Principal EDR & XDR Engineer

Job-:
Technology

Location:

United Kingdom Workplace:
Hybrid

Schedule:

Full time, Days Posted:
Closes:
Summary The Principal EDR & XDR Engineer is a senior technical role responsible for the engineering, optimisation, and strategic development of the organisation's Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms. The role will act as the technical Subject Matter Expert (SME) for Microsoft Defender XDR and Crowd Strike Falcon, ensuring the organisation maintains effective endpoint visibility, threat detection, and incident response capabilities.

Based on the source role's emphasis on SIEM leadership and detection capabilities. Working closely with the CDC Engineering Manager, Security Operations, Incident Response, Threat Intelligence, and Security Architecture teams, the successful candidate will develop and maintain advanced detection capabilities, improve platform performance, enhance security visibility, and ensure EDR and XDR technologies remain aligned with the evolving threat landscape.

What you'll doLead the engineering, optimisation, governance and lifecycle management of Microsoft Defender XDR and Crowd Strike Falcon, ensuring resilient, scalable and effective endpoint protection.

Develop, tune and validate high-fidelity detections across EDR, XDR and Microsoft Sentinel, using MITRE ATT&CK, threat intelligence and incident insights to improve coverage and alert quality.

Perform advanced threat hunting and support complex investigations, working with Security Operations and Incident Response teams to identify threats and close detection gaps.

Provide technical leadership for security monitoring architecture, integrations and the cyber defence roadmap, evaluating new capabilities to strengthen detection and response maturity.

Establish engineering standards, Detection-as-Code and CI/CD practices, maintain technical documentation, mentor engineers and advise stakeholders on platform effectiveness and strategic improvements.

Who you are Extensive senior-level experience in EDR, XDR, security engineering, security operations or cyber defence within complex enterprise environments.

Deep subject-matter expertise in Microsoft Defender XDR and Crowd Strike Falcon, with strong knowledge of endpoint detection, platform optimisation and enterprise security monitoring.

Proven experience developing detection content across EDR, XDR and SIEM platforms, including Microsoft Sentinel, KQL, advanced hunting and MITRE ATT&CK-aligned analytics.

Strong capability in threat hunting, threat intelligence integration, incident investigation and response, with the ability to identify and resolve detection gaps.

Experience leading security architecture, platform integrations and technical projects, using Detection-as-Code, CI/CD and engineering best practices while influencing stakeholders and producing clear technical documentation.

What’s in it for you? Working at M&S means being part of something bigger - helping to deliver quality, value and service to millions of customers every day. We’re inclusive, fast-moving and always evolving, with a strong sense of purpose and a focus on doing the right thing.

Here are just a few of the benefits that make working here even more rewarding:20% colleague discount on all M&S products and many third-party brands for you and someone in your household, available once you’ve completed your probation

Competitive holiday allowance with the option to buy more Discretionary bonus schemes linked to your performance and ours Strong pension and life assurance to help plan for the future

Tailored induction and training to support your development from day one Exclusive perks and savings through our M&S Choices portal

Market-leading family policies,…