Senior Microsoft Defender XDR & Deception Engineer

WTW; City Of London; Hybrid; GBP 120,000 - 160,000; Full time

Benefits offered by this job

25 days annual leave

Hybrid working options

Private healthcare

Life insurance

Group income protection

Job summary

WTW is seeking a Senior Microsoft Security Engineer to lead enterprise deception and Defender XDR across a global security program. You will own deception engineering, integrate signals into Defender XDR and Sentinel, and drive automated response and investigations at scale.

You will work with cross-functional teams to align GDPR/DLP controls, manage multi-cloud deception deployments, and mentor a growing team of security engineers.

Qualifications

• Hands-on experience with deception platforms and honeypots.
• Expertise in Defender XDR across Microsoft stack and Sentinel integration.
• Experience in incident response across identity, endpoint, and cloud.
• Proficient scripting in PowerShell and Python.

Responsibilities

• Own and lead the enterprise deception programme end-to-end, including strategy and operations.
• Design, deploy and operate a layered deception fabric across on-prem, hybrid and multi-cloud.
• Lead the design, implementation and optimisation of Defender XDR across endpoints, identity, email and cloud workloads.
• Collaborate with Risk, Compliance, and Legal teams to align DLP and insider risk controls.

Skills

Deception engineering

Defender XDR

MITRE ATT&CK

Agentic AI / Security Copilot

PowerShell / Python scripting

Tools

Thinkst Canary

T-Pot

Cowrie

OpenCanary

Zscaler Deception

Job description

WTW is seeking a Senior Microsoft Security Engineer to lead enterprise deception and Defender XDR across a global security program. You will own deception engineering, integrate signals into Defender XDR and Sentinel, and drive automated response and investigations at scale.

You will work with cross-functional teams to align GDPR/DLP controls, manage multi-cloud deception deployments, and mentor a growing team of security engineers.