WTW
The Principal Microsoft Defender XDR, IRM & Deception Engineer, working within the Global Information and Cyber Security Defence (ICSD) function, is the technical leader for enterprise cyber deception and unified detection and response across the Microsoft security ecosystem. The role focuses on building, operating, and continuously evolving an enterprise-grade Insider Risk Management (IRM) and deception programme - including honeypots, honeytokens, decoy users, decoy devices, deceptive credentials, and breadcrumbs - fully integrated with Microsoft Defender XDR (Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps), Microsoft Sentinel, and Microsoft Security Copilot. The role exists to detect adversaries earlier in the kill chain by deceiving attackers into engaging with high-fidelity traps, while delivering unified detection, automated investigation, and response across endpoint, identity, email, and cloud workloads. It combines deep deception engineering expertise with hands-on Defender XDR mastery and the use of Agentic AI to drive proactive, intelligence-led, and largely autonomous security operations. The Role: Deception Engineering Leadership Own and lead the enterprise cyber deception programme end-to-end, including strategy, architecture, deployment, operations, and continuous improvement. Design, deploy, and operate a layered deception fabric across on-premises, hybrid, and multi-cloud environments using honeypots, honeytokens, decoy accounts, decoy devices, deceptive files / shares, and breadcrumbs. Act as the technical authority for deception engineering and Microsoft Defender XDR across the enterprise. Microsoft Defender XDR Leadership Lead the design, implementation, and optimisation of Microsoft Defender XDR across endpoint, identity, email, and cloud-app workloads. Integrate all deception signals (honeypot, honeytoken, decoy, breadcrumb) into Defender XDR and Microsoft Sentinel as first-class, high-fidelity detections. Define and enforce a unified detection and response strategy across the Microsoft security stack. Data Protection, DLP & Insider Risk Management Lead the design and implementation of Microsoft Purview Data Loss Prevention (DLP) policies across endpoints, cloud apps, and collaboration platforms Define and enforce data protection controls to prevent unauthorised data exfiltration and misuse Leverage Microsoft Insider Risk Management (IRM) to detect risky user behaviour, including data leaks, policy violations, and insider threats Correlate DLP, IRM, and identity signals with Microsoft Defender XDR to provide unified incident context Collaborate with Risk, Compliance, and Legal teams to align DLP and insider risk controls with regulatory and business requirements Continuously optimise detection use cases combining identity, data, and behavioural analytics Multi-Cloud Deception & Detection (AWS, GCP, OCI) Extend the deception programme and Defender-style detection capabilities consistently across AWS, GCP, and OCI, including: Cloud honeypots, decoy IAM roles, and honeytoken cloud credentials / API keys Control-plane, workload, container, and Kubernetes threat detection Cross-cloud identity and access misuse detection Ensure consistent detection, deception, and response coverage across hybrid and multi-cloud environments. Automation, Agentic AI & Continuous Improvement Contribute towards automation of deception deployment, detection, investigation, and response workflows using Microsoft Sentinel SOAR, Logic Apps, and Microsoft Security Copilot. Define KPIs and metrics covering deception engagement, detection coverage, and response maturity. Continuously improve detection, hunting, and deception capabilities to align with emerging threats and adversary tradecraft. Stakeholder Engagement & Technical Leadership Lead and grow a team of Defender XDR and Deception Engineers, setting technical direction, standards, and delivery priorities. Partner with SOC, CTI, Identity, Cloud, and Engineering teams to embed deception and Defender XDR detection into all enterprise platforms. Provide mentorship and leadership to deception engineers, detection engineers, threat hunters, and SOC analysts. Communicate deception strategy, detection coverage, residual risk, and security improvements to senior stakeholders. What we offer: Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company. We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you. Equal Opportunity Employer We're committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants.
The Principal Microsoft Defender XDR, IRM & Deception Engineer, working within the Global Information and Cyber Security Defence (ICSD) function, is the technical leader for enterprise cyber deception and unified detection and response across the Microsoft security ecosystem. The role focuses on building, operating, and continuously evolving an enterprise-grade Insider Risk Management (IRM) and deception programme - including honeypots, honeytokens, decoy users, decoy devices, deceptive credentials, and breadcrumbs - fully integrated with Microsoft Defender XDR (Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps), Microsoft Sentinel, and Microsoft Security Copilot. The role exists to detect adversaries earlier in the kill chain by deceiving attackers into engaging with high-fidelity traps, while delivering unified detection, automated investigation, and response across endpoint, identity, email, and cloud workloads. It combines deep deception engineering expertise with hands-on Defender XDR mastery and the use of Agentic AI to drive proactive, intelligence-led, and largely autonomous security operations. The Role: Deception Engineering Leadership Own and lead the enterprise cyber deception programme end-to-end, including strategy, architecture, deployment, operations, and continuous improvement. Design, deploy, and operate a layered deception fabric across on-premises, hybrid, and multi-cloud environments using honeypots, honeytokens, decoy accounts, decoy devices, deceptive files / shares, and breadcrumbs. Act as the technical authority for deception engineering and Microsoft Defender XDR across the enterprise. Microsoft Defender XDR Leadership Lead the design, implementation, and optimisation of Microsoft Defender XDR across endpoint, identity, email, and cloud-app workloads. Integrate all deception signals (honeypot, honeytoken, decoy, breadcrumb) into Defender XDR and Microsoft Sentinel as first-class, high-fidelity detections. Define and enforce a unified detection and response strategy across the Microsoft security stack. Data Protection, DLP & Insider Risk Management Lead the design and implementation of Microsoft Purview Data Loss Prevention (DLP) policies across endpoints, cloud apps, and collaboration platforms Define and enforce data protection controls to prevent unauthorised data exfiltration and misuse Leverage Microsoft Insider Risk Management (IRM) to detect risky user behaviour, including data leaks, policy violations, and insider threats Correlate DLP, IRM, and identity signals with Microsoft Defender XDR to provide unified incident context Collaborate with Risk, Compliance, and Legal teams to align DLP and insider risk controls with regulatory and business requirements Continuously optimise detection use cases combining identity, data, and behavioural analytics Multi-Cloud Deception & Detection (AWS, GCP, OCI) Extend the deception programme and Defender-style detection capabilities consistently across AWS, GCP, and OCI, including: Cloud honeypots, decoy IAM roles, and honeytoken cloud credentials / API keys Control-plane, workload, container, and Kubernetes threat detection Cross-cloud identity and access misuse detection Ensure consistent detection, deception, and response coverage across hybrid and multi-cloud environments. Automation, Agentic AI & Continuous Improvement Contribute towards automation of deception deployment, detection, investigation, and response workflows using Microsoft Sentinel SOAR, Logic Apps, and Microsoft Security Copilot. Define KPIs and metrics covering deception engagement, detection coverage, and response maturity. Continuously improve detection, hunting, and deception capabilities to align with emerging threats and adversary tradecraft. Stakeholder Engagement & Technical Leadership Lead and grow a team of Defender XDR and Deception Engineers, setting technical direction, standards, and delivery priorities. Partner with SOC, CTI, Identity, Cloud, and Engineering teams to embed deception and Defender XDR detection into all enterprise platforms. Provide mentorship and leadership to deception engineers, detection engineers, threat hunters, and SOC analysts. Communicate deception strategy, detection coverage, residual risk, and security improvements to senior stakeholders. What we offer: Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company. We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you. Equal Opportunity Employer We're committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants.
TryHackMe Ltd
The Role We're looking for experienced incident responders and blue team practitioners to join our Content Engineering team. Your job is simple in concept: take what you know from real world IR work and turn it into world class training content. You'll take your years of real world experience and teach your peers and the next generation. Job Responsibilities Research, design, and develop defensive cyber security training material with supporting hands on lab exercises (such as virtual machines and datasets for analysis). Draw on your real world IR experience to build realistic, scenario driven labs that reflect how attacks actually unfold in enterprise Windows environments. Develop and configure virtual machines and sample datasets for realistic cybersecurity labs. Collaborate closely with your team by sharing expertise, reviewing each other's work, and raising the quality bar collectively. Take charge of planning and designing portions of the content development roadmap. Collaborate with the Head of Content Engineering to continuously improve the content development process. Analyse industry trends in tooling and techniques and recreate them as teachable content. Strategically plan, review, and schedule content with our blue team content engineering team. Technical Skills & Experience To be considered for this opportunity, you must have significant hands on relevant cyber security industry experience in roles such as Incident Responder, Threat Hunter, Digital Forensics Investigator or L3 SOC Analyst. You should also demonstrate: Proven, hands on experience responding to real incidents in Windows environments. Triaging compromised endpoints, analysing forensic artefacts, and reconstructing attacker timelines from initial access through to impact. Solid grounding in Windows forensics and artefact analysis - event logs, registry hives, NTFS artefacts, and memory/disk forensics - with the ability to extract attacker activity from both live systems and forensic images. Working knowledge of offensive techniques used against Windows and Active Directory environments, including credential dumping, privilege escalation, Kerberos based attacks, and lateral movement, and critically, how to detect them in forensic artefacts, contain them during live response, and prevent recurrence. Hands on familiarity with attacker tooling and tradecraft - fileless execution, living off the land techniques (LOLBins), common exfiltration methods, and ransomware deployment patterns - including the TTPs of active APT groups and ransomware as a service operators. Experience with DFIR collection tooling such as EZ Toolset, Velociraptor, KAPE, or equivalent with an understanding of how to conduct IR at scale across enterprise environments. Strong verbal and written English communication skills, essential for conveying complex technical concepts. Preferred Skills (nice to have) Any experience creating training content, writing documentation, or explaining technical concepts to others either formally or informally Deeper expertise in one or more specialist areas: Active Directory attack paths (Kerberoasting, DCSync, ADCS), memory forensics (MemProcFS, Volatility), or advanced NTFS analysis Creating challenges for capture the flags (CTFs) Experience leading, coaching, or mentoring others Certifications such as GIAC Certified Incident Handler (GCIH), GIAC Certified Enterprise Defender (GCED), Security Analyst Level 2 (SAL2), Certified Forensic Analyst (GCFA) Benefits & Perks 100% Remote - In a fully digital world, work from anywhere you want! Flexi Time - Choose your own hours as long as you have at least 4 hours of overlap with the UK timezone (from 8am - 6pm) Tools - a dedicated work laptop + any accessories you need to do your best work. Swag Pack - start your TryHackMe journey with a branded swag bundle! Personal Development - £2,500 training budget to acquire certifications, and more. Company Retreat - an annual company retreat, fully paid for by us! Lunch on us - whether you're a pizza lover, salad obsessed or a big sushi fan, TryHackMe will cover the cost of your lunch order during our recurring company virtual lunches. Health Insurance - if you're in a country that doesn't have public health care. Enhanced Maternity & Paternity - an enhanced package on top of statutory requirements. 401k / Pension - TryHackMe makes it easy to save money for your retirement.
The Role We're looking for experienced incident responders and blue team practitioners to join our Content Engineering team. Your job is simple in concept: take what you know from real world IR work and turn it into world class training content. You'll take your years of real world experience and teach your peers and the next generation. Job Responsibilities Research, design, and develop defensive cyber security training material with supporting hands on lab exercises (such as virtual machines and datasets for analysis). Draw on your real world IR experience to build realistic, scenario driven labs that reflect how attacks actually unfold in enterprise Windows environments. Develop and configure virtual machines and sample datasets for realistic cybersecurity labs. Collaborate closely with your team by sharing expertise, reviewing each other's work, and raising the quality bar collectively. Take charge of planning and designing portions of the content development roadmap. Collaborate with the Head of Content Engineering to continuously improve the content development process. Analyse industry trends in tooling and techniques and recreate them as teachable content. Strategically plan, review, and schedule content with our blue team content engineering team. Technical Skills & Experience To be considered for this opportunity, you must have significant hands on relevant cyber security industry experience in roles such as Incident Responder, Threat Hunter, Digital Forensics Investigator or L3 SOC Analyst. You should also demonstrate: Proven, hands on experience responding to real incidents in Windows environments. Triaging compromised endpoints, analysing forensic artefacts, and reconstructing attacker timelines from initial access through to impact. Solid grounding in Windows forensics and artefact analysis - event logs, registry hives, NTFS artefacts, and memory/disk forensics - with the ability to extract attacker activity from both live systems and forensic images. Working knowledge of offensive techniques used against Windows and Active Directory environments, including credential dumping, privilege escalation, Kerberos based attacks, and lateral movement, and critically, how to detect them in forensic artefacts, contain them during live response, and prevent recurrence. Hands on familiarity with attacker tooling and tradecraft - fileless execution, living off the land techniques (LOLBins), common exfiltration methods, and ransomware deployment patterns - including the TTPs of active APT groups and ransomware as a service operators. Experience with DFIR collection tooling such as EZ Toolset, Velociraptor, KAPE, or equivalent with an understanding of how to conduct IR at scale across enterprise environments. Strong verbal and written English communication skills, essential for conveying complex technical concepts. Preferred Skills (nice to have) Any experience creating training content, writing documentation, or explaining technical concepts to others either formally or informally Deeper expertise in one or more specialist areas: Active Directory attack paths (Kerberoasting, DCSync, ADCS), memory forensics (MemProcFS, Volatility), or advanced NTFS analysis Creating challenges for capture the flags (CTFs) Experience leading, coaching, or mentoring others Certifications such as GIAC Certified Incident Handler (GCIH), GIAC Certified Enterprise Defender (GCED), Security Analyst Level 2 (SAL2), Certified Forensic Analyst (GCFA) Benefits & Perks 100% Remote - In a fully digital world, work from anywhere you want! Flexi Time - Choose your own hours as long as you have at least 4 hours of overlap with the UK timezone (from 8am - 6pm) Tools - a dedicated work laptop + any accessories you need to do your best work. Swag Pack - start your TryHackMe journey with a branded swag bundle! Personal Development - £2,500 training budget to acquire certifications, and more. Company Retreat - an annual company retreat, fully paid for by us! Lunch on us - whether you're a pizza lover, salad obsessed or a big sushi fan, TryHackMe will cover the cost of your lunch order during our recurring company virtual lunches. Health Insurance - if you're in a country that doesn't have public health care. Enhanced Maternity & Paternity - an enhanced package on top of statutory requirements. 401k / Pension - TryHackMe makes it easy to save money for your retirement.
