Specialist Detection Engineer in Bristol, Gloucestershire

Our client, operating within the banking and retail sectors, is seeking a Principal EDR Manager to provide technical leadership across its cyber defence capabilities. This permanent role will focus on the engineering, optimisation and strategic development of Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) platforms, helping to strengthen security visibility, detection and incident response across enterprise, cloud and hybrid environments.

• Act as the technical subject matter expert for Microsoft Defender XDR and CrowdStrike Falcon
• Design, implement, maintain and optimise enterprise EDR and XDR capabilities
• Develop, tune and maintain high-fidelity detection content across EDR, XDR and SIEM platforms, including Microsoft Sentinel
• Support SOAR integration and automation to improve incident response and security operations
• Conduct advanced threat hunting and investigations using KQL and Defender Advanced Hunting
• Align detection logic with the MITRE ATT&CK framework, threat intelligence and emerging attacker behaviour
• Lead platform configuration, upgrades, policy development, health monitoring and performance improvements
• Provide technical leadership for security platform architecture, integrations, standards and engineering best practice

• Significant experience in EDR, XDR, security engineering, security operations or cyber defence
• Strong expertise in Microsoft Defender XDR and CrowdStrike Falcon
• Experience developing detection content and managing security monitoring across SIEM technologies
• Practical understanding of SOAR tools, incident response automation and security tool integration
• Strong knowledge of threat hunting, incident investigation and detection engineering methodologies
• Proficiency in KQL, Microsoft Sentinel and enterprise security analytics
• Understanding of MITRE ATT&CK, attacker tactics, techniques and procedures
• Experience with Detection-as-Code, CI/CD practices, technical documentation and platform governance

The Principal EDR Manager will work closely with the Cyber Defence Centre, Security Operations, Incident Response, Threat Intelligence, Vulnerability Management and Security Architecture teams. The role will provide mentoring to engineers, influence technical strategy, report on detection coverage and platform effectiveness, and present recommendations to senior stakeholders.

• Microsoft Certified: Security Engineer Associate or Security Operations Analyst Associate
• CrowdStrike Falcon Administrator Certification
• CISSP or relevant GIAC certification

• Permanent opportunity within a major banking and retail environment
• Opportunity to shape enterprise EDR, XDR, SIEM and SOAR capabilities
• Technical leadership across a broad and evolving cyber security landscape
• Professional development, knowledge-sharing and mentoring opportunities
• Collaborative work with specialist cyber security and engineering teams

If you are an experienced cyber security engineer with strong EDR, XDR, SIEM and SOAR expertise, this is an opportunity to lead the evolution of enterprise endpoint security. Apply now to be considered.