Manager, Detection & Response Engineering

Imagine yourself as a SOC analyst and a new alert shoots to the top of the queue. You open the alert and all of the relevant facts are laid out for you. You know the whos the whats and the wheres of what happened and it’s all right there in the alert. You notice the attacker IP immediately you wonder “Where is that IP located?”. Wonder no more because the IP has already been fully enriched with all publicly available information! This looks bad, just as you’re about to shift to the EDR console to see what kind of damage was done, you notice further down that’s already been provided for you. You have full context of everything that happened before, during and after this event and it’s confirming your suspicions. You raise the alarm and notify the customer that you’re digging into a potential security incident and it only took 20 seconds to make that decision. 

Now imagine you lead the team that created that alert. You understand security operations and have a keen understanding of what information is needed to make an informed decision about a potential attack. You know the sort of enrichment needed to provide the right context about the facts of the alert. You have studied the metrics from previous investigations and know where analysts get tripped up or slowed down on decisions during the moments that matter. You enable your team to streamline the response process through automation and make sure the decisions can be made quickly. Now imagine that the SOC analyst never even needed to triage the alert because of your automations, it was automatically promoted to an incident for the SOC.

You also enjoy working together on a team to prioritize the problems that matter and work toward a solution. And you have a high degree of empathy and understand the demands of working in a SOC environment. You understand that scaling operations doesn’t always mean scaling with more people, the real strength comes when you can arm analysts with the tools they need to become super heroes.

Does this sound like you? At Expel, we’re taking a new approach to managed security. We spend our time trying to discover ways to keep our customers safe and our security analysts happy. We’re trying to meet our customers where they are—understanding a vast number of attacker tactics, security vendor capabilities, and customer requirements. We believe innovating while handling the combinatorial explosion represents a captivating problem. If you agree, we may have the job for you!

What Expel can do for you

• Place you into the middle of a fast-growing cybersecurity company with the most enthusiastic customers you’ve ever seen—a welcome surprise in the MSSP/MDR market
• Give you an opportunity to collaboratively drive a significant security capability of the business
• Enable you to learn from analysts, data scientists, engineers, and responders responsible for various components of Expel’s service and technology
• Provide access to Expel’s proprietary automation engine allowing you to develop content and expand capabilities
• Provide an entertaining small and highly transparent startup environment
• Challenge you to push the boundaries of our security vision
• Give you access to popular EDR, network, SIEM, and Cloud technologies

What you can do for Expel

• Improve and maintain the detection and response strategy of Expel’s Workbench platform in order to meet the scale of our growing customer base. 
• Grow a team of skilled detection engineers with deep EDR detection writing experience.
• Lead your team to grow a sustainable model for continuously adding content to Expel’s product.
• Maintain and evolve a detection and response strategy that meets the needs of all of our customers, in terms of both coverage and efficiency. 
• Consistently develop and maintain a deep understanding of adversary behavior, tools, and techniques to drive forward new approaches to detection and response.
• Continuously provide feedback and coaching to inspire a high-performing team of detection and response engineers.
• Collaborate with sister teams, UX, product management, and senior leadership.
• Shape how the security industry thinks about detection and response at scale by creating new and novel approaches for SOC analysts investigating and responding to alerts in a queue.

What you should bring with you

• Expertise in writing efficient and effective detections for EDRs, ideally at an MDR,a service provider, or as part of a security product’s research team.
• Deep understanding of attacker behavior, mapping that behavior to MITRE ATT&CK, building coverage around that behavior, and measuring that coverage at scale.
• Experience using response automation to improve detection efficacy
• Familiarity with a range of detection and response tools including but not limited to EDR, NSM, EUBA, SIEM, and cloud detection and response products.
• Proficient in Python or Golang programming languages.
• Understanding of various operating systems and cloud service platforms.
• The ability to analyze event and systems logs, perform forensic analysis, analyze malware, and other incident response related data, as needed.
• Knowledge of attack surfaces and corresponding attacker tactics, techniques and procedures
• Comfortable with enterprise security architecture, detection, and response.
• Ability to identify relevant data sources, normalize them across toolsets, and work with detection engines to drive effective correlation, automation and orchestration. 
• Education and Experience
• Extensive experience in threat detection and incident response within the context of a managed service, incident response consulting organization, or for a security product’s research team. 
• Experience mentoring or managing security analysts, researchers, engineers, or data scientists
• Bachelor’s degree or compelling story
• 5+ years of related professional experience

The Details

The base salary range for this role is between $146,900 USD and $213,000 USD + bonus eligibility and equity.

We believe in paying transparently and equitably. Your salary will ultimately be based on factors such as your experience, skills, team equity, and market data. You’ll also be eligible for unlimited PTO (which we model and encourage), work location flexibility, up to 24 weeks of parental leave, and really excellent health benefits.

We're only hiring those authorized to work in the United States.

We're an Equal Opportunity Employer: You will receive consideration for employment without regard to race, sex, color, religion, sexual orientation, gender identity, national origin, protected veteran status, or on the basis of disability.

We’ll ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform crucial job functions, and to receive other benefits and privileges of employment. Please let us know if you need accommodation of any kind.

#LI-Remote