Headquarters: Remote

Are you a detection engineer who wants to bring real depth of expertise into a new and growing function and use it to deliver security excellence to customers? Expel's professional services practice is just getting started, and we're looking for the technical expert who'll deliver the work that gets customers ready to thrive under our co-managed SIEM model. You'll bring hands-on skill to a team that's finding its stride, help it grow, and have a real runway to grow into a lead yourself.

Here's the work. Customers come to us with SIEMs that should be surfacing threats but are instead consuming their teams: ingestion costs climbing year over year, engineers buried in alert noise and broken pipelines, and detection blind spots leaving real gaps. You're the engineer who turns that around: authoring and tuning detection content that satisfies real security use cases, closing coverage gaps, migrating detection logic off legacy platforms, and helping optimize what customers ingest and pay for, so their SIEM becomes a force multiplier again, not a management burden.

And because this function evolves right alongside our customers and the market, the work won't stand still. Expect it to grow into deeper integrations, automated and AI-assisted tooling, and security strategies our customers need next.

What Expel can do for you

Give you a ground-floor seat in a new professional services function, where your expertise directly shapes the quality of what we deliver to customers
Provide real runway for professional development as the function grows
Put you on complex, high-stakes detection and SIEM problems across a wide range of customer environments
Let you work across leading SIEM platforms, including Splunk, Microsoft Sentinel, and CrowdStrike NG SIEM, plus emerging AI-assisted tooling
Give you visibility and partnership across the organization, including Sales, Detection Engineering, our SOC, and Customer Success
Accelerate your career by letting you own meaningful outcomes end to end

What you can do for Expel

Deliver end-to-end professional services engagements, including detection strategy, MITRE ATT&CK assessment, SIEM optimization and integrations, SOAR playbook development, and custom log parsing
Develop and validate detection content that satisfies defined security use cases, at onboarding and as environments evolve, with strong coverage and clean fidelity
Optimize SIEM performance and cost by tuning detections for fidelity, reducing alert noise, and improving ingestion efficiency
Contribute to Expel's professional services proprietary detection library, continuously improving our detection strategy and capability
Translate detection logic between SIEM platforms and write custom parsers for standard and non-standard log sources, using

Managed SIEM Detection Engineer

Compensation & logistics

Similar Jobs

What Expel can do for you

What you can do for Expel