Senior XDR Specialist
Location:Cheltenham,Manchesteror London
Role Purpose
Love the buzz of turning noisy security data into sharp, automated defence? At NCC Group, you’ll help well-known brands get the most from Microsoft’s security stack — designing Sentinel-led detection and response, wiring up smart SOAR playbooks, and shaping XDR strategy that actually lands. It’s hands-on, high-impact work with a team that backs experimentation, knowledge-sharing and doing things properly.
Summary
1. Build & tune Microsoft Sentinel: data connectors, normalisation, analytics rules, UEBA, watchlists, workbooks and cost-savvy ingestion strategies.
2. Orchestrate & automate: create pragmatic SOAR playbooks (Logic Apps/Power Automate) that slash MTTR and remove toil.
3. XDR in the real world: deploy and optimise Microsoft Defender XDR across endpoints, identity, email and cloud; align detections to MITRE ATT&CK and real threats.
4. Hunt & respond: KQL-led threat hunting, incident triage guidance, detection content packs, purple-team style improvements.
5. Secure the data: advise on Purview information protection & DLP, from policy design to pilot and rollout.
6. Make it land: roadmaps, runbooks, and regular stakeholder updates — translating deep technical detail into business-ready outcomes.
7. Coach & mentor: guide junior consultants; share patterns, reusable content and lessons learned.
8. Shape opportunities: support presales scoping, proposals and estimation for consulting and implementation work.
What we are looking for in you
9. Proven experience delivering Microsoft security projects: Sentinel (must-have), Defender XDR, SOAR (Logic Apps), and Purview/DLP.
10. Comfortable with KQL and scripting (PowerShell); version control with Git.
11. A knack for cost optimisation (ingestion, retention, table choices, Basic vs Analytics).
12. Solid consulting skills — workshops, architecture reviews, stakeholder management and great written reports.
13. Familiarity with control frameworks (ISO 27001, NIST CSF/800-53, PCI DSS, GDPR) and how to evidence them in Microsoft cloud.
Nice-to-haves (not show-stoppers)
14. Azure Resource Manager/Bicep or IaC pipelines
15. Entra ID/Conditional Access
16. Defender for Cloud
17. Intune
18. MITRE mapping
19. Incident response exposure
20. Certifications such as SC-200/SC-100, CISSP/CISM, ISO 27001 LA/LI, PCI QSA.
Ways of working
Focusing on Clients and Customers.
Working as One NCC.
Always Learning.
Being Inclusive and Respectful.
Delivering Brilliantly.
Our company
At NCC Group, our mission is to create a more secure digital future. That mission underpins everything we do, from our work with our incredible clients to groundbreaking research shaping our industry. Our teams' partner with clients across a multitude of industries, delving into, securing new products, andemergingtechnologies, as well as solving complex security problems. As global leaders in cyber and escrow, NCC Group is a people-powered business seeking the next group of brilliant minds to join our ranks.
Our colleagues are our greatestasset, and NCC Group is committed to providing an inclusive and supportive work environment that fosters creativity, collaboration, authenticity, and accountability. We want colleagues toput down rootsat NCC Group, and we offer a comprehensive benefits package, as well as opportunities for learning and development and career growth. We believe our people are at their brilliant best when they feel bolstered in all aspects of their well-being, and we offer wellness programs and flexible working arrangements to provide that vital support.
Come join us?
What do we offer in return?
We have a high-performance culture which is balanced evenly with world-class well-being initiatives and benefits:
⏰Flexible working
💸Financial & Investment
Pension
Life Assurance
Share Save Scheme
Maternity & Paternity leave
🙋🏾Community & Volunteering Programmes
⚡Green Car Scheme
🚴Cycle Scheme
🧑🏻🤝🧑🏻Employee Referral Program
🧘🏻Lifestyle & Wellness
🎓Learning & Development
So,what’snext?