Principal EDR & XDR Engineer

Summary

The Principal EDR & XDR Engineer is a senior technical role responsible for the engineering, optimisation, and strategic development of the organisation's Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms. The role will act as the technical Subject Matter Expert (SME) for Microsoft Defender XDR and CrowdStrike Falcon, ensuring the organisation maintains effective endpoint visibility, threat detection, and incident response capabilities. Based on the source role's emphasis on SIEM leadership and detection capabilities. 

Working closely with the CDC Engineering Manager, Security Operations, Incident Response, Threat Intelligence, and Security Architecture teams, the successful candidate will develop and maintain advanced detection capabilities, improve platform performance, enhance security visibility, and ensure EDR and XDR technologies remain aligned with the evolving threat landscape.

What you'll do

• Lead the engineering, optimisation, governance and lifecycle management of Microsoft Defender XDR and CrowdStrike Falcon, ensuring resilient, scalable and effective endpoint protection.
• Develop, tune and validate high-fidelity detections across EDR, XDR and Microsoft Sentinel, using MITRE ATT&CK, threat intelligence and incident insights to improve coverage and alert quality.
• Perform advanced threat hunting and support complex investigations, working with Security Operations and Incident Response teams to identify threats and close detection gaps.
• Provide technical leadership for security monitoring architecture, integrations and the cyber defence roadmap, evaluating new capabilities to strengthen detection and response maturity.
• Establish engineering standards, Detection-as-Code and CI/CD practices, maintain technical documentation, mentor engineers and advise stakeholders on platform effectiveness and strategic improvements.

Who you are

• Extensive senior-level experience in EDR, XDR, security engineering, security operations or cyber defence within complex enterprise environments.
• Deep subject-matter expertise in Microsoft Defender XDR and CrowdStrike Falcon, with strong knowledge of endpoint detection, platform optimisation and enterprise security monitoring.
• Proven experience developing detection content across EDR, XDR and SIEM platforms, including Microsoft Sentinel, KQL, advanced hunting and MITRE ATT&CK-aligned analytics.
• Strong capability in threat hunting, threat intelligence integration, incident investigation and response, with the ability to identify and resolve detection gaps.
• Experience leading security architecture, platform integrations and technical projects, using Detection-as-Code, CI/CD and engineering best practices while influencing stakeholders and producing clear technical documentation.

What’s in it for you? 

Working at M&S means being part of something bigger - helping to deliver quality, value and service to millions of customers every day. We’re inclusive, fast-moving and always evolving, with a strong sense of purpose and a focus on doing the right thing.

Here are just a few of the benefits that make working here even more rewarding:

• 20% colleague discount on all M&S products and many third-party brands for you and someone in your household, available once you’ve completed your probation
• Competitive holiday allowance with the option to buy more
• Discretionary bonus schemes linked to your performance and ours
• Strong pension and life assurance to help plan for the future
• Tailored induction and training to support your development from day one
• Exclusive perks and savings through our M&S Choices portal
• Market-leading family policies, including parental, adoption and neonatal leave
• 24/7 wellbeing support, including virtual GP access and mental health services
• One paid volunteer day a year to support a cause that matters to you

Everyone’s welcome 

We are ambitious about the future of retail. We’re disrupting, innovating and leading the industry into a more conscientious, inspiring digital era. We’re transforming how we work together and offering our most exciting opportunities yet. Marks & Spencer strives to be an inclusive organisation, trusted and admired by our colleagues, customers and suppliers. Join us and make change happen.

We are committed to building diverse and representative teams, where everyone can bring their whole selves to work and be at their best. We support each other and work together to win together.

If you feel you'd benefit from any support or reasonable adjustments during any stage of the recruitment process, please don’t hesitate to let us know when completing your application. This information will be picked up by our team, so we can try and put steps in place to help you be at your best through this process.

#LI-hybrid #LI-CC1 #hybridrole