Location
London (Hybrid working model with office attendance as required)

Hours
Full Time

Salary
Negotiable

About the Role
The Threat-Led Detection Engineer will design, build, and maintain high-quality threat detections within WTW’s Global Information and Cyber Security Defence (ICSD) function. This hands-on engineering role requires a strong cyber security mindset and a genuine interest in attacker behaviour. You will write and tune detection rules, map coverage to real adversary tactics, and contribute to a well-maintained, version-controlled detection library. Working closely with SOC, Threat Hunting, Cyber Threat Intelligence (CTI), and Incident Response teams, you will transform intelligence and hunt findings into reliable detections using a threat-led, Detection-as-Code approach.

As part of a global, multi-disciplined security community, you will help foster a security-aware culture and ensure WTW remains a great place to work. The role offers a varied and stimulating range of work with occasional global travel. Key responsibilities include designing, writing, testing, and maintaining high-fidelity detection rules across SIEM, EDR/XDR, cloud, identity, and network data sources; applying frameworks such as MITRE ATT&CK, Cyber Kill Chain, and the Diamond Model; rapidly creating new detections in response to emerging threats; tuning existing detections to reduce false positives; practising Detection-as-Code with Git workflows and automated testing; validating detections through adversary emulation and purple-team exercises; supporting AI and automation integration; collaborating across teams to close detection gaps; and expanding detection coverage through onboarding new log sources.

This role is critical in helping WTW detect adversary activity quickly and accurately across its global estate, ensuring robust cyber defence capabilities.

Experience
- Strong background in cyber security with hands-on detection engineering, SOC, or threat-hunting experience.
- Proven ability to write and tune detection rules using query languages such as KQL, SPL, EQL, or Sigma on platforms like Microsoft Sentinel, Splunk, Elastic, CrowdStrike, or Microsoft Defender XDR.
- Experience maintaining detection content and contributing to a detection library.
- Familiarity with Detection-as-Code concepts including Git, version control, and automated testing.
- Exposure to cloud detection across Azure, AWS, and/or GCP and cloud/identity log sources (e.g. Entra ID, CloudTrail).
- Good written and verbal communication skills for clear documentation and cross-team collaboration.

About you
- Strong cyber security mindset with a thorough understanding of attacker behaviour and the modern threat landscape.
- Ability to rapidly develop high-fidelity detections in response to emerging threats and intelligence.
- Awareness of AI/ML in security operations and AI-specific threats such as prompt injection and sensitive-data exposure via GenAI.
- Collaborative team player comfortable working in a global, multi-disciplined security community.
- Enthusiastic about continuous improvement and innovation in detection engineering.

Qualifications
- Working knowledge of MITRE ATT&CK framework, Cyber Kill Chain, and Diamond Model with the ability to map detections accordingly.
- Good to have: Threat-hunting mindset and experience hunting novel or emerging threats.
- Experience with adversary emulation and breach-and-attack-simulation tools (e.g. Atomic Red Team, Caldera) and purple teaming.
- Scripting skills (e.g. Python, PowerShell) for automation and enrichment.
- Awareness of OWASP LLM Top 10 and MITRE ATLAS frameworks.