# Principal EDR & XDR Engineer **Company**: Marks & Spencer **Location**: London **Work arrangement**: hybrid **Experience**: senior **Job type**: full-time **Category**: Security **Industry**: Technology **Apply**: https://fa-eqid-saasfaprod1.fa.ocs.oraclecloud.com/hcmUI/CandidateExperience/en/sites/CX_1/job/131855?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_eb2ae33f-56c ## Description The Principal EDR & XDR Engineer is a senior technical role responsible for the engineering, optimisation, and strategic development of the organisation's Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms. Working closely with the CDC Engineering Manager, Security Operations, Incident Response, Threat Intelligence, and Security Architecture teams, the successful candidate will develop and maintain advanced detection capabilities, improve platform performance, enhance security visibility, and ensure EDR and XDR technologies remain aligned with the evolving threat landscape. **Responsibilities:** - Lead the engineering, optimisation, governance, and lifecycle management of Microsoft Defender XDR and CrowdStrike Falcon, ensuring resilient, scalable, and effective endpoint protection. - Develop, tune, and validate high-fidelity detections across EDR, XDR, and Microsoft Sentinel, using MITRE ATT&CK, threat intelligence, and incident insights to improve coverage and alert quality. - Perform advanced threat hunting and support complex investigations, working with Security Operations and Incident Response teams to identify threats and close detection gaps. - Provide technical leadership for security monitoring architecture, integrations, and the cyber defence roadmap, evaluating new capabilities to strengthen detection and response maturity. - Establish engineering standards, Detection-as-Code, and CI/CD practices, maintain technical documentation, mentor engineers, and advise stakeholders on platform effectiveness and strategic improvements. **Requirements:** - Extensive senior-level experience in EDR, XDR, security engineering, security operations, or cyber defence within complex enterprise environments. - Deep subject-matter expertise in Microsoft Defender XDR and CrowdStrike Falcon, with strong knowledge of endpoint detection, platform optimisation, and enterprise security monitoring. - Proven experience developing detection content across EDR, XDR, and SIEM platforms, including Microsoft Sentinel, KQL, advanced hunting, and MITRE ATT&CK-aligned analytics. - Strong capability in threat hunting, threat intelligence integration, incident investigation, and response, with the ability to identify and resolve detection gaps. - Experience leading security architecture, platform integrations, and technical projects, using Detection-as-Code, CI/CD, and engineering best practices while influencing stakeholders and producing clear technical documentation. **Benefits:** - 20% colleague discount on all M&S products and many third-party brands for you and someone in your household, available once you’ve completed your probation - Competitive holiday allowance with the option to buy more - Discretionary bonus schemes linked to your performance and ours - Strong pension and life assurance to help plan for the future - Tailored induction and training to support your development from day one - Exclusive perks and savings through our M&S Choices portal - Market-leading family policies, including parental, adoption, and neonatal leave - 24/7 wellbeing support, including virtual GP access and mental health services - One paid volunteer day a year to support a cause that matters to you ## Skills ### Required - Microsoft Defender XDR - CrowdStrike Falcon - MITRE ATT&CK - SIEM - KQL - Detection-as-Code - CI/CD --- Source: [Apply at fa-eqid-saasfaprod1.fa.ocs.oraclecloud.com](https://fa-eqid-saasfaprod1.fa.ocs.oraclecloud.com/hcmUI/CandidateExperience/en/sites/CX_1/job/131855?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)