Principal Microsoft Defender XDR, IRM & Deception Engineer in London

Energy Jobline ZR; Greater London; Hybrid; GBP 140,000 - 180,000; Full time

Benefits offered by this job

25 days annual leave

Private health care

Pension scheme

Job summary

WTW in London is seeking a Principal Microsoft Defender XDR, IRM & Deception Engineer to lead enterprise cyber deception and unified detection across the Microsoft security stack. The role focuses on building, operating, and evolving an enterprise-grade IRM and deception programme integrated with Defender XDR and Microsoft Sentinel.

You will design, deploy, and operate deception fabric across on‑premises, hybrid, and multi‑cloud environments using honeypots, decoy accounts, decoy devices, and

Qualifications

• Hands-on experience with deception platforms (e.g., Thinkst Canary, OpenCanary).
• Advanced detection engineering using KQL and threat hunting at scale.
• Familiarity with MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and cyber kill chain.

Responsibilities

• Own and lead enterprise cyber deception programme end-to-end.
• Design and operate deception fabric across multi-cloud environments.
• Integrate deception signals into Defender XDR and Sentinel as high‑fidelity detections.
• Define a unified detection and response strategy across the Microsoft security stack.
• Mentor deception engineers, threat hunters, and SOC analysts.

Skills

Deception platforms

KQL

MITRE ATT&CK

Detection engineering

Defender XDR

Incident response

Tools

Microsoft Defender XDR

Microsoft Sentinel

PowerShell

Job description

Job Description This job is with WTW, an inclusive employer and a member of myGwork – the largest global platform for the + business community.

The Principal Microsoft Defender XDR, IRM & Deception Engineer, working within the Global Information and Cyber Security Defence (ICSD) function, is the technical leader for enterprise cyber deception and unified detection and response across the Microsoft security ecosystem. The role focuses on building, operating, and continuously evolving an enterprise-grade Insider Risk Management (IRM) and deception programme - including honeypots, honeytokens, decoy users, decoy devices, deceptive credentials, and breadcrumbs - fully integrated with Microsoft Defender XDR (Defender for Endpoint, Defender for , Defender for Office 365, and Defender for Cloud Apps), Microsoft Sentinel, and Microsoft Security Copilot. The role exists to detect adversaries earlier in the kill chain by deceiving attackers into engaging with high-fidelity traps, while delivering unified detection, automated investigation, and response across endpoint, , email, and cloud workloads. It combines deep deception engineering expertise with hands‑on Defender XDR mastery and the use of Agentic AI to drive proactive, intelligence‑led, and largely autonomous security operations.

Deception Engineering Leadership

• Own and lead the enterprise cyber deception programme end-to-end, including strategy, architecture, deployment, operations, and continuous improvement.
• Design, deploy, and operate a layered deception fabric across on‑premises, hybrid, and multi‑cloud environments using honeypots, honeytokens, decoy accounts, decoy devices, deceptive files / shares, and breadcrumbs.
• Act as the technical authority for deception engineering and Microsoft Defender XDR across the enterprise.

Microsoft Defender XDR Leadership

• Lead the design, implementation, and optimisation of Microsoft Defender XDR across endpoint, , email, and cloud‑app workloads.
• Integrate all deception signals (honeypot, honeytoken, decoy, breadcrumb) into Defender XDR and Microsoft Sentinel as first‑class, high‑fidelity detections.
• Define and enforce a unified detection and response strategy across the Microsoft security stack.

Data Protection, DLP & Insider Risk Management

• Lead the design and implementation of Microsoft Purview Data Loss Prevention (DLP) policies across endpoints, cloud apps, and collaboration platforms.
• Define and enforce data protection controls to prevent unauthorised data exfiltration and misuse.
• Leverage Microsoft Insider Risk Management (IRM) to detect risky user behaviour, including data leaks, policy violations, and insider threats.
• Correlate DLP, IRM, and signals with Microsoft Defender XDR to provide unified incident context.
• Collaborate with Risk, Compliance, and Legal teams to align DLP and insider risk controls with regulatory and business requirements.
• Continuously optimise detection use cases combining , data, and behavioural analytics.

Multi‑Cloud Deception & Detection (AWS, GCP, OCI)

• Extend the deception programme and Defender‑style detection capabilities consistently across AWS, GCP, and OCI, including: Cloud honeypots, decoy IAM roles, and honeytoken cloud credentials / API keys.
• Control‑plane, workload, container, and Kubernetes threat detection.
• Cross‑cloud and access misuse detection.
• Ensure consistent detection, deception, and response coverage across hybrid and multi‑cloud environments.

Automation, Agentic AI & Continuous Improvement

• Contribute towards automation of deception deployment, detection, investigation, and response workflows using Microsoft Sentinel SOAR, Logic Apps, and Microsoft Security Copilot.
• Define KPIs and metrics covering deception engagement, detection coverage, and response maturity.
• Continuously improve detection, hunting, and deception capabilities to align with emerging threats and adversary tradecraft.

Stakeholder Engagement & Technical Leadership

• Lead and grow a team of Defender XDR and Deception Engineers, setting technical direction, standards, and delivery priorities.
• Partner with SOC, CTI, , Cloud, and Engineering teams to embed deception and Defender XDR detection into all enterprise platforms.
• Provide mentorship and leadership to deception engineers, detection engineers, threat hunters, and SOC analysts.
• Communicate deception strategy, detection coverage, residual risk, and security improvements to senior stakeholders.

Qualifications

• Required Skills & Experience:Hands‑on experience with:Open‑source and commercial deception / honeypot platforms (e.g., Thinkst Canary, T‑Pot, Cowrie, OpenCanary, Zscaler Deception)
• Advanced KQL for detection engineering and threat hunting at scale
• Detection‑as‑code, CI/CD of detection content, and security content management
• Strong knowledge of adversary tradecraft and frameworks:MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain
• Experience leveraging Agentic AI, Microsoft Security Copilot, or AI/ML in security operations ( detection, hunting, IR, automation).
• Proven experience designing and operating enterprise cyber deception programmes (honeypots, honeytokens, decoy users, decoy devices, breadcrumbs) at scale.
• Extensive hands‑on experience operating and engineering Microsoft Defender XDR (MDE, MDI, MDO, MDA) in large enterprises.
• Deep expertise across the Microsoft security stack, including:Microsoft Defender for (MDI) deceptive accounts, deceptive devices, and honeytokens
• Microsoft Sentinel (analytics rules, workbooks, hunting, SOAR)
• Microsoft Security Copilot, automated investigation & response, and attack disruption
• Microsoft Defender for Cloud Apps and Defender for Cloud
• Proven experience leading incident response across , endpoint, email, and cloud domains.
• Strong scripting / automation experience (PowerShell, Python, or equivalent).
• Deep understanding of Zero Trust architecture and -centric defence.
• Experience contributing to red‑team / purple‑team exercises and breach‑and‑attack simulation (BAS) programmes.
• Microsoft certifications:Microsoft Certified: Security Operations Analyst Associate (SC‑200)
• Microsoft Certified: Azure Security Engineer Associate (AZ‑500)
• Microsoft Certified: Cybersecurity Architect Expert (SC‑100)
• Industry certifications (CISSP, GCIA, GCFA, GCIH, OSCP, or equivalent)
• Cloud certifications across AWS, GCP, or OCI

What we offer:

• Enjoy a benefits package designed to help you thrive, both professionally and personally.
• You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge.
• Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind.
• Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.
• We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community.
• On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle‑to‑work programme, dental and optical cover, critical illness protection, and much more.

Equal Opportunity Employer

We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email [e-mail]