Managed SIEM Detection Engineer

Who you are

• Are you a detection engineer who wants to bring real depth of expertise into a new and growing function and use it to deliver security excellence to customers?
• Hands-on SIEM expertise across Splunk, Microsoft Sentinel, and/or CrowdStrike NG SIEM, including architecture, data ingestion, and detection rule development
• 3+ years with detection and response tooling, particularly SIEM, SOAR, and EDR
• 3+ years writing, deploying, and tuning custom detections from research or investigative work against common datasets (Windows Event Logs, auditd, CloudTrail, and similar)
• SIEM migration experience translating detection logic between platforms and re-pointing log sources
• Working knowledge of attacker tactics and techniques and the MITRE ATT&CK framework
• Solid fundamentals across Windows, macOS, and Linux, networking basics (TCP/IP, OSI), and working knowledge of cloud IAM models and platforms
• Basic proficiency with Python, Go, or similar, and comfort using Git/GitHub for version control of detection content, scripts, and templates
• Curiosity, strong ownership, and the appetite for growth
• A willingness to travel up to 20%
• One or more SIEM or vendor certifications (e.g., Splunk Core Certified Power User or Enterprise Security Certified Admin, Microsoft SC-200, CrowdStrike CCFA/CCFR)
• Experience authoring platform-agnostic detections with Sigma and converting rules across SIEM backends
• Familiarity with detection-as-code practices, including version-controlled rules, testing, and CI/CD for detection content
• Industry security certifications such as GIAC (e.g., GCDA, GCIA), Security+, or similar
• A bachelor's degree in Computer Science or Information Security

What the job involves

• Expel's professional services practice is just getting started, and we're looking for the technical expert who'll deliver the work that gets customers ready to thrive under our co-managed SIEM model. You'll bring hands-on skill to a team that's finding its stride, help it grow, and have a real runway to grow into a lead yourself
• Here's the work. Customers come to us with SIEMs that should be surfacing threats but are instead consuming their teams: ingestion costs climbing year over year, engineers buried in alert noise and broken pipelines, and detection blind spots leaving real gaps
• You're the engineer who turns that around: authoring and tuning detection content that satisfies real security use cases, closing coverage gaps, migrating detection logic off legacy platforms, and helping optimize what customers ingest and pay for, so their SIEM becomes a force multiplier again, not a management burden
• And because this function evolves right alongside our customers and the market, the work won't stand still. Expect it to grow into deeper integrations, automated and AI-assisted tooling, and security strategies our customers need next
• Give you a ground-floor seat in a new professional services function, where your expertise directly shapes the quality of what we deliver to customers
• Provide real runway for professional development as the function grows
• Put you on complex, high-stakes detection and SIEM problems across a wide range of customer environments
• Let you work across leading SIEM platforms, including Splunk, Microsoft Sentinel, and CrowdStrike NG SIEM, plus emerging AI-assisted tooling
• Give you visibility and partnership across the organization, including Sales, Detection Engineering, our SOC, and Customer Success
• Accelerate your career by letting you own meaningful outcomes end to end
• Deliver end-to-end professional services engagements, including detection strategy, MITRE ATT&CK assessment, SIEM optimization and integrations, SOAR playbook development, and custom log parsing
• Develop and validate detection content that satisfies defined security use cases, at onboarding and as environments evolve, with strong coverage and clean fidelity
• Optimize SIEM performance and cost by tuning detections for fidelity, reducing alert noise, and improving ingestion efficiency
• Contribute to Expel's professional services proprietary detection library, continuously improving our detection strategy and capability
• Translate detection logic between SIEM platforms and write custom parsers for standard and non-standard log sources, using AI-assisted tools where they help and validating the outputs
• Partner with Detection Engineering and the SOC to hand off environments ready for ongoing co-managed operations, and work with SOC analysts to sharpen the fidelity and actionability of rules and alerts
• Track the evolving threat landscape and turn it into new detection development
• Help the function grow by contributing repeatable processes, templates, and tooling that raise the quality and consistency of what we deliver

Benefits

• Flexible work hours and locations
• Unlimited time off - includes vacation, personal days, and an annual company-wide restorative day
• 24 weeks parental leave when you, your spouse or your domestic partner gives birth to a child, adopts a child or becomes a foster parent (first 12 weeks paid)
• Military leave
• Paid annual conference - we reimburse you up to $2,500 to attend at least one conference every year that helps you move your career forward
• One month sabbatical after hitting your 5 year anniversary
• Zero-meetings week each quarter - where all Expletives are challenged to reduce the number of internal meetings on their calendar all the way to zero
• Medical insurance through the Cigna Open Access Plus HRA plan
• Dental & vision insurance through Guardian
• Team touchdowns - Expel Teams are encouraged to come together quarterly for planning, for connecting, for energizing and maybe a little fun
• Fitness stipend
• Cell phone stipend
• Employee Assistance Program
• Telemedicine (Cigna’s Telehealth Connection)
• Access to the popular mental health platforms, Ginger and Talkspace
• BenefitHub - a web portal where Expel employees can enjoy discounts, cash back rewards and perks on thousands of brands in a variety of categories!
• Retirement 401(k) account provided by Principal
• Health Reimbursement Arrangement (Cigna)
• Flexible Spending Accounts
• Student loan refinancing