Senior Security Engineer

WPP is the trusted growth partner for the world’s leading brands. With exceptional talent, trusted data and intelligence, and world-class partnerships – all united by ourpioneeringagentic marketing platform, WPP Open – we help clients navigate change, capture opportunity, and deliver transformational growth.

WPP Media is WPP's AI-driven media operating unit, bringing together media, data, and partnerships to deliver creative personalisation nected through WPP Open and powered by Open Intelligence, clients see exactly where, how, and why their media investment is working.

DTA is WPP’s global data products and technology company. We’re on a mission to transform marketing by building the fastest, most connected data platform that bridges marketing strategy to scaled activation.

We work with agencies and clients to transform the value of data by bringing together technology, data and analytics capabilities. We deliver this through the Open Media Studio, an AI-enabled media and data platform for the next era of advertising.

We’re endlessly curious. Our team of thinkers, builders, creators and problem solvers are over 1,000 strong, across 20 markets around the world.

We are hiring a Senior Security Engineer based in London to join our Cloud Architecture team, focused on security configuration and identity security across client and internal platforms.

This role leads the design and implementation of secure-by-default patterns for identity, access, and configuration in Microsoft Entra  (Azure AD), Okta, Microsoft 365, Google Workspace, and AWS IAM Identity Center, with strong API/SCIM and Service Now integration.

You will report to the Head of Cloud Architecture and work closely with Platform Engineering, EUC/Workplace, Security Operations, Data Engineering, and Client Delivery teams.

The mission is to improve control coverage, reduce risk and enable frictionless, compliant access for users, applications, and services. You will translate requirements into practical controls and automation, ensuring our platforms meet policy, compliance, and performance goals, including effective monitoring and response through SIEM/SOAR.

• Identity security architecture across Entra  (Azure AD), Okta, Microsoft 365, Google Workspace, and AWS IAM Identity Center.
• Hardening of identity platforms and SaaS configurations:
  Google Workspace Admin, Entra t and CA policies, AWS IAM Identity Center permission sets and SSO.
• SSO and MFA design and rollout (SAML/OIDC, passwordless, conditional access, device/trust signals).
• Lifecycle and JML automation using SCIM and HRIS integrations with Service Now (and/or Workday).
• Federation, directory services, and migration (Entra Connect/Azure AD Connect; ADFS decommissioning).
• Privileged access management and just-in-time elevation (Entra PIM, Okta admin roles, AWS IAM Identity Center assignments).
• Policy-as-code and configuration baselines for identity/security controls; drift detection and remediation.
• Identity telemetry, detections, and response via SIEM/SOAR, emphasizing Microsoft Sentinel.
• External/B2B identity governance, partner access, guest lifecycle, and app consent governance.
• Alignment to ISO 27001, SOC 2, NIST CSF, CIS Benchmarks, and GDPR.

• Threat-aware builder who designs for misuse cases and closes gaps with strong defaults.
• Automates with code and low/no-code workflows (Power Shell, Python, Okta Workflows, Service Now).
• Pragmatic about risk; balances security, usability and delivery timelines.
• Clear communicator who can brief stakeholders and write concise standards/runbooks.
• Consultative mindset with experience guiding design authorities and cross-functional teams.
• Measures outcomes (e.g., MFA adoption, SSO coverage, JML SLA adherence) and iterates.
• Comfortable with complex enterprise environments and multi-tenant identity models.
• Inclusive collaborator who seeks diverse perspectives and documents decisions.

• Design and implement identity and access controls across Entra , Okta, M365, Google Workspace, and AWS IAM Identity Center to raise control coverage and reduce account compromise risk.
• Define and enforce…