Principal Microsoft Defender XDR, IRM & Deception Engineer

This job is with WTW, an inclusive employer and a member of my Gwork – the largest global platform for the LGBTQ+ business community. Please do not contact the recruiter directly.

Description

The Principal Microsoft Defender XDR, IRM & Deception Engineer, working within the Global Information and Cyber Security Defence (ICSD) function, is the technical leader for enterprise cyber deception and unified detection and response across the Microsoft security ecosystem. The role focuses on building, operating, and continuously evolving an enterprise-grade Insider Risk Management (IRM) and deception programme - including honeypots, honey tokens, decoy users, decoy devices, deceptive credentials, and breadcrumbs - fully integrated with Microsoft Defender XDR (Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps), Microsoft Sentinel, and Microsoft Security Copilot.

The role exists to detect adversaries earlier in the kill chain by deceiving attackers into engaging with high-fidelity traps, while delivering unified detection, automated investigation, and response across endpoint, identity, email, and cloud workloads. It combines deep deception engineering expertise with hands-on Defender XDR mastery and the use of Agentic AI to drive proactive, intelligence-led, and largely autonomous security operations.

The Role:

Deception Engineering Leadership
Own and lead the enterprise cyber deception programme end-to-end, including strategy, architecture, deployment, operations, and continuous improvement.

Design, deploy, and operate a layered deception fabric across on-premises, hybrid, and multi-cloud environments using honeypots, honey tokens, decoy accounts, decoy devices, deceptive files / shares, and breadcrumbs.

Act as the technical authority for deception engineering and Microsoft Defender XDR across the enterprise.

Microsoft Defender XDR Leadership
Lead the design, implementation, and optimisation of Microsoft Defender XDR across endpoint, identity, email, and cloud-app workloads.

Integrate all deception signals (honeypot, honey token, decoy, breadcrumb) into Defender XDR and Microsoft Sentinel as first-class, high-fidelity detections.

Define and enforce a unified detection and response strategy across the Microsoft security stack.

Data Protection, DLP & Insider Risk Management

Lead the design and implementation of Microsoft Purview Data Loss Prevention (DLP) policies across endpoints, cloud apps, and collaboration platforms

Define and enforce data protection controls to prevent unauthorised data exfiltration and misuse

Leverage Microsoft Insider Risk Management (IRM) to detect risky user behaviour, including data leaks, policy violations, and insider threats

Correlate DLP, IRM, and identity signals with Microsoft Defender XDR to provide unified incident context

Collaborate with Risk, Compliance, and Legal teams to align DLP and insider risk controls with regulatory and business requirements

Continuously optimise detection use cases combining identity, data, and behavioural analytics

Multi-Cloud Deception & Detection (AWS, GCP, OCI)
Extend the deception programme and Defender-style detection capabilities consistently across AWS, GCP, and OCI, including:

Cloud honeypots, decoy IAM roles, and honey token cloud credentials / API keys

Control-plane, workload, container, and Kubernetes threat detection

Cross-cloud identity and access misuse detection

Ensure consistent detection, deception, and response coverage across hybrid and multi-cloud environments.

Automation, Agentic AI & Continuous Improvement
Contribute towards automation of deception deployment, detection, investigation, and response workflows using Microsoft Sentinel SOAR, Logic Apps, and Microsoft Security Copilot.

Define KPIs and metrics covering deception engagement, detection coverage, and response maturity.

Continuously improve detection, hunting, and deception capabilities to align with emerging threats and adversary tradecraft.

Stakeholder Engagement & Technical Leadership
Lead and grow a team of Defender XDR and Deception Engineers, setting technical direction, standards, and delivery priorities.

Partner with SOC, CTI, Identity, Cloud, and Engineering teams to embed deception and Defender XDR detection into all enterprise platforms.

Provide mentorship and leadership to deception engineers, detection engineers, threat hunters, and SOC analysts.

Communicate deception strategy, detection coverage, residual risk, and security improvements to senior stakeholders.

Qualifications

What you'll bring:

Required

Skills & Experience:

Hands-on experience with:
Open-source and commercial deception / honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, Open Canary, Zscaler Deception)

Advanced KQL for detection engineering and threat hunting at scale

Detection-as-code, CI/CD of detection content, and security content management

Strong knowledge of adversary tradecraft and frameworks:
MITRE ATT&CK, MITRE Engage, MITRE D3

FEND, and the cyber kill chain

Experience…