Associate Detection & Response Engineer

Imagine yourself as a SOC analyst and a new alert shoots to the top of the queue. You open the alert and all of the relevant facts are laid out for you. You know the whos the whats and the wheres of what happened and it’s all right there in the alert. You notice the attacker IP immediately you wonder “Where is that IP located?”. Wonder no more because the IP has already been fully enriched with all publicly available information! This looks bad, just as you’re about to shift to the EDR console to see what kind of damage was done, you notice further down that’s already been provided for you. You have full context of everything that happened before, during and after this event and it’s confirming your suspicions. You raise the alarm and notify the customer that you’re digging into a potential security incident and it only took 20 seconds to make that decision. 

Now imagine you are the one who created that alert. You understand security operations and have a keen understanding of what information is needed to make an informed decision about a potential attack. You know the sort of enrichment needed to provide the right context about the facts of the alert. You know how to streamline the response process through automation. Now imagine that the SOC analyst never even needed to triage the alert because of your automations, it was automatically promoted to an incident for the SOC.

You also enjoy working together on a team to prioritize the problems that matter and work toward a solution. And you have a high degree of empathy and understand the demands of working in a SOC environment. You understand that scaling operations doesn’t always mean scaling with more people, the real strength comes when you can arm analysts with the tools they need to become super heroes.

Does this sound like you? At Expel, we’re taking a new approach to managed security. We spend our time trying to discover ways to keep our customers safe and our security analysts happy. We’re trying to meet our customers where they are—understanding a vast number of attacker tactics, security vendor capabilities, and customer requirements. We believe innovating while handling the combinatorial explosion represents a captivating problem. If you agree, we may have the job for you!

What Expel can do for you

• Give you an opportunity to collaboratively drive a significant security capability of the business
• Enable you to learn from analysts, data scientists, engineers, and responders responsible for various components of Expel’s service and technology
• Facilitate ways to harness event signal from cloud service providers
• Provide an entertaining small and highly transparent startup environment
• Challenge you to push the boundaries of our security vision
• Provide access to popular EDR, network, and SIEM technologies

What you can do for Expel

• Maintain and improve Expel's ability to detect and investigate threats using integrated technologies.
• Continuously improve Expel’s detection capability through creation of rules for Expel’s proprietary rule engine.
• Improve SOC analyst efficiency by automating investigative workflows using an orchestration framework written in Python.
• Gain familiarity with Expel’s integrations and engineering standards associated with each class of integration.
• Thrive in a culture of experimentation, agile, quality and continuous improvement among the team.
• Participate in the team’s research and monitoring of the latest threat landscape and subsequent detection development.
• Communicate effectively with stakeholders on support requests surfaced to the D&R engineering team.

What you should bring with you

• Familiarity with detection and response tools
• Knowledge of attack vectors, threat tactics, and attacker techniques
• Hands-on experience developing in Python for the purposes of automating mundane tasks
• Understanding of Windows and Linux operating systems and command line tools
• Familiarity with networking fundamentals, TCP/IP and core protocols
• Developing an expertise in one or more of the following technical areas: data analytics, remediation strategies, and offensive security
• Experience with cloud or container platforms is a tremendous advantage

Additional Notes

Pay range: $93,900 USD to $136,200 USD + bonus eligibility and equity.

We believe in paying transparently and equitably. Your salary will ultimately be based on factors such as your experience, skills, team equity, and market data. You’ll also be eligible for unlimited PTO (which we model and encourage), work location flexibility, up to 24 weeks of parental leave, and really excellent health benefits.

We're only hiring those authorized to work in the United States. We do not currently sponsor immigration visas.

We're an Equal Opportunity Employer: you’ll receive consideration for employment without regard to race, sex, color, religion, sexual orientation, gender identity, national origin, protected veteran status, or on the basis of disability.

We will ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please contact us to request accommodation.

#LI-Remote