Apply on Employer Site

Expel · 1 month ago

Detection & Response Engineer

United States

Full-time

Remote

Entry, Mid Level

$118K/yr - $172K/yr

1+ years exp

Expel is a fast-growing cybersecurity company that focuses on managed security services. The Detection & Response Engineer will be responsible for enhancing threat detection capabilities and automating workflows to improve SOC analyst efficiency.

Cloud SecurityCyber SecurityNetwork SecuritySaaS

Growth Opportunities

No H1B

Responsibilities

Implement, maintain and iteratively improve Expel's ability to detect and investigate threats using integrated technologies with limited direction

Contribute to the growth of Expel’s detection strategy and capability through creation of detections for Expel’s proprietary rule engine

Maintain documentation in support of Expel’s detection and response content

Improve SOC analyst efficiency by automating investigative workflows using an orchestration framework written in Python

Evaluate technology APIs to design detection and response solutions to contribute to improving the value and efficiency in Expel’s Workbench platform

Contribute to and thrive in a culture of experimentation, agile, quality and continuous improvement among the team

Participate in the team’s research and monitoring of the latest threat landscape and subsequent detection and response automation development

Qualification

DetectionResponse toolsPython programmingCustom detectionsWindows operating systemLinux operating systemMacOS operating systemNetworking basicsCloud infrastructureSoft skills

Required

1+ years of experience with detection and response tools, particularly EDR, NSM, and SIEM

1+ years of experience writing, deploying and tuning custom detections based on research or investigative work against common data sets (Windows Event Logs, auditd, CloudTrail, and similar datasets.)

Proficiency of Python, Go or other object oriented programming languages

Strong understanding of Windows, macOS and Linux operating systems and command line tools

Knowledge of networking basics, such as TCP/IP and OSI model

Working knowledge and observations of attack vectors, threat tactics, and attacker techniques

Understanding of cloud infrastructure platforms and their Identity and Access Management (IAM) models