Senior Defender XDR, IRM & Deception Architect

WTW; Greater London; Hybrid; GBP 110,000 - 150,000; Full time

Benefits offered by this job

25 days annual leave

Private healthcare

Life insurance

Group income protection

Pension (matched)

Volunteer day

Share scheme

Electric vehicle scheme

Dental and optical cover

Job summary

WTW is seeking a Principal Microsoft Defender XDR, IRM & Deception Engineer to lead an enterprise deception programme and Defender XDR implementation. You will integrate honeypots, decoy assets, and deceptive credentials with XDR, Sentinel, and IRM to enable proactive, intelligence-led security operations at scale.

You will drive cross-functional collaboration with SOC, CTI, Identity, Cloud, and Engineering teams, mentoring engineers and shaping detection, response, and automation capabilities

Qualifications

• Experience leading enterprise deception programmes and Defender XDR deployment.
• Strong knowledge of security analytics, threat hunting and automation.
• Proven ability to design, implement, and operate deception fabrics across hybrid/multi-cloud environments.

Responsibilities

• Own and lead the enterprise deception programme end-to-end.
• Design, deploy, and operate a layered deception fabric across on-premises, hybrid, and multi-cloud environments.
• Act as the technical authority for deception engineering and Defender XDR.
• Lead the design and optimisation of Defender XDR across endpoints, identities, email and cloud workloads.
• Integrate deception signals into Defender XDR and Microsoft Sentinel as high-fidelity detections.
• Define a unified detection and response strategy across the Microsoft security stack.
• Collaborate with Risk, Compliance, and Legal to align DLP and insider-risk controls.
• Extend deception capabilities across AWS, GCP, and OCI.

Skills

Deception engineering

Defender XDR

KQL proficiency

Automation/Orchestration

Threat hunting

MITRE frameworks

Education

Bachelor's degree in CS/InfoSec

Tools

Thinkst Canary

T-Pot

Cowrie

OpenCanary

Zscaler Deception

PowerShell

Job description

WTW is seeking a Principal Microsoft Defender XDR, IRM & Deception Engineer to lead an enterprise deception programme and Defender XDR implementation. You will integrate honeypots, decoy assets, and deceptive credentials with XDR, Sentinel, and IRM to enable proactive, intelligence-led security operations at scale.

You will drive cross-functional collaboration with SOC, CTI, Identity, Cloud, and Engineering teams, mentoring engineers and shaping detection, response, and automation capabilities