Expel is a Herndon-based MDR provider whose service plugs into a customer's existing security tools rather than replacing them. Its project pipeline is unusually Microsoft-centric: Defender XDR and Sentinel detection coverage, signal mapping, and ingestion schema work, backed by an Iceberg, Glue and Lake Formation data layer. Hiring is accelerating and security-weighted at senior levels, while pain points around ingestion costs and alert noise mirror what its own customers face.
Expel, founded in 2016 and headquartered in Herndon, Virginia, provides managed detection and response services that use AI to speed up and sharpen the work of human security analysts. The service covers cloud, identity, email, SIEM, SaaS and on-prem environments and integrates with security tools customers already run, including CrowdStrike, Splunk, Okta and the Microsoft security suite. The company is privately held with 201–500 employees and currently hires in the United States. Its go-to-market runs on Salesforce, Salesforce CPQ, Marketo, 6sense, Outreach and ZoomInfo.
Expel uses AWS, Azure and GCP, Microsoft Defender XDR, Sentinel, Splunk, CrowdStrike and Okta, a data layer on Apache Iceberg, AWS Glue and Lake Formation, plus Salesforce, Marketo, Outreach and Workday on the business side.
Current projects include expanding detection coverage across the Microsoft security estate, Microsoft ingestion and schema mapping, integration roadmap and lifecycle management, SIEM optimization, SOAR playbooks and AI tooling integration.
Yes. Hiring is accelerating and led by security positions, mostly at senior level, with additional openings in sales, engineering, product and HR, all based in the United States.
Other companies in the same industry, closest in size
Expel's technology stack, projects, and hiring signals are inferred from public hiring and company data — career pages, public listings, and company web presence — then clustered and de-duplicated. Figures are estimates that refresh over time. Read our full methodology →
This is not an official vendor or customer list. It is a technology-adoption signal inferred from public data, intended for B2B research.