{"id":2359006,"url":"https://alion.io/job/marks-spencer-principal-edr-xdr-engineer","title":"Principal EDR & XDR Engineer","company":{"id":45913,"name":"Marks & Spencer","domain":"marksandspencer.com","url":"https://alion.io/company/marks-and-spencer","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Oracle","truth_index":{"grade":"A","score":100,"open_postings":35,"ghost_share":0,"stale_share":0.086,"repost_share":0.2,"time_to_fill_p50_days":10,"computed_at":"2026-10-27T05:46:45Z"}},"role":"Industrial Engineering","role_family":"Industrial Engineering","seniority":"lead","employment_type":null,"work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["London, United Kingdom"],"countries":["GB"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":71000,"max_usd":119000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":109},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"CI/CD","optional":false},{"name":"Crowdstrike","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"SIEM","optional":false}],"status":"closed","first_seen_at":"2026-10-12T14:06:58Z","employer_posted_date":"2026-10-12","last_verified_at":"2026-10-27T04:17:28Z","board_verified":false,"closed_at":"2026-10-27T04:17:28Z","days_open":14,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":14},"description":"Summary\nThe Principal EDR & XDR Engineer is a senior technical role responsible for the engineering, optimisation, and strategic development of the organisation's Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms. The role will act as the technical Subject Matter Expert (SME) for Microsoft Defender XDR and CrowdStrike Falcon, ensuring the organisation maintains effective endpoint visibility, threat detection, and incident response capabilities. Based on the source role's emphasis on SIEM leadership and detection capabilities.\nWorking closely with the CDC Engineering Manager, Security Operations, Incident Response, Threat Intelligence, and Security Architecture teams, the successful candidate will develop and maintain advanced detection capabilities, improve platform performance, enhance security visibility, and ensure EDR and XDR technologies remain aligned with the evolving threat landscape.\nWhat you'll do\nLead the engineering, optimisation, governance and lifecycle management of Microsoft Defender XDR and CrowdStrike Falcon, ensuring resilient, scalable and effective endpoint protection.\nDevelop, tune and validate high-fidelity detections across EDR, XDR and Microsoft Sentinel, using MITRE ATT&CK, threat intelligence and incident insights to improve coverage and alert quality.\nPerform advanced threat hunting and support complex investigations, working with Security Operations and Incident Response teams to identify threats and close detection gaps.\nProvide technical leadership for security monitoring architecture, integrations and the cyber defence roadmap, evaluating new capabilities to strengthen detection and response maturity.\nEstablish engineering standards, Detection-as-Code and CI/CD practices, maintain technical documentation, mentor engineers and advise stakeholders on platform effectiveness and strategic improvements.\nWho you are\nExtensive senior-level experience in EDR, XDR, security engineering, security operations or cyber defence within complex enterprise environments.\nDeep subject-matter expertise in Microsoft Defender XDR and CrowdStrike Falcon, with strong knowledge of endpoint detection, platform optimisation and enterprise security monitoring.\nProven experience developing detection content across EDR, XDR and SIEM platforms, including Microsoft Sentinel, KQL, advanced hunting and MITRE ATT&CK-aligned analytics.\nStrong capability in threat hunting, threat intelligence integration, incident investigation and response, with the ability to identify and resolve detection gaps.\nExperience leading security architecture, platform integrations and technical projects, using Detection-as-Code, CI/CD and engineering best practices while influencing stakeholders and producing clear technical documentation.\nWhat’s in it for you?\nWorking at M&S means being part of something bigger - helping to deliver quality, value and service to millions of customers every day. We’re inclusive, fast-moving and always evolving, with a strong sense of purpose and a focus on doing the right thing.\nHere are just a few of the benefits that make working here even more rewarding:\n20% colleague discount on all M&S products and many third-party brands for you and someone in your household, available once you’ve completed your probation\nCompetitive holiday allowance with the option to buy more\nDiscretionary bonus schemes linked to your performance and ours\nStrong pension and life assurance to help plan for the future\nTailored induction and training to support your development from day one\nExclusive perks and savings through our M&S Choices portal\nMarket-leading family policies, including parental, adoption and neonatal leave\n24/7 wellbeing support, including virtual GP access and mental health services\nOne paid volunteer day a year to support a cause that matters to you\nEveryone’s welcome\nWe are ambitious about the future of retail. We’re disrupting, innovating and leading the industry into a more conscientious, inspiring digital era. We’re transforming how we work together and offering our most exciting opportunities yet. Marks & Spencer strives to be an inclusive organisation, trusted and admired by our colleagues, customers and suppliers. Join us and make change happen.\nWe are committed to building diverse and representative teams, where everyone can bring their whole selves to work and be at their best. We support each other and work together to win together.\nIf you feel you'd benefit from any support or reasonable adjustments during any stage of the recruitment process, please don’t hesitate to let us know when completing your application. This information will be picked up by our team, so we can try and put steps in place to help you be at your best through this process.\n#LI-hybrid #LI-CC1 #hybridrole","description_format":"text","description_chars":4817,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Apparel & Fashion Brands","Online Groceries","Home Decor"],"lifecycle":[{"event":"open","at":"2026-10-12T15:28:23Z"},{"event":"close","at":"2026-10-27T04:17:28Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/marks-spencer-principal-edr-xdr-engineer","json_url":"https://alion.io/job/marks-spencer-principal-edr-xdr-engineer.json","meta":{"generated_at":"2026-10-27T15:45:16Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4766,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-28T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":45913},"rest":"https://alion.io/mcp/rest/get_company?id=45913"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fmarks-spencer-principal-edr-xdr-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fmarks-spencer-principal-edr-xdr-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fmarks-spencer-principal-edr-xdr-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/marks-spencer-principal-edr-xdr-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fmarks-spencer-principal-edr-xdr-engineer"}]}