Senior Deception & Defender XDR Engineer

Willis Towers Watson; Greater London; Hybrid; GBP 120,000 - 180,000; Full time

Benefits offered by this job

Hybrid work

Private healthcare

Life insurance

Pension scheme

Volunteer day

Share scheme

Job summary

Willis Towers Watson in London is seeking a Senior Microsoft Security Engineer to lead enterprise deception and Defender XDR across on‑premises, cloud, and hybrid environments.

You will own the design and operation of an IRM and deception programme, integrating with Microsoft Defender XDR, Sentinel, and Security Copilot to deliver automated detection and response at scale. The role demands hands‑on expertise, leadership, and cross‑functional collaboration.

Qualifications

• Hands-on deception platforms experience (honeypots, honeytokens, decoys).
• Advanced KQL for detection engineering and threat hunting at scale.
• Detection‑as‑code and CI/CD for security content management.
• Strong knowledge of MITRE ATT&CK, MITRE Engage and D3FEND.
• Experience with Agentic AI, Microsoft Security Copilot, or AI/ML in security ops.
• Proven leadership in designing and operating enterprise deception programmes.

Responsibilities

• Lead enterprise deception programme end‑to‑end: strategy, architecture, deployment, and ops.
• Design and operate a deception fabric across on‑premises, hybrid and multi‑cloud.
• Act as technical authority for deception engineering and Defender XDR.
• Lead incident response design and integration with Defender XDR, Sentinel, and SIEMs.

Job description

Willis Towers Watson in London is seeking a Senior Microsoft Security Engineer to lead enterprise deception and Defender XDR across on‑premises, cloud, and hybrid environments.

You will own the design and operation of an IRM and deception programme, integrating with Microsoft Defender XDR, Sentinel, and Security Copilot to deliver automated detection and response at scale. The role demands hands‑on expertise, leadership, and cross‑functional collaboration.