Director of Detection & Response Engineering, Expel
$179.6-245.5k
+ Bonus Eligibility + Equity
More information about location
Cyber security threat detection & management
Be an early applicant
Cyber security threat detection & management
501-1000 employees
Be an early applicant
$179.6-245.5k
+ Bonus Eligibility + Equity
More information about location
501-1000 employees
Company mission
Expel is on a mission to make security easy to understand, easy to use, and easy to continuously improve.
Role
Who you are
- 10+ years in threat detection and incident response within the context of managed services, incident response, security product research teams, and/or large enterprise security teams
- 5+ years mentoring security analysts, researchers, engineers, or data scientists
- A deep understanding of attack surfaces, corresponding attacker behaviors, how behaviors map to MITRE ATT&CK, and how to deliver coverage for those behaviors
- Experience with a wide range of security solutions across categories such as Endpoint, Network, Cloud, Identity, SIEM/XDR, and security orchestration
- Experience implementing cybersecurity schemas such as OCSF, ASIM, CIM, or ECS to accelerate detection and response delivery is a plus
- Knowledge of common ML techniques and experience applying machine learning techniques in cybersecurity is a plus
What the job involves
- Imagine yourself as a SOC analyst and a new alert pops to the top of the queue
- You open the alert and all of the data you need to make a decision is present
- In just a few seconds you’ve notified the customer of a potential security incident
- After completing the investigation, you find yourself waiting in vain for another alert to appear in the queue (hey, we’re dreaming here, right?!)
- An alert finally pops up but it’s immediately triaged by the system; a combination of AI and automation classified the alert as benign, leaving you time to finish your research into the latest MFA bypass techniques
- Now, imagine you lead the teams that enabled both of these scenarios
- Your teams created the detection logic that produced the alert, built the response actions that enriched the alert, and automated the SOC playbook that made the decision
- You prioritized this work with the data-driven detection program you’ve established
- But you can’t stop at the prioritization and creation of content
- Your team is also a core driver of the continuous evolution of the platform
- You have a running list of the features you need built to mitigate the running-even-faster list of emerging TTPs, and it's all backed up with research
- The research spikes you prioritized are informed by the continuous detection gap analyses your teams perform of the attacks we see every day
- This is why you worked so closely with the Data Science team to build the ML model that now safely auto-closes false positive alerts
- Create the strategy and operational processes to rapidly support the ingestion of new security signals, deliver world-class detections, build effective automation, and ultimately drive the security value and scalability of the MDR service
- Create processes and tools to measure our adherence to this strategy. Maintain and evolve the strategy to balance the needs of our customers and our SOC, in terms of both coverage and efficiency
- Structure your teams to support rapid service delivery, while maintaining a consistent focus on innovation. Strike that perfect balance between reactive and proactive
- Lead, inspire, and organize multiple, high-performing teams of detection and response engineers
Our take
As ransomware and hacking threats rise, identifying and resolving breaches in security must be done quickly. Lack of transparency in cyber-security makes it difficult for engineers to detect, understand, and fix the issues as fast as possible. Expel is aiming to redefine what a security operations center and managed detection service looks like in the modern age.
Though the company faces competition from the vast number of cybersecurity platforms, Expel positions itself as a viable alternative to the service delivery model of managed security service providers (MSSPs) by offering a comprehensive management platform that connects to its customers’ tech remotely through APIs, providing fast detection and clear solutions.
Having reached unicorn status, the company is establishing a stronger presence in the European and Asia-Pacific markets, capturing business in Canada, the United Kingdom, Australia, and Singapore. Its 2022 funding is being used to accelerate sustainable growth, continue the company's international expansion, and push forward with go-to-market initiatives.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
17% employee growth in 12 months
Company
Funding (last 2 of 6 rounds)
Oct 2022
$31m
SERIES E
Nov 2021
$140.3m
SERIES E
Total funding: $288.8m
Company benefits
- Flexible work hours and locations
- Unlimited time off - includes vacation, personal days, and an annual company-wide restorative day
- 24 weeks parental leave when you, your spouse or your domestic partner gives birth to a child, adopts a child or becomes a foster parent (first 12 weeks paid)
- Military leave
- Paid annual conference - we reimburse you up to $2,500 to attend at least one conference every year that helps you move your career forward
- One month sabbatical after hitting your 5 year anniversary
- Zero-meetings week each quarter - where all Expletives are challenged to reduce the number of internal meetings on their calendar all the way to zero
- Medical insurance through the Cigna Open Access Plus HRA plan
- Dental & vision insurance through Guardian
- Team touchdowns - Expel Teams are encouraged to come together quarterly for planning, for connecting, for energizing and maybe a little fun
- Fitness stipend
- Cell phone stipend
- Employee Assistance Program
- Telemedicine (Cigna’s Telehealth Connection)
- Access to the popular mental health platforms, Ginger and Talkspace
- BenefitHub - a web portal where Expel employees can enjoy discounts, cash back rewards and perks on thousands of brands in a variety of categories!
- Retirement 401(k) account provided by Principal
- Health Reimbursement Arrangement (Cigna)
- Flexible Spending Accounts
- Student loan refinancing
Company HQ
Herndon, VA
Leadership
Dave Merkel
(CEO & Co-Founder)Previous CTO of both FireEye and Mandiant (also VP, Products and Threat Management Services). Previously worked as the Senior Technical Director at America Online and for the US Air Force as an Assistant Chief of Intrusion Invasions.
Justin Bajko
(VP of Strategy & Business Development & Co-Founder)Previous Managing Director (MCIRT Operations) at Mandiant and Senior Manager of Global Security Analysis at Symantec. Previously worked as a Network Administrator at Clinical Trial Management Services, and was a Network and Systems Administrator at MiniFibers.
Yanek Korff
(Chief of Staff & Co-Founder)Previous COO at Expel. Current Board Member at ThreatSwitch and Investor at Berg Capital Group. Previous Member of the Technical Advisory Board at Ntrepid Corp and CP an CTO at FireEye.
Share this job
View 2 more jobs at Expel