Principal EDR & XDR Engineer

Marks and Spencer; Greater London; Hybrid; GBP 90,000 - 120,000; Full time

Benefits offered by this job

20% colleague discount

Holiday allowance

Discretionary bonus schemes

Pension and life assurance

Induction and training

Perks through Choices portal

Parental, adoption and neonatal leave

Wellbeing support

Volunteer day

Job summary

Marks & Spencer is seeking a Principal EDR & XDR Engineer to lead the engineering, optimisation and strategic development of our EDR/XDR platforms. You will act as SME for Microsoft Defender XDR and CrowdStrike Falcon, ensuring endpoint visibility, threat detection and incident response across large-scale environments.

Work closely with Security Operations, Incident Response and Threat Intelligence teams to develop advanced detections and improve platform performance while aligning with MITRE

Qualifications

• Extensive senior-level experience in EDR/XDR and cyber defence within complex enterprise environments.
• Proven capability in detection content development and platform optimisation across SIEM, EDR, and XDR.
• Strong leadership in security architecture, integrations and engineering best practices.

Responsibilities

• Lead engineering, governance and lifecycle management of Defender XDR and CrowdStrike Falcon for robust endpoint protection.
• Develop and tune high-fidelity detections across EDR/XDR and SIEM using MITRE ATT&CK and threat intel.
• Perform advanced threat hunting and support complex investigations with Security Operations and Incident Response teams.
• Provide technical leadership for security monitoring architecture, integrations and the cyber defence roadmap.
• Establish engineering standards, Detection-as-Code and CI/CD practices, and mentor engineers.

Skills

EDR

XDR

Security engineering

Security operations

Cyber defence

Threat hunting

Threat intelligence

MITRE ATT&CK

KQL

Incident response

Tools

Microsoft Defender XDR

CrowdStrike Falcon

Microsoft Sentinel

Job description

All the details

The Principal EDR & XDR Engineer is a senior technical role responsible for the engineering, optimisation, and strategic development of the organisation's Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms. The role will act as the technical Subject Matter Expert (SME) for Microsoft Defender XDR and CrowdStrike Falcon, ensuring the organisation maintains effective endpoint visibility, threat detection, and incident response capabilities. Based on the source role's emphasis on SIEM leadership and detection capabilities.

Working closely with the CDC Engineering Manager, Security Operations, Incident Response, Threat Intelligence, and Security Architecture teams, the successful candidate will develop and maintain advanced detection capabilities, improve platform performance, enhance security visibility, and ensure EDR and XDR technologies remain aligned with the evolving threat landscape.

What You’ll Do

• Lead the engineering, optimisation, governance and lifecycle management of Microsoft Defender XDR and CrowdStrike Falcon, ensuring resilient, scalable and effective endpoint protection.
• Develop, tune and validate high-fidelity detections across EDR, XDR and Microsoft Sentinel, using MITRE ATT&CK, threat intelligence and incident insights to improve coverage and alert quality.
• Perform advanced threat hunting and support complex investigations, working with Security Operations and Incident Response teams to identify threats and close detection gaps.
• Provide technical leadership for security monitoring architecture, integrations and the cyber defence roadmap, evaluating new capabilities to strengthen detection and response maturity.
• Establish engineering standards, Detection-as-Code and CI/CD practices, maintain technical documentation, mentor engineers and advise stakeholders on platform effectiveness and strategic improvements.

Who You Are

• Extensive senior-level experience in EDR, XDR, security engineering, security operations or cyber defence within complex enterprise environments.
• Deep subject-matter expertise in Microsoft Defender XDR and CrowdStrike Falcon, with strong knowledge of endpoint detection, platform optimisation and enterprise security monitoring.
• Proven experience developing detection content across EDR, XDR and SIEM platforms, including Microsoft Sentinel, KQL, advanced hunting and MITRE ATT&CK-aligned analytics.
• Strong capability in threat hunting, threat intelligence integration, incident investigation and response, with the ability to identify and resolve detection gaps.
• Experience leading security architecture, platform integrations and technical projects, using Detection-as-Code, CI/CD and engineering best practices while influencing stakeholders and producing clear technical documentation.

What's in it for you?

Working at M&S means being part of something bigger - helping to deliver quality, value and service to millions of customers every day. We're inclusive, fast-moving and always evolving, with a strong sense of purpose and a focus on doing the right thing.

• 20% colleague discount on all M&S products and many third-party brands for you and someone in your household, available once you've completed your probation
• Competitive holiday allowance with the option to buy more
• Discretionary bonus schemes linked to your performance and ours
• Strong pension and life assurance to help plan for the future
• Tailored induction and training to support your development from day one
• Exclusive perks and savings through our M&S Choices portal
• Market-leading family policies, including parental, adoption and neonatal leave
• 24/7 wellbeing support, including virtual GP access and mental health services
• One paid volunteer day a year to support a cause that matters to you

Everyone’s welcome

We are ambitious about the future of retail. We're disruptive, innovating and leading the industry into a more conscientious, inspiring digital era. We're transforming how we work together and offering our most exciting opportunities yet. Marks & Spencer strives to be an inclusive organisation, trusted and admired by our colleagues, customers and suppliers. Join us and make change happen.

We are committed to building diverse and representative teams, where everyone can bring their whole selves to work and be at their best. We support each other and work together to win together.

If you feel you'd benefit from any support or reasonable adjustments during any stage of the recruitment process, please don't hesitate to let us know when completing your application. This information will be picked up by our team, so we can try and put steps in place to help you be at your best through this process.

#hybridrole