Specialist Detection Engineer

In this role, you will provide technical leadership across cyber defence with a focus on EDR/XDR engineering and optimisation. You will shape detection content, threat hunting, and security platform strategy to strengthen visibility and incident response across enterprise, cloud, and hybrid environments. You will work with cross-functional teams to advance EDR, XDR, SIEM and SOAR capabilities and align practices with MITRE ATT&CK. This is a high-impact opportunity to steer enterprise endpoint security in a major banking and retail setting.

• permanent role
• professional development
• mentoring opportunities
• cross-team collaboration
• enterprise-scale security initiatives
• collaborative, specialist environment

• Act as technical SME for Microsoft Defender XDR and CrowdStrike Falcon
• Design, implement, maintain and optimise EDR/XDR capabilities
• Develop, tune and maintain high-fidelity detection content across EDR, XDR and SIEM (incl. Microsoft Sentinel)
• Support SOAR integration and incident response automation
• Conduct advanced threat hunting and investigations using KQL and Defender Advanced Hunting
• Align detection logic with MITRE ATT&CK, threat intel and attacker behaviour
• Lead platform configuration, upgrades, policy development, health monitoring, performance improvements
• Provide technical leadership for security platform architecture, integrations, standards and engineering best practices

• Significant experience in EDR, XDR, security engineering, security operations or cyber defence
• Strong expertise in Microsoft Defender XDR and CrowdStrike Falcon
• Experience developing detection content and managing security monitoring across SIEM technologies
• Practical understanding of SOAR tools, incident response automation and security tool integration
• Strong knowledge of threat hunting, incident investigation and detection engineering methodologies
• Proficiency in KQL, Microsoft Sentinel and enterprise security analytics
• Understanding of MITRE ATT&CK, attacker tactics, techniques and procedures
• Experience with Detection-as-Code, CI/CD practices, technical documentation and platform governance

• leadership
• collaboration
• mentoring
• Microsoft Defender XDR
• CrowdStrike Falcon
• SIEM (Microsoft Sentinel)