The Principal Microsoft Defender XDR, IRM & Deception Engineer, working within the Global Information and Cyber Security Defence (ICSD) function, is the technical leader for enterprise cyber deception and unified detection and response across the Microsoft security ecosystem. The role focuses on building, operating, and continuously evolving an enterprise-grade Insider Risk Management (IRM) and deception programme - including honeypots, honeytokens, decoy users, decoy devices, deceptive credentials, and breadcrumbs - fully integrated with Microsoft Defender XDR (Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps), Microsoft Sentinel, and Microsoft Security Copilot.
The role exists to detect adversaries earlier in the kill chain by deceiving attackers into engaging with high-fidelity traps, while delivering unified detection, automated investigation, and response across endpoint, identity, email, and cloud workloads. It combines deep deception engineering expertise with hands-on Defender XDR mastery and the use of Agentic AI to drive proactive, intelligence-led, and largely autonomous security operations.
The Role:
What you'll bring:
Required Skills & Experience:
- Proven experience designing and operating enterprise cyber deception programmes (honeypots, honeytokens, decoy users, decoy devices, breadcrumbs) at scale.
- Extensive hands-on experience operating and engineering Microsoft Defender XDR (MDE, MDI, MDO, MDA) in large enterprises.
- Deep expertise across the Microsoft security stack, including:
- Microsoft Defender for Identity (MDI) deceptive accounts, deceptive devices, and honeytokens
- Microsoft Sentinel (analytics rules, workbooks, hunting, SOAR)
- Microsoft Security Copilot, automated investigation & response, and attack disruption
- Microsoft Defender for Cloud Apps and Defender for Cloud
- Hands-on experience with:
- Open-source and commercial deception / honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception)
- Advanced KQL for detection engineering and threat hunting at scale
- Detection-as-code, CI/CD of detection content, and security content management
- Strong knowledge of adversary tradecraft and frameworks:
- MITRE ATT&CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain
- Experience leveraging Agentic AI, Microsoft Security Copilot, or AI/ML in security operations (detection, hunting, IR, automation).
- Proven experience leading incident response across identity, endpoint, email, and cloud domains.
- Strong scripting / automation experience (PowerShell, Python, or equivalent).
- Deep understanding of Zero Trust architecture and identity-centric defence.
Preferred Qualifications:
- Experience contributing to red-team / purple-team exercises and breach-and-attack simulation (BAS) programmes.
- Microsoft certifications:
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- Microsoft Certified: Azure Security Engineer Associate (AZ-500)
- Microsoft Certified: Cybersecurity Architect Expert (SC-100)
- Industry certifications (CISSP, GCIA, GCFA, GCIH, OSCP, or equivalent)
- Cloud certifications across AWS, GCP, or OCI
What we offer:
Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.
We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.
Equal Opportunity Employer
We’re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email [email protected]
