Specialist Detection Engineer

Our client, operating within the banking and retail sectors, is seeking a Principal EDR Manager to provide technical leadership across its cyber defence capabilities. This permanent role will focus on the engineering, optimisation and strategic development of Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms, helping to strengthen security visibility, detection and incident response across enterprise, cloud and hybrid environments.

Key Responsibilities:

Act as the technical subject matter expert for Microsoft Defender XDR and CrowdStrike Falcon
Design, implement, maintain and optimise enterprise EDR and XDR capabilities
Develop, tune and maintain high-fidelity detection content across EDR, XDR and SIEM platforms, including Microsoft Sentinel
Support SOAR integration and automation to improve incident response and security operations
Conduct advanced threat hunting and investigations using KQL and Defender Advanced Hunting
Align detection logic with the MITRE ATT&CK framework, threat intelligence and emerging attacker behaviour
Lead platform configuration, upgrades, policy development, health monitoring and performance improvements
Provide technical leadership for security platform architecture, integrations, standards and engineering best practice

Job Requirements:

Significant experience in EDR, XDR, security engineering, security operations or cyber defence
Strong expertise in Microsoft Defender XDR and CrowdStrike Falcon
Experience developing detection content and managing security monitoring across SIEM technologies
Practical understanding of SOAR tools, incident response automation and security tool integration
Strong knowledge of threat hunting, incident investigation and detection engineering methodologies
Proficiency in KQL, Microsoft Sentinel and enterprise security analytics
Understanding of MITRE ATT&CK, attacker tactics, techniques and procedures
Experience with Detection-as-Code, CI/CD practices, technical documentation and platform governance

Leadership and Collaboration:

The Principal EDR Manager will work closely with the Cyber Defence Centre, Security Operations, Incident Response, Threat Intelligence, Vulnerability Management and Security Architecture teams. The role will provide mentoring to engineers, influence technical strategy, report on detection coverage and platform effectiveness, and present recommendations to senior stakeholders.

Desirable Qualifications:

Microsoft Certified: Security Engineer Associate or Security Operations Analyst Associate
CrowdStrike Falcon Administrator Certification
CISSP or relevant GIAC certification

What is Offered:

Permanent opportunity within a major banking and retail environment
Opportunity to shape enterprise EDR, XDR, SIEM and SOAR capabilities
Technical leadership across a broad and evolving cyber security landscape
Professional development, knowledge-sharing and mentoring opportunities
Collaborative work with specialist cyber security and engineering teams
If you are an experienced cyber security engineer with strong EDR, XDR, SIEM and SOAR expertise, this is an opportunity to lead the evolution of enterprise endpoint security. Apply now to be considered