EDR & XDR Engineer

Summary

The Principal EDR & XDR Engineer is a senior technical role responsible for the engineering, optimisation, and strategic development of the organisation's Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms. The role will act as the technical Subject Matter Expert (SME) for Microsoft Defender XDR and CrowdStrike Falcon, ensuring the organisation maintains effective endpoint visibility, threat detection, and incident response capabilities. Based on the source role's emphasis on SIEM leadership and detection capabilities. 

Working closely with the CDC Engineering Manager, Security Operations, Incident Response, Threat Intelligence, and Security Architecture teams, the successful candidate will develop and maintain advanced detection capabilities, improve platform performance, enhance security visibility, and ensure EDR and XDR technologies remain aligned with the evolving threat landscape.

What you'll do

• Lead the engineering, optimisation, governance and lifecycle management of Microsoft Defender XDR and CrowdStrike Falcon, ensuring resilient, scalable and effective endpoint protection.
• Develop, tune and validate high-fidelity detections across EDR, XDR and Microsoft Sentinel, using MITRE ATT&CK, threat intelligence and incident insights to improve coverage and alert quality.
• Perform advanced threat hunting and support complex investigations, working with Security Operations and Incident Response teams to identify threats and close detection gaps.
• Provide technical leadership for security monitoring architecture, integrations and the cyber defence roadmap, evaluating new capabilities to strengthen detection and response maturity.
• Establish engineering standards, Detection-as-Code and CI/CD practices, maintain technical documentation, mentor engineers and advise stakeholders on platform effectiveness and strategic improvements.

Who you are

• Extensive senior-level experience in EDR, XDR, security engineering, security operations or cyber defence within complex enterprise environments.
• Deep subject-matter expertise in Microsoft Defender XDR and CrowdStrike Falcon, with strong knowledge of endpoint detection, platform optimisation and enterprise security monitoring.
• Proven experience developing detection content across EDR, XDR and SIEM platforms, including Microsoft Sentinel, KQL, advanced hunting and MITRE ATT&CK-aligned analytics.
• Strong capability in threat hunting, threat intelligence integration, incident investigation and response, with the ability to identify and resolve detection gaps.
• Experience leading security architecture, platform integrations and technical projects, using Detection-as-Code, CI/CD and engineering best practices while influencing stakeholders and producing clear technical documentation.