Senior XDR Specialist

Senior XDR Specialist

Location:

Cheltenham, Manchester or London Role Purpose

Love the buzz of turning noisy security data into sharp, automated defence? At NCC Group, you’ll help well-known brands get the most from Microsoft’s security stack—designing Sentinel-led detection and response, wiring up smart SOAR playbooks, and shaping XDR strategy that actually lands. It’s hands‑on, high‑impact work with a team that backs experimentation, knowledge‑sharing and doing things properly.

• Build & tune Microsoft Sentinel: data connectors, normalisation, analytics rules, UEBA, watchlists, workbooks and cost‑savvy ingestion strategies.
• Orchestrate & automate: create pragmatic SOAR playbooks (Logic Apps/Power Automate) that slash MTTR and remove toil.
• XDR in the real world: deploy and optimise Microsoft Defender XDR across endpoints, identity, email and cloud; align detections to MITRE ATT&CK and real threats.
• Hunt & respond: KQL‑led threat hunting, incident triage guidance, detection content packs, purple‑team style improvements.
• Secure the data: advise on Purview information protection & DLP, from policy design to pilot and rollout.
• Make itland: roadmaps, runbooks, and regular stakeholder updates—translating deep technical detail into business‑ready outcomes.
• Coach & mentor: guide junior consultants; share patterns, reusable content and lessons learned.
• Shape opportunities: support presales scoping, proposals and estimation for consulting and implementation work.

• Proven experience delivering Microsoft security projects:
  Sentinel (must‑have), Defender XDR, SOAR (Logic Apps), and Purview/DLP.
• Comfortable with KQL and scripting (Power Shell); version control with Git.
• A knack for cost optimisation (ingestion, retention, table choices, Basic vs Analytics).
• Solid consulting skills—workshops, architecture reviews, stakeholder management and great written reports.
• Familiarity with control frameworks (ISO 27001, NIST CSF/800-53, PCI DSS, GDPR) and how to evidence them in Microsoft cloud.

• Azure Resource Manager/Bicep or IaC pipelines
• Entra /Conditional Access
• Defender for Cloud
• Intune
• MITRE mapping
• Incident response exposure
• Certifications such as SC-200/SC-100, CISSP/CISM, ISO 27001 LA/LI, PCI QSA.

Focusing on Clients and Customers.

Working as One NCC.

Always Learning.

Being Inclusive and Respectful.

Delivering Brilliantly.

At NCC Group, our mission is to create a more secure digital future. That mission underpins everything we do, from our work with our incredible clients to groundbreaking research shaping our industry. Our teams partner with clients across a multitude of industries, delving into, securing new products, and emerging technologies, as well as solving complex security problems. As global leaders in cyber and escrow, NCC Group is a people‑powered business seeking the next group of brilliant minds to join our ranks.

Our colleagues are our greatest asset, and NCC Group is committed to providing an inclusive and supportive work environment that fosters creativity, collaboration, authenticity, and accountability. We want colleagues to put down roots at NCC Group, and we offer a comprehensive benefits package, as well as opportunities for learning and development and career growth. We believe our people are at their brilliant best when they feel bolstered in all aspects of their well‑being, and we offer wellness programs and flexible working arrangements to provide that vital support.

We have a high‑performance culture which is balanced evenly with world‑class well‑being initiatives and benefits:

• ⏰ Flexible working
• Financial & Investment
• Pension
• Life Assurance
• Share Save Scheme
• Maternity & Paternity leave
• Community & Volunteering Programmes
• ⚡ Green Car Scheme
• Cycle Scheme
• Employee Referral Program
• Lifestyle & Wellness
• Learning & Development

If this sounds like the right opportunity for you, then we would love to hear from you! Click on apply to this job to send us your CV and cover letter and the relevant member of our global talent team will be in touch with you. Alternatively send your details to