Urwah Admin

<div><h2 class="jobSectionHeader">Description</h2>
<div>
The Associate Client Advocate (ACA) client-facing functions utilizing the colleague&rsquo;s advanced skills in Commercial Property and Casualty Insurance and is responsible for a blend of internal delivery activities. The ACA is responsible for supporting client relationships, strategy development, and execution at the insurance program level.

The Associate Client Advocate (ACA) owns client service activities and client engagement in those activities through daily coordination with an assigned Client Specialist in our Global Service Delivery (GSD) Team. The ACA is the primary point of contact for providing all service, escalation, and placement to meet the client&rsquo;s insurance and risk management needs. The ACA has a strong connection to the client&rsquo;s business with a fundamental understanding of its industry and aids in opportunities to maximize the profitability of existing clients by supporting new business efforts.

The primary responsibility of the Associate Client Advocate is to provide an exceptional client experience, with a primary focus on direct client engagement and retention of that business. This includes engaging with sales and broking to understand marketplace changes, design and deliver client presentations/proposals, assist and respond to defensive RFPs, and attend oral presentations where required.

As an ACA you are expected to have:
<ul>
<li>Basic negotiation skills and demonstrated experience</li>
<li>Basic account management skills and demonstrated experience</li>
<li>Basic project management skills and demonstrated experience</li>
<li>Strong presentation skills</li>
<li>Ability to adapt to change</li>
<li>Solid organization skills</li>
<li>Ability to mentor a Client Specialist colleague</li>
</ul>
As an ACA you have the potential to serve as a mentor to other ACAs, a partner/ team member for others within your IVD, or an ACA Leader. 
 
Note: Employment-based non-immigrant visa sponsorship and/or assistance is not offered for this specific job opportunity.

The Role
<ul>
<li>Retains existing book of business, develops, and strengthens client relationships</li>
<li>Identifies, engages, and integrates delivery of all WTW internal resources to deliver an exceptional client experience</li>
<li>Provides direct or supporting strategic planning and consulting advice to clients; monitors insurance and risk management needs in collaboration with WTW resource, practice, and industry groups.</li>
<li>Recommend appropriate solutions throughout the policy term (including acquisition due diligence)</li>
<li>Maximizes the profitability of the client account &amp; drives retention of that business</li>
<li>In collaboration with the Client Advocate, actively expands existing client relationships and supports new business prospecting</li>
<li>Collaborates with client teams during Internal and External Strategy Meetings</li>
<li>Engages with sales and broking to understand marketplace changes</li>
<li>Supports the fee/compensation agreement and overall client invoicing processes</li>
<li>Supports defensive RFP responses
</li><li>Aids in the design and delivery of full client presentations/proposals, client advocacy reports, client service plans and schedules</li>
<li>Coordinates the renewal process to establish and implement the client-specific renewal strategy, collaborates with WTW resources and industry groups to develop and deliver renewal to clients</li>
<li>Ensures all policy requirements (legal, regulatory &amp; compliance) are met</li>
<li>Client-level coordination &amp; management of all service delivery (GSD)</li>
<li>Engage Service Liaisons (Subject Matter Expert or Client Operations Specialist) on escalations</li>
<li>Gather and receive all client information working in collaboration with the Client Specialist</li>
<li>Responsible for coordination of all service delivery activities such as audits, completing second pair of eyes review on policies, resolving all accounting issues, managing aged receivables and bad debt, surplus lines affidavits, issuance of client invoicing and certificates of insurance and auto identification cards.</li>
</ul></div><h2 class="jobSectionHeader">Qualifications</h2>
<div>
The Requirements
<ul>
<li>Targeted 5+ years of commercial Property &amp; Casualty insurance knowledge/experience in a client-facing role, or demonstrated capabilities to complete role responsibilities</li>
<li>Able to apply knowledge of coverage forms in the analysis of program design, the identification of coverage gaps, and ongoing coverage consultation
</li><li>Depending on the complexity of accountability to understand, interpret, analyze, and/or present analytical models</li>
<li>Relationship Management skills: ability to leverage internal and external relationships to bring WTW resources and assets tailored to client needs</li>
<li>Negotiation skills &ndash; the ability to drive conflict resolution and secure concessions without damaging relationships.</li>
<li>Business Acumen; knowledge of strategy, tactics, and solutions for the client, and/or in the marketplace</li>
<li>Knowledge of commercial insurance renewal end-to-end process, steps and owners</li>
<li>Excellent verbal and written communication skills; group presentation skills, ability to drive complex/technical conversations</li>
<li>Daily management of work assignments, mentoring, and collaboration with a Client Specialist</li>
<li>Receptive to feedback; critical thinking and problem-solving skills, high adaptability
</li><li>Supports Client Advocate (CA) in advocating for change. Provides encouragement, takes control of client deliverables, and team projects, leads key delivery areas, collaborates with internal/external stakeholders, and provides clear guidance to ensure others fulfill roles effectively</li>
<li>Strong project management skills: Support the CA in end-to-end oversight of large, complex, ambiguous, or multi-dimensional projects
</li><li>Proficient Microsoft Office skills and familiarity with other relevant online tools</li>
<li>Must achieve and maintain an active insurance broker&rsquo;s P&amp;C license, and complete various continuing education activities as needed
</li><li>Insurance industry designations preferred but not required (CPCU, ARM, CIC, CRIS, CRM)</li></ul> 


This position will remain posted for a minimum of three business days from the date posted or until sufficient/appropriate candidate slate has been identified. 
 
Compensation and Benefits

Base salary range and benefits information for this position are being included in accordance with requirements of various state/local pay transparency legislation. Please note that base salaries may vary for different individuals in the same role based on several factors, including but not limited to location of the role, individual competencies, education/professional certifications, qualifications/experience, performance in the role and potential for revenue generation.

Compensation

The base salary compensation range being offered for this role is $90,000-$120,000 USD per year.

This role is also eligible for an annual short-term incentive bonus.

Company Benefits

WTW provides a competitive benefit package which includes the following (eligibility requirements apply):
<ul>
<li>Health and Welfare Benefits: Medical (including prescription coverage), Dental, Vision, Health Savings Account, Commuter Account, Health Care and Dependent Care Flexible Spending Accounts, Group Accident, Group Critical Illness, Life Insurance, AD&amp;D, Group Legal, Identify Theft Protection, Wellbeing Program and Work/Life Resources (including Employee Assistance Program)</li>
<li>Leave Benefits: Paid Holidays, Annual Paid Time Off (includes paid state/local paid leave where required), Short-Term Disability, Long-Term Disability, Other Leaves (e.g., Bereavement, FMLA, ADA, Jury Duty, Military Leave, and Parental and Adoption Leave), Paid Time Off (Washington State only)</li>
<li>Retirement Benefits: Contributory Pension Plan and Savings Plan (401k).</li>
</ul>
Pursuant to the San Francisco Fair Chance Ordinance and Los Angeles County Fair Chance Ordinance for Employers, we will consider for employment qualified applicants with arrest and conviction records.

At WTW, we trust you to know your work and the people, tools and environment you need to be successful. The majority of our colleagues work in a &rdquo;hybrid&rdquo; style, with a mix of remote, in-person and in-office interactions dependent on the needs of the team, role and clients. Our flexibility is rooted in trust and &ldquo;hybrid&rdquo; is not a one-size-fits-all solution.

We understand flexibility is key to supporting an inclusive and diverse workforce and so we encourage requests for all types of flexible working as well as location-based arrangements. Please speak to your recruiter to discuss more. 

EOE, including disability/vets</div></div>

Associate Client Advocate

<div><h2 class="jobSectionHeader">Description</h2>
<div>
The Principal Microsoft Defender XDR, IRM &amp; Deception Engineer, working within the Global Information and Cyber Security Defence (ICSD) function, is the technical leader for enterprise cyber deception and unified detection and response across the Microsoft security ecosystem. The role focuses on building, operating, and continuously evolving an enterprise-grade Insider Risk Management (IRM) and deception programme - including honeypots, honeytokens, decoy users, decoy devices, deceptive credentials, and breadcrumbs - fully integrated with Microsoft Defender XDR (Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps), Microsoft Sentinel, and Microsoft Security Copilot.

The role exists to detect adversaries earlier in the kill chain by deceiving attackers into engaging with high-fidelity traps, while delivering unified detection, automated investigation, and response across endpoint, identity, email, and cloud workloads. It combines deep deception engineering expertise with hands-on Defender XDR mastery and the use of Agentic AI to drive proactive, intelligence-led, and largely autonomous security operations.

The Role:
<ul>
<li>Deception Engineering Leadership<ul>
<li>Own and lead the enterprise cyber deception programme end-to-end, including strategy, architecture, deployment, operations, and continuous improvement.</li>
<li>Design, deploy, and operate a layered deception fabric across on-premises, hybrid, and multi-cloud environments using honeypots, honeytokens, decoy accounts, decoy devices, deceptive files / shares, and breadcrumbs.</li>
<li>Act as the technical authority for deception engineering and Microsoft Defender XDR across the enterprise.</li>
</ul></li><li>Honeypots, Honeytokens, Decoys &amp; Breadcrumbs<ul>
<li>Design and operate the full deception asset lifecycle, ensuring high-fidelity, low-noise detections that are realistic, attacker-grade, and resilient to evasion.</li>
<li>Deploy and manage Microsoft Defender for Identity deceptive accounts, deceptive devices, and honeytoken accounts across Active Directory and Microsoft Entra ID.</li>
<li>Build and maintain a portfolio of deception assets, including:<ul>
<li>Honeypot systems (low-, medium-, and high-interaction) across on-prem, Azure, AWS, GCP, and OCI</li>
<li>Honeytoken credentials, API keys, OAuth tokens, secrets, and SaaS accounts</li>
</ul></li><li>Decoy users, decoy devices, decoy shares, decoy files, and decoy databases<ul>
<li>Plant attacker-grade breadcrumbs across endpoints, identities, and cloud workloads, including:</li>
<li>Saved credentials, browser cookies, RDP and SSH artefacts</li>
<li>LSASS-resident credentials and cached tokens on selected lures</li>
<li>Fake Kerberos service accounts and SPNs to bait Kerberoasting and AS-REP roasting</li>
</ul></li><li>Continuously evolve deception techniques, lure design, and trap placement aligned to current attacker TTPs, red-team findings, and breach intelligence.</li>
<li>Govern the deception programme with clear standards for asset realism, segmentation, monitoring, and safe operation (no production impact).</li>
<li>Validate deception coverage through red-team, purple-team, and breach-and-attack simulation (BAS) exercises.</li>
</ul></li><li>Microsoft Defender XDR Leadership<ul>
<li>Lead the design, implementation, and optimisation of Microsoft Defender XDR across endpoint, identity, email, and cloud-app workloads.</li>
<li>Integrate all deception signals (honeypot, honeytoken, decoy, breadcrumb) into Defender XDR and Microsoft Sentinel as first-class, high-fidelity detections.</li>
<li>Define and enforce a unified detection and response strategy across the Microsoft security stack.</li>
</ul></li><li>Defender for Identity &amp; Identity Deception<ul>
<li>Lead operation and optimisation of Microsoft Defender for Identity (MDI) to detect identity-based attacks, including:<ul>
<li>Credential theft, Kerberoasting, AS-REP roasting, Pass-the-Hash, and Pass-the-Ticket</li>
<li>Lateral movement, reconnaissance, and privilege escalation</li>
<li>Misuse of deceptive / honeytoken accounts as early-warning tripwires</li>
</ul></li><li>Integrate MDI, deception, and Microsoft Entra ID signals into Defender XDR, Microsoft Sentinel, and SOAR workflows for unified investigation and response.</li>
</ul>
</li><li>Data Protection, DLP &amp; Insider Risk Management
<ul>
<li>Lead the design and implementation of Microsoft Purview Data Loss Prevention (DLP) policies across endpoints, cloud apps, and collaboration platforms</li>
<li>Define and enforce data protection controls to prevent unauthorised data exfiltration and misuse</li>
<li>Leverage Microsoft Insider Risk Management (IRM) to detect risky user behaviour, including data leaks, policy violations, and insider threats</li>
<li>Correlate DLP, IRM, and identity signals with Microsoft Defender XDR to provide unified incident context</li>
<li>Collaborate with Risk, Compliance, and Legal teams to align DLP and insider risk controls with regulatory and business requirements</li>
<li>Continuously optimise detection use cases combining identity, data, and behavioural analytics</li>
</ul></li><li>Endpoint, Email &amp; Cloud App Detection<ul>
<li>Lead detection engineering across the Defender XDR stack, ensuring deception assets are continuously monitored alongside production telemetry:</li>
<li>Microsoft Defender for Endpoint (MDE) - EDR policies, ASR rules, and decoy-device monitoring</li>
<li>Microsoft Defender for Office 365 (MDO) - anti-phishing, Safe Links, Safe Attachments, and honeytoken inboxes</li>
<li>Optimise automatic attack disruption, automated investigation and response (AIR), and self-healing capabilities to:<ul>
<li>Disrupt in-progress attacks at machine speed, including deception-triggered intrusions</li>
<li>Reduce analyst workload through high-confidence automation</li>
<li>Improve coverage for ransomware, BEC, and identity-based attacks</li>
<li>Ensure consistent telemetry ingestion and detection parity across Windows, macOS, Linux, mobile, and deception assets.</li>
</ul></li></ul></li><li>Multi-Cloud Deception &amp; Detection (AWS, GCP, OCI)<ul>
<li>Extend the deception programme and Defender-style detection capabilities consistently across AWS, GCP, and OCI, including:</li>
<li>Cloud honeypots, decoy IAM roles, and honeytoken cloud credentials / API keys</li>
<li>Control-plane, workload, container, and Kubernetes threat detection</li>
<li>Cross-cloud identity and access misuse detection</li>
<li>Ensure consistent detection, deception, and response coverage across hybrid and multi-cloud environments.</li>
</ul></li><li>Automation, Agentic AI &amp; Continuous Improvement<ul>
<li>Drive automation of deception deployment, detection, investigation, and response workflows using Microsoft Sentinel SOAR, Logic Apps, and Microsoft Security Copilot.</li>
<li>Define KPIs and metrics covering deception engagement, detection coverage, and response maturity.</li>
<li>Continuously improve detection, hunting, and deception capabilities to align with emerging threats and adversary tradecraft.</li>
</ul></li><li>Stakeholder Engagement &amp; Technical Leadership<ul>
<li>Lead and grow a team of Defender XDR and Deception Engineers, setting technical direction, standards, and delivery priorities.</li>
<li>Partner with SOC, CTI, Identity, Cloud, and Engineering teams to embed deception and Defender XDR detection into all enterprise platforms.</li>
<li>Provide mentorship and leadership to deception engineers, detection engineers, threat hunters, and SOC analysts.</li>
<li>Communicate deception strategy, detection coverage, residual risk, and security improvements to senior stakeholders.</li></ul></li></ul> 


</div><h2 class="jobSectionHeader">Qualifications</h2>
<div>
What you'll bring:

Required Skills &amp; Experience:
<ul>
<li>Proven experience designing and operating enterprise cyber deception programmes (honeypots, honeytokens, decoy users, decoy devices, breadcrumbs) at scale.</li>
<li>Extensive hands-on experience operating and engineering Microsoft Defender XDR (MDE, MDI, MDO, MDA) in large enterprises.</li>
<li>Deep expertise across the Microsoft security stack, including:<ul>
<li>Microsoft Defender for Identity (MDI) deceptive accounts, deceptive devices, and honeytokens</li>
<li>Microsoft Sentinel (analytics rules, workbooks, hunting, SOAR)</li>
<li>Microsoft Security Copilot, automated investigation &amp; response, and attack disruption</li>
<li>Microsoft Defender for Cloud Apps and Defender for Cloud</li>
</ul></li><li>Hands-on experience with:<ul>
<li>Open-source and commercial deception / honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception)</li>
<li>Advanced KQL for detection engineering and threat hunting at scale</li>
<li>Detection-as-code, CI/CD of detection content, and security content management</li>
</ul></li><li>Strong knowledge of adversary tradecraft and frameworks:<ul>
<li>MITRE ATT&amp;CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain</li>
<li>Experience leveraging Agentic AI, Microsoft Security Copilot, or AI/ML in security operations (detection, hunting, IR, automation).</li>
</ul></li><li>Proven experience leading incident response across identity, endpoint, email, and cloud domains.</li>
<li>Strong scripting / automation experience (PowerShell, Python, or equivalent).</li>
<li>Deep understanding of Zero Trust architecture and identity-centric defence.</li></ul> 


Preferred Qualifications:
<ul>
<li>Experience contributing to red-team / purple-team exercises and breach-and-attack simulation (BAS) programmes.</li>
<li>Microsoft certifications:<ul>
<li>Microsoft Certified: Security Operations Analyst Associate (SC-200)</li>
<li>Microsoft Certified: Azure Security Engineer Associate (AZ-500)</li>
<li>Microsoft Certified: Cybersecurity Architect Expert (SC-100)</li>
<li>Industry certifications (CISSP, GCIA, GCFA, GCIH, OSCP, or equivalent)</li>
<li>Cloud certifications across AWS, GCP, or OCI</li></ul></li> 
</ul>
What we offer:

Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.

We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.

Equal Opportunity Employer

We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidatehelpdesk@wtwco.com</div></div>

Principal Microsoft Defender XDR & Deception Engineer

<div><h2 class="jobSectionHeader">Description</h2>
<div>
The Threat-Led Detection Engineer Lead will drive WTW&rsquo;s detection engineering capability within the Global Information and Cyber Security Defence (ICSD) function, owning the strategy, quality, and continuous improvement of how WTW detects threats across its global estate in AI era. This role blends deep technical detection expertise with team leadership, driving a threat-led, intelligence-informed approach to detection that maps directly to real adversary behaviour.

The Lead will set the standard for how detections are designed, written, tested, documented, and maintained &ndash; championing Detection-as-Code, measurable detection coverage, and a strong engineering culture. Working closely with SOC, Threat Hunting, Cyber Threat Intelligence (CTI), Incident Response, and Vulnerability

Management teams, the Lead will ensure WTW&rsquo;s detection library evolves ahead of the threat landscape. 
The individual will work as part of a global, multi-disciplined security community with strong support across the business, helping to foster a security-aware culture while ensuring WTW remains a great place to work. With WTW&rsquo;s large global footprint, this role offers a fascinating range of work, and occasional global travel may be required.

The Threat-Led Detection Engineer Lead will grow WTW&rsquo;s detection engineering function within the Global Cyber Security Defence team. Responsibilities of this role will include:
<ul>
<li>Drive WTW&rsquo;s detection engineering strategy, setting the vision, standards, and roadmap for threat-led detection across cloud, endpoint, identity, network, and SaaS environments.</li>
<li>Lead, mentor, and grow a team of detection engineers, establishing engineering best practices, peer review, and a culture of high-quality, well-documented detections.</li>
<li>Drive a threat-led detection approach, prioritising detection development against adversary tradecraft using the MITRE ATT&amp;CK framework, the Cyber Kill Chain, and the Diamond Model of Intrusion Analysis.</li>
<li>Translate Cyber Threat Intelligence and threat-hunting findings into robust, high-fidelity detections with low false-positive rates.</li>
<li>Establish, own, and maintain the central detection library, ensuring detections are version-controlled, tested, documented, and mapped to MITRE ATT&amp;CK coverage.</li>
<li>Champion Detection-as-Code, implementing Git-based workflows, CI/CD pipelines, automated testing, and peer review for all detection content.</li>
<li>Define and track detection coverage, efficacy, and quality metrics (e.g. ATT&amp;CK coverage, detection fidelity, time-to-detect) and report on detection posture to senior leadership.</li>
<li>Lead detection validation and tuning through adversary emulation, purple-team exercises, and breach-and-attack-simulation tooling (e.g. Atomic Red Team, Caldera).</li>
<li>Support the integration of AI and automation into detection workflows &ndash; including AI-assisted detection authoring, enrichment, and triage &ndash; and lead detection efforts for AI/GenAI-specific threats.</li>
<li>Partner with SOC, Threat Hunting, CTI, Incident Response, and Vulnerability Management to close detection gaps identified during incidents and hunts.</li>
<li>Govern the full detection lifecycle: intake, development, testing, deployment, monitoring, tuning, retirement, and continuous improvement.</li>
<li>Evaluate and onboard new log sources, telemetry, and tooling to expand detection coverage across the global estate.</li>
<li>Set standards for detection documentation, runbooks, and response guidance so every detection is clear and actionable for the SOC.</li></ul> 

</div>
<h2 class="jobSectionHeader">Qualifications</h2>
<div>
We are looking for a candidate for the Threat-Led Detection Engineer Lead role who has the following:
Must-have
<ul>
<li>5+ years in cyber security with detection engineering experience, including a track record of leading, mentoring, or coordinating technical teams.</li>
<li>Strong cyber security mindset with a deep, thorough understanding of adversary behaviour, attacker tradecraft, and the modern threat landscape.</li>
<li>Expert knowledge of the MITRE ATT&amp;CK framework, the Cyber Kill Chain, and the Diamond Model, with proven ability to map and drive detection coverage against them.</li>
<li>Proven expertise writing, testing, and maintaining detection rules across SIEM and EDR/XDR platforms (e.g. Microsoft Sentinel, Splunk, Elastic, CrowdStrike, Microsoft Defender XDR), using query languages such as KQL, SPL, EQL, or Sigma.</li>
<li>Demonstrated ability to develop high-fidelity detections swiftly in response to emerging threats, intelligence, and live incidents.</li>
<li>Experience owning and maturing a detection library, including detection lifecycle governance and ATT&amp;CK coverage mapping.</li>
<li>Hands-on experience with Detection-as-Code: Git, version control, CI/CD pipelines, and automated testing of detection content.</li>
<li>Understanding of AI/ML in security operations and awareness of AI-specific threats (prompt injection, model/data poisoning, sensitive-data exposure via GenAI), with familiarity with the OWASP LLM Top 10 and MITRE ATLAS.</li>
<li>Exceptional written and verbal communication skills, able to convey complex technical concepts to both engineers and non-technical stakeholders, including executives.</li></ul> 


Good to have
<ul>
<li>Strong threat-hunting mindset and hands-on hunting experience to proactively surface detection gaps and feed detection development.</li>
<li>Scripting and automation skills (e.g. Python, PowerShell) for tooling, enrichment, and SOAR integration.</li>
<li>Familiarity with detection data pipelines (log routing, parsing, normalisation, data lakes) and how they affect detection quality.</li></ul> 


We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidate.helpdesk@willistowerswatson.com.</div></div>

Threat-Led Detection Engineer - Lead

<div><h2 class="jobSectionHeader">Description</h2>
<div>
The Threat-Led Detection Engineer will design, build, and maintain high-quality threat detections within WTW&rsquo;s Global Information and Cyber Security Defence (ICSD) function, helping WTW detect adversary activity quickly and accurately across its global estate. This is a hands-on engineering role for someone with a strong cyber security mindset and a genuine interest in how attackers operate. You will write and tune detection rules, map coverage to real adversary behaviour, and contribute to a well-maintained, version-controlled detection library. Working closely with SOC, Threat Hunting, Cyber Threat Intelligence (CTI), and Incident Response, you will turn intelligence and hunt findings into reliable detections, embracing a threat-led, Detection-as-Code approach.

The individual will work as part of a global, multi-disciplined security community with strong support across the business, helping to foster a security-aware culture while ensuring WTW remains a great place to work. With WTW&rsquo;s large global footprint, this role offers a varied and stimulating range of work, and occasional global travel may be required. The role is based in London and follows a hybrid working model, with the expectation of attending the office as and when required on business demand.

The Role: 
 
The Threat-Led Detection Engineer will build and maintain detections within WTW&rsquo;s Global Cyber Security Defence team. Responsibilities of this role will include:
<ul>
<li>Design, write, test, and maintain high-fidelity detection rules across SIEM, EDR/XDR, cloud, identity, and network data sources.</li>
<li>Apply a threat-led approach, developing detections mapped to adversary tradecraft using the MITRE ATT&amp;CK framework, the Cyber Kill Chain, and the Diamond Model.</li>
<li>Rapidly create new detections in response to emerging threats, Cyber Threat Intelligence, and incident or hunt findings.</li>
<li>Contribute to the detection library, ensuring detections are version-controlled, documented, tested, and mapped to MITRE ATT&amp;CK coverage.</li>
<li>Tune and optimise existing detections to reduce false positives and continuously improve fidelity.</li>
<li>Practise Detection-as-Code, using Git-based workflows, peer review, and automated testing for detection content.</li>
<li>Validate detections through adversary emulation and testing (e.g. Atomic Red Team) and collaborate on purple-team exercises.</li>
<li>Support the integration of AI and automation into detection and triage workflows, and help build detections for AI/GenAI-specific threats.</li>
<li>Collaborate with SOC, Threat Hunting, CTI, and Incident Response to close detection gaps surfaced during hunts and incidents.</li>
<li>Write clear detection documentation and response guidance so each detection is actionable for analysts.</li>
<li>Onboard and validate new log sources and telemetry to expand detection coverage.</li>
<li>Contribute to detection coverage and quality metrics to help measure and improve detection effectiveness.</li>
</ul></div><h2 class="jobSectionHeader">Qualifications</h2>
<div>
What you'll bring:

We are looking for a candidate for the Threat-Led Detection Engineer role who has the following:

Must-have:
<ul>
<li>Strong background in cyber security with hands-on detection engineering, SOC, or threat-hunting experience.</li>
<li>Strong cyber security mindset and a solid, thorough understanding of attacker behaviour and the modern threat landscape.</li>
<li>Working knowledge of the MITRE ATT&amp;CK framework, the Cyber Kill Chain, and the Diamond Model, with the ability to map detections to them.</li>
<li>Hands-on experience writing and tuning detection rules using query languages such as KQL, SPL, EQL, or Sigma on platforms like Microsoft Sentinel, Splunk, Elastic, CrowdStrike, or Microsoft Defender XDR.</li>
<li>Ability to develop high-fidelity detections swiftly in response to emerging threats and intelligence.</li>
<li>Experience maintaining detection content and contributing to a detection library.</li>
<li>Familiarity with Detection-as-Code concepts: Git, version control, and automated testing of detection content.</li>
<li>Awareness of AI/ML in security operations and AI-specific threats (e.g. prompt injection, sensitive-data exposure via GenAI), with awareness of the OWASP LLM Top 10 and MITRE ATLAS.</li>
<li>Exposure to cloud detection across Azure, AWS, and/or GCP and to cloud and identity log sources (e.g. Entra ID, CloudTrail).</li>
<li>Good written and verbal communication skills, able to document detections clearly and collaborate across teams.</li></ul> 


Good to have:
<ul>
<li>Threat-hunting mindset and experience hunting for novel or emerging threats to feed detection development.</li>
<li>Experience with adversary emulation and breach-and-attack-simulation tooling (Atomic Red Team, Caldera) and purple teaming.</li>
<li>Scripting skills (e.g. Python, PowerShell) for automation and enrichment.</li></ul> 


What we offer:

Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.

We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.

Equal Opportunity Employer

We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidatehelpdesk@wtwco.com</div></div>

Threat-Led Detection Engineer

<div>
 
 Description
 
 
 
 As a DevOps Engineer, you will join a global engineering organisation supporting the delivery of WTW&rsquo;s flagship Radar Live product. You will work teams and disciplines to improve the end-to-end path from code commit through build, automated testing, security scanning, release, deployment and environment validation.
 
 
 This is a hands-on DevOps engineering role focused on improving the flow, safety, repeatability and quality of software delivery. You will help build and maintain the automation, pipelines, Infrastructure-as-Code, Kubernetes deployment patterns and engineering practices that allow development teams to deliver reliably and at velocity.
 
 
 The ideal candidate will have strong experience with Azure DevOps, PowerShell automation, OpenTofu/Terraform-style Infrastructure-as-Code, Azure, AKS and Kubernetes. Just as importantly, they will bring a practical DevOps mindset: reducing manual work, improving feedback loops, embedding security and quality checks into delivery, supporting developers, and making complex delivery processes simpler, safer and more observable.
 
 
 
 The Role
 
 
 
 As a DevOps Engineer, you will help improve the engineering systems and practices that take Radar Live from code change to validated deployment. You will work closely with development teams, SaaS infrastructure, security, QA and architecture to make delivery safer, faster, more automated and easier to operate.
 
 
 
 You Will Be Expected To
 
 
 
 <ul>
 <li>
 Build, maintain and improve Azure DevOps YAML pipelines for build, validation, packaging, release and deployment workflows.
 </li>
 <li>
 Support the full delivery flow from code commit through automated testing, security scanning, release evidence, deployment and environment validation.
 </li>
 <li>
 Develop PowerShell automation and tooling that reduces manual effort and improves consistency across teams and environments.
 </li>
 <li>
 Maintain and extend Infrastructure-as-Code using OpenTofu and Terraform-compatible patterns for Azure-based development and production-like environments.
 </li>
 <li>
 Support AKS and Kubernetes-based deployment patterns, including Helm, workload configuration, ingress, secrets, certificates and troubleshooting.
 </li>
 <li>
 Work with Azure services such as AKS, Azure Front Door, API Management, Azure DNS, Key Vault, Managed Identities, Azure networking and Microsoft Entra ID.
 </li>
 <li>
 Integrate and support security tooling and quality gates, including Mend, Snyk, Invicti, Wiz and GitLeaks.
 </li>
 <li>
 Improve observability and feedback across build, deployment and environment health using tools such as Datadog, Azure Monitor and Log Analytics.
 </li>
 <li>
 Help development teams diagnose delivery, deployment and environment issues in non-production and production-like SaaS environments.
 </li>
 <li>
 Improve release traceability, auditability and governance while keeping delivery processes practical and developer friendly.
 </li>
 <li>
 Use delivery and flow metrics pragmatically to identify bottlenecks, reduce avoidable failures and support continuous improvement.
 </li>
 <li>
 Collaborate across teams to promote DevOps practices, shared engineering standards and reliable, repeatable delivery.
 </li>
 <li>
 Contribute to future CI/CD evolution, including potential adoption of GitHub Actions.
 
 
 </li>
 </ul>
 
 Qualifications
 
 
 
 
 What you&rsquo;ll bring
 
 
 
 
 Essential Skills And Experience
 
 
 
 The essential skills and experience for this position are:
 
 
 <ul>
 <li>
 Strong hands-on experience in a DevOps, release engineering or cloud engineering role supporting software delivery in a SaaS or cloud-based environment.
 </li>
 <li>
 Strong experience designing, maintaining and improving CI/CD workflows, preferably using Azure DevOps YAML pipelines.
 </li>
 <li>
 Strong PowerShell automation skills, with a focus on maintainable, repeatable and version-controlled tooling.
 </li>
 <li>
 Experience with Infrastructure-as-Code using OpenTofu, Terraform or equivalent declarative IaC tooling.
 </li>
 <li>
 Good working knowledge of Microsoft Azure and the services commonly used to support SaaS delivery environments.
 </li>
 <li>
 Hands-on Kubernetes experience, ideally with AKS, including Helm-based deployment, workload configuration, ingress, secrets, certificates and troubleshooting.
 </li>
 <li>
 Experience embedding security, quality and compliance checks into delivery pipelines, including vulnerability scanning, container scanning, secrets scanning and release evidence.
 </li>
 <li>
 Good understanding of observability practices, including logs, metrics, dashboards, alerts and environment health checks.
 </li>
 <li>
 Strong troubleshooting skills across pipelines, deployment automation, Kubernetes workloads, cloud configuration and environment issues.
 </li>
 <li>
 Ability to work closely with development teams to improve build, test, deployment and release workflows.
 </li>
 <li>
 Practical understanding of Agile delivery, DevOps ways of working and continuous improvement.
 </li>
 <li>
 Strong communication skills, with the ability to explain technical issues clearly and work effectively across development, infrastructure, security, QA and architecture teams.
 
 
 </li>
 </ul>
 
 Highly Desirable Skills And Experience
 
 
 
 
 The following skills and experience are highly desirable, but not essential:
 
 
 
 <ul>
 <li>
 Experience with the current delivery and security toolchain, including Azure DevOps, Mend, Snyk, Invicti, Wiz, GitLeaks, Datadog, Azure Monitor and Log Analytics.
 </li>
 <li>
 Experience with GitHub Actions or migration from Azure DevOps to GitHub-based workflows.
 </li>
 <li>
 Experience with GitOps workflows, Argo CD, progressive delivery, service mesh or advanced ingress patterns.
 </li>
 <li>
 Experience supporting complex SaaS systems, distributed architectures or regulated technology environments.
 </li>
 <li>
 Relevant Microsoft Azure, Kubernetes or Infrastructure-as-Code certifications.
 </li>
 <li>
 Degree in Computer Science, Engineering, Mathematics or equivalent industry experience.
 </li>
 <li>
 Knowledge of the insurance industry or financial services technology environments.
 
 
 </li>
 </ul>
 
 What We Offer
 
 
 
 Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.
 
 
 We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.
 
 
 
 Equal Opportunity Employer
 
 
 
 We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidatehelpdesk@wtwco.com
 
 
 (ICT_TECH TD_2026_20R)
</div>

DevOps Engineer

<div>
 
 Description
 
 
 
 We are seeking a Data Scientist with experience prototyping, building, and scaling AI applications to join WTW&rsquo;s Data Science team within our Consulting practice. In this role, you will help grow our AI and Data Science advisory capability, working alongside leading insurance market experts to design and deliver cutting edge machine learning and generative AI solutions for the world&rsquo;s leading general insurers and intermediaries.
 
 
 
 The Role
 
 
 
 As a data scientist, you will operate at the intersection of advanced machine learning, generative AI, and insurance domain expertise. You will help shape, prototype, and scale AI-driven solutions that materially transform how insurers analyse risk, operate, and make decisions.
 
 
 <ul>
 <li>
 Design, prototype, and build applied AI solutions &mdash; including agentic workflows &mdash; that enhance consulting delivery, unlock new analytical capabilities, and augment expert judgement.
 </li>
 <li>
 Develop generative AI applications using techniques such as Retrieval‑Augmented Generation (RAG), prompt engineering, and tool‑augmented agents to convert complex, unstructured insurer data into reliable, structured insights, prototypes, and semi‑automated analytical tools.
 </li>
 <li>
 Own AI solutions end‑to‑end, from translating ambiguous problem statements into working prototypes through to production‑ready applications for internal teams and external clients.
 </li>
 <li>
 Identify and deliver automation opportunities, such as natural language interfaces over insurer datasets, AI‑assisted exploratory analysis, document understanding, and generation of structured analytical outputs.
 </li>
 <li>
 Apply rigorous AI evaluation and safety practices, including:
 </li>
 <ul>
 <li>
 Prompt and few‑shot experimentation
 </li>
 <li>
 Hallucination detection and mitigation
 </li>
 <li>
 Deterministic and rule‑based validation
 </li>
 <li>
 SME‑driven constraints and edge‑case testing
 </li>
 <li>
 Human‑in‑the‑loop feedback mechanisms
 </li>
 </ul>
 <li>
 Rapidly prototype under uncertainty, independently converting loosely defined business questions into functioning AI tools with minimal supervision and tight iteration cycles.
 </li>
 <li>
 Translate domain expertise into machine‑readable logic, integrating subject‑matter expert input into rules, checks, evaluation criteria, and structured reasoning constraints.
 </li>
 <li>
 Collaborate with consulting, product, and technology teams to scale successful prototypes into reusable, robust analytical workflows and AI‑enabled offerings.
 </li>
 <li>
 Deliver best‑in‑class data science and AI capability reviews, helping clients assess maturity, identify opportunities, and design practical AI roadmaps.
 </li>
 <li>
 Build predictive models, analytical tools, and data products using a wide range of machine learning, statistical, and data science techniques across structured and unstructured data.
 </li>
 <li>
 Leverage market and client knowledge to co‑create innovative solutions across WTW, acting as a visible advocate for WTW&rsquo;s Data Science and AI consulting capabilities.
 </li>
 <li>
 Manage substantial workstreams on large, complex projects, including day‑to‑day client engagement, delivery ownership, and coordination across practices and regions.
 </li>
 <li>
 Develop trusted advisor relationships with senior client stakeholders through clear communication, technical credibility, and consistently high‑quality execution.
 </li>
 <li>
 Contribute to intellectual capital and proposition development, supporting business development through proposals, thought leadership, and internal collaboration.
 </li>
 <li>
 Lead, mentor, and develop junior colleagues, managing small teams to deliver projects on time, on budget, and to a high technical standard.
 
 </li>
 </ul>
 
 Qualifications
 
 
 
 
 What you&rsquo;ll bring
 
 
 
 <ul>
 <li>
 Fluent Python programming skills with an understanding of software engineering practices
 </li>
 <li>
 Demonstrable experience designing, developing, and deploying AI applications end to end, from initial prototype through to scalable production use
 </li>
 <li>
 Hands on experience with one or more of the following Generative AI techniques:
 </li>
 <li>
 Retrieval Augmented Generation (RAG)
 </li>
 <li>
 Prompt engineering
 </li>
 <li>
 Agent based or agentic AI workflows and orchestration
 </li>
 <li>
 AI evaluation frameworks
 </li>
 <li>
 Neuro symbolic frameworks
 </li>
 <li>
 Experience with major cloud platforms such as Azure or AWS
 </li>
 <li>
 Strong understanding of machine learning and statistical modelling principles, with the ability to explain model behaviour, assumptions, and trade offs
 </li>
 <li>
 Experience working with real world structured and unstructured data, and building robust data pipelines
 </li>
 <li>
 Strong interpersonal and collaboration skills, with the ability to work effectively in multi disciplinary teams and engage with clients
 </li>
 <li>
 Comfortable with rapid prototyping, experimentation, and iterative tool building
 </li>
 <li>
 A proven track record of innovation, delivering AI driven solutions that create measurable business value such as revenue growth, efficiency improvements, or risk reduction
 </li>
 <li>
 Experience in insurance or consulting
 </li>
 <li>
 Experience with MLOps
 </li>
 <li>
 Experience with fine-tuning or adapting foundation models, such as LoRA
 </li>
 <li>
 Experience with WTW actuarial software
 
 
 </li>
 </ul>
 
 What We Offer
 
 
 
 Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.
 
 
 We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.
 
 
 
 Equal Opportunity Employer
 
 
 
 We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidatehelpdesk@wtwco.com
</div>

Senior Data Scientist - AI

<div><h2 class="jobSectionHeader">Description</h2>
<div>
We&rsquo;re looking for a highly skilled Forward Deployed AI Engineer to join our Health, Wealth &amp; Career (HWC) segment&mdash;where you&rsquo;ll design and deliver cutting-edge AI solutions that solve complex, real-world business challenges and shape the future of work.

This is a hands-on, high-impact role where you&rsquo;ll move beyond traditional development&mdash;partnering closely with stakeholders to translate ambiguous needs into scalable, AI-powered solutions that drive measurable value. You&rsquo;ll own the full lifecycle&mdash;from architecture and build through to deployment and adoption&mdash;embedding AI into real workflows, integrating enterprise systems, and ensuring solutions are secure, reliable, and truly user-centric. Sitting close to the business, you&rsquo;ll continuously refine solutions to maximise impact, efficiency, and adoption.

Why join us?
<ul>
<li>At WTW, you&rsquo;ll be part of our Health, Wealth &amp; Career (HWC) segment&mdash;where we use data, technology, and deep expertise to shape the future of work.</li>
<li>You&rsquo;ll collaborate across multiple lines of business&mdash;such as Retirement, Health &amp; Benefits, and Workforce Strategy&mdash;gaining exposure to diverse challenges and opportunities.</li>
<li>As the role evolves, you&rsquo;ll also help deliver innovative, AI-driven solutions directly to external clients, turning complex problems into scalable outcomes.</li>
<li>Together, we&rsquo;re creating more resilient, high-performing organizations&mdash;enhancing wellbeing, enabling better decisions, and driving sustainable business success at scale.</li>
<li>This is a hybrid role, with the flexibility of remote working alongside occasional time in the office to build strong relationships and collaborate effectively with stakeholders.</li> 
</ul>
The Role 
This position is ideal for an experienced Solutions Architect, Staff Engineer, or Technical Lead with a strong enterprise engineering background and a passion for applying it to AI-enabled systems. You&rsquo;ll bring deep expertise across modern full-stack technologies (.NET, Azure, SQL, React/Angular), along with experience in distributed systems, observability, and AI tooling such as LLMs, retrieval pipelines, and agentic workflows. 
Acting as a bridge between business and technology, you&rsquo;ll work across product, data science, architecture, and engineering teams&mdash;mentoring others, resolving production challenges, and scaling prototypes into robust, enterprise-grade solutions that deliver real impact.
<ul>
<li>AI solution delivery: Design and build AI-enabled applications, copilots, agents, extraction pipelines, prediction interfaces, and decision-support tools using foundation models, retrieval-augmented generation, structured outputs, and orchestration frameworks.</li>
<li>Forward deployed problem solving: Work directly with business teams, product owners, clients, or operational users to understand real workflows, constraints, data quality issues, and adoption barriers, then translate these into working technical solutions.</li>
<li>LLM and agent engineering: Build and tune LLM workflows, prompt strategies, schema-driven extraction, tool-calling patterns, agent orchestration, evaluation loops, and human-in-the-loop controls.</li>
<li>Enterprise integration: Integrate AI solutions with enterprise systems, APIs, data platforms, document repositories, workflow tools, observability platforms, and identity and access management services.</li>
<li>Production engineering: Ensure AI solutions meet enterprise standards for reliability, scalability, latency, maintainability, cost control, logging, monitoring, and operational support.</li>
<li>Evaluation and quality assurance: Create evaluation datasets, test harnesses, validation tools, regression checks, and quality review workflows to measure accuracy, extraction quality, hallucination risk, and business usefulness.</li>
<li>Architecture and technical leadership: Define solution architecture, engineering standards, reusable patterns, and implementation approaches for AI-enabled platforms and services.</li>
<li>Data and knowledge readiness: Work with engineering, data, and business teams to prepare structured and unstructured data, improve metadata, design retrieval strategies, and identify gaps in source content.</li>
<li>Security, privacy, and governance: Embed access controls, audit logging, data protection, responsible AI controls, security review, and compliance requirements into the AI delivery lifecycle.</li>
<li>Adoption and enablement: Support users through demos, pilots, training, feedback loops, documentation, and iterative improvement so that deployed AI solutions create measurable business value.</li>
</ul></div><h2 class="jobSectionHeader">Qualifications</h2>
<div>
What you'll bring
<ul>
<li>Significant professional experience in software engineering, technical leadership, solutions architecture, or platform engineering, ideally in enterprise-scale environments.</li>
<li>Proven ability to design and deliver production applications using modern engineering practices, including APIs, distributed systems, microservices, automated testing, CI/CD, observability, and cloud platforms.</li>
<li>Hands-on experience building AI-enabled systems, such as LLM pipelines, document extraction, structured output generation, AI-assisted analytics, prediction interfaces, or agentic workflows.</li>
<li>Experience working with business-critical systems where reliability, maintainability, operational support, and measurable business impact are essential.</li>
<li>Experience collaborating with data scientists, product managers, QA teams, architects, security teams, and senior stakeholders.</li>
<li>Track record of mentoring engineers, leading technical delivery, establishing engineering standards, and influencing teams beyond direct line management.</li>
</ul>
What we offer 
Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.

We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.

Equal Opportunity Employer 
We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidatehelpdesk@wtwco.com</div></div>

Forward Deployed AI Engineer

Join WTW and explore 12   exciting career opportunities. They're hiring for various roles with options for remote or on-site work. Apply today and become part of their innovative team.

WTW