Senior Detection & Response Engineer, Expel
$138.8-201k
+ Bonus Eligibility and Equity.
More information about location
Cyber security threat detection & management
Open for applications
Cyber security threat detection & management
501-1000 employees
Open for applications
$138.8-201k
+ Bonus Eligibility and Equity.
More information about location
501-1000 employees
Company mission
Expel is on a mission to make security easy to understand, easy to use, and easy to continuously improve.
Role
Who you are
- 3+ years of experience with detection and response tools, particularly EDR, NSM, and SIEM
- 3+ years of experience writing, deploying and tuning custom detections based on research or investigative work against common data sets (Windows Event Logs, auditd, CloudTrail, and similar datasets.)
- Proficiency of Python, Go or other object oriented programming languages
- Strong understanding of Windows, macOS and Linux operating systems and command line tools
- Knowledge of networking basics, such as TCP/IP and OSI model
- Expert knowledge and observations of attack vectors, threat tactics, and attacker techniques
- Intermediate knowledge of cloud infrastructure platforms and their Identity and Access Management (IAM) models
- Cursory understanding of common Software-as-a-Service (SaaS) applications and available security signal
- Bachelor’s degree in Computer Science or Information Security strongly preferred
- 5+ years of professional experience in information technology or security operations would be ideal but not required
What the job involves
- You understand security operations and have a keen understanding of what information is needed to make an informed decision about a potential attack
- You know the sort of enrichment needed to provide the right context about the facts of the alert
- You have studied the metrics from previous investigations and know where analysts get tripped up or slowed down on decisions during the moments that matter
- You streamline the response process through automation and make sure the decisions can be made quickly
- Now imagine that the SOC analyst never even needed to triage the alert because of your automations, it was automatically promoted to an incident for the SOC
- You also enjoy working together on a team to prioritize the problems that matter and work toward a solution
- And you have a high degree of empathy and understand the demands of working in a SOC environment
- You understand that scaling operations doesn’t always mean scaling with more people, the real strength comes when you can arm analysts with the tools they need to become super heroes
- Place you into the middle of a fast-growing cybersecurity company with the most enthusiastic customers you’ve ever seen—a welcome surprise in the MSSP/MDR market
- Give you an opportunity to collaboratively drive a significant security capability of the business
- Enable you to learn from analysts, data scientists, engineers, and responders responsible for various components of Expel’s service and technology
- Facilitate ways to harness event signal from cloud service providers
- Provide an entertaining small and highly transparent startup environment
- Challenge you to push the boundaries of our security vision
- Provide access to popular EDR, network, and SIEM technologies
- Architect, maintain and iteratively improve Expel's ability to detect and investigate threats using integrated technologies with limited direction
- Continuously improve Expel’s detection strategy and capability through creation of detections for Expel’s proprietary rule engine
- Maintain documentation in support of Expel’s detection and response content
- Improve SOC analyst efficiency by automating investigative workflows using an orchestration framework written in Python
- Collaborate with engineering on Expel’s integrations and engineering standards associated with each class of integration
- Evaluate technology APIs to design detection and response solutions to drive value and efficiency in Expel’s Workbench platform
- Contribute to and thrive in a culture of experimentation, agile, quality and continuous improvement among the team
- Take a leading role in the team’s research and monitoring of the latest threat landscape and subsequent detection and response automation development
- Communicate effectively with stakeholders on support requests surfaced to the D&R engineering team
- Mentor less experienced team members and SOC analysts
- Bridge the Engineering to effectively identify new platform features and tools to better enable the growth of our detection and response capabilities
Our take
As ransomware and hacking threats rise, identifying and resolving breaches in security must be done quickly. Lack of transparency in cyber-security makes it difficult for engineers to detect, understand, and fix the issues as fast as possible. Expel is aiming to redefine what a security operations center and managed detection service looks like in the modern age.
Though the company faces competition from the vast number of cybersecurity platforms, Expel positions itself as a viable alternative to the service delivery model of managed security service providers (MSSPs) by offering a comprehensive management platform that connects to its customers’ tech remotely through APIs, providing fast detection and clear solutions.
Having reached unicorn status, the company is establishing more of a presence in the European and Asia-Pacific markets, capturing business in Canada, the United Kingdom, Australia and Singapore. Its most recent funding will be used to accelerate sustainable growth and continue its international expansion, as well as push forward with go-to-market initiatives.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
Company
Funding (last 2 of 6 rounds)
Oct 2022
$31m
SERIES E
Nov 2021
$140.3m
SERIES E
Total funding: $288.8m
Company benefits
- Flexible work hours and locations
- Unlimited time off - includes vacation, personal days, and an annual company-wide restorative day
- 24 weeks parental leave when you, your spouse or your domestic partner gives birth to a child, adopts a child or becomes a foster parent (first 12 weeks paid)
- Military leave
- Paid annual conference - we reimburse you up to $2,500 to attend at least one conference every year that helps you move your career forward
- One month sabbatical after hitting your 5 year anniversary
- Zero-meetings week each quarter - where all Expletives are challenged to reduce the number of internal meetings on their calendar all the way to zero
- Medical insurance through the Cigna Open Access Plus HRA plan
- Dental & vision insurance through Guardian
- Team touchdowns - Expel Teams are encouraged to come together quarterly for planning, for connecting, for energizing and maybe a little fun
- Fitness stipend
- Cell phone stipend
- Employee Assistance Program
- Telemedicine (Cigna’s Telehealth Connection)
- Access to the popular mental health platforms, Ginger and Talkspace
- BenefitHub - a web portal where Expel employees can enjoy discounts, cash back rewards and perks on thousands of brands in a variety of categories!
- Retirement 401(k) account provided by Principal
- Health Reimbursement Arrangement (Cigna)
- Flexible Spending Accounts
- Student loan refinancing
Company HQ
Herndon, VA
Articles
Leadership
Dave Merkel
(CEO)Previous CTO of both FireEye and Mandiant (also VP, Products and Threat Management Services). Previously worked as the Senior Technical Director at America Online and for the US Air Force as an Assistant Chief of Intrusion Invasions.
Justin Bajko
(VP of Strategy & Business Development)Previous Managing Director (MCIRT Operations) at Mandiant and Senior Manager of Global Security Analysis at Symantec. Previously worked as a Network Administrator at Clinical Trial Management Services, and was a Network and Systems Administrator at MiniFibers.
Yanek Korff
(Chief of Staff)Previous COO at Expel. Current Board Member at ThreatSwitch and Investor at Berg Capital Group. Previous Member of the Technical Advisory Board at Ntrepid Corp and CP an CTO at FireEye.
Share this job
View 4 more jobs at Expel