Lead Defender XDR & Cyber Deception Architect

Energy Jobline ZR; Greater London; Hybrid; GBP 140,000 - 180,000; Full time

Benefits offered by this job

25 days annual leave

Private health care

Pension scheme

Job summary

WTW in London is seeking a Principal Microsoft Defender XDR, IRM & Deception Engineer to lead enterprise cyber deception and unified detection across the Microsoft security stack. The role focuses on building, operating, and evolving an enterprise-grade IRM and deception programme integrated with Defender XDR and Microsoft Sentinel.

You will design, deploy, and operate deception fabric across on‑premises, hybrid, and multi‑cloud environments using honeypots, decoy accounts, decoy devices, and

Qualifications

• Hands-on experience with deception platforms (e.g., Thinkst Canary, OpenCanary).
• Advanced detection engineering using KQL and threat hunting at scale.
• Familiarity with MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and cyber kill chain.

Responsibilities

• Own and lead enterprise cyber deception programme end-to-end.
• Design and operate deception fabric across multi-cloud environments.
• Integrate deception signals into Defender XDR and Sentinel as high‑fidelity detections.
• Define a unified detection and response strategy across the Microsoft security stack.
• Mentor deception engineers, threat hunters, and SOC analysts.

Skills

Deception platforms

KQL

MITRE ATT&CK

Detection engineering

Defender XDR

Incident response

Tools

Microsoft Defender XDR

Microsoft Sentinel

PowerShell

Job description

WTW in London is seeking a Principal Microsoft Defender XDR, IRM & Deception Engineer to lead enterprise cyber deception and unified detection across the Microsoft security stack. The role focuses on building, operating, and evolving an enterprise-grade IRM and deception programme integrated with Defender XDR and Microsoft Sentinel.

You will design, deploy, and operate deception fabric across on‑premises, hybrid, and multi‑cloud environments using honeypots, decoy accounts, decoy devices, and