cyber security engineer

Dorchester Collection

<div><div><h2 class="jobSectionHeader">Your future, our legacy</h2>
<h3 class="jobSectionHeader">Hotel</h3>
Dorchester Collection
<h3 class="jobSectionHeader">Division &amp; Department</h3>
Corporate Office - Information Technology
<h3 class="jobSectionHeader">Job Title</h3>
Cyber Security Engineer
<h3 class="jobSectionHeader">Contract Type</h3>
Permanent
<h3 class="jobSectionHeader">Status</h3>
Full time
<h3 class="jobSectionHeader">Position Overview</h3>
<div>We care about your career and are known for having the absolute best people in the industry. When you join us as a Cyber Security Engineer you start a unique opportunity to become celebrated as the very best in your field. You&rsquo;ll learn not only from your fellow Legends, but also through our award-winning learning academy, so that you can achieve the highest standards of craft, service, and leadership and become a legend in your own story.
The Cyber Security Engineer is a hands-on technical role responsible for shaping, driving, and continuously improving the organisation&rsquo;s information and cyber security posture across on‑premises infrastructure and Microsoft Azure cloud environments. The role focuses on owning and delivering remediation from security assessments, penetration testing, and vulnerability management, while acting as the technical subject matter expert for cyber security across the business.
This position is suited to candidates with a strong infrastructure or IT system administration/support background, with proven experience securing hybrid environments and responding to real‑world threats
</div><h3 class="jobSectionHeader">What you'll get</h3>
<div>As a Cyber Security Engineer at Dorchester Collection here are just some of the great benefits you will receive:
<ul><li>Complimentary stays with breakfast included in all 10 Dorchester Collection hotels</li>
<li>50% off at bars and restaurants within all of our Dorchester Collection hotels</li>
<li>&pound;750 Refer a friend bonus scheme</li>
<li>World class development opportunities</li>
<li>Social events throughout the year</li>
<li>Workday Lunches in the form of a prepaid contactless card</li>
<li>Season ticket loan and cycle to work scheme</li>
<li>Exclusive Access to a discount platform featuring 1000s of retailers</li>
<li>Subsided access to gyms, fitness classes and wellness experiences</li>
<li>Competitive retirement scheme</li>
</ul></div><h3 class="jobSectionHeader">What you'll do</h3>
<div><ul><li>Cyber Security Engineering &amp; Operations
<ul><li>Own and resolve cyber security&ndash;related support tickets, investigations, and technical issues.</li>
<li>Triaging, investigating, and responding to threats via the global XDR platform.</li>
</ul></li><li>Act as an escalation point for complex or high-risk security events.
 
<ul><li>Vulnerability Management &amp; Remediation</li>
<li>Own end-to-end remediation of findings from penetration tests, vulnerability scanning, and internal assessments.</li>
<li>Work hands-on with infrastructure and regional teams to remediate vulnerabilities across servers, endpoints, networks, and cloud platforms.</li>
<li>Track and drive remediation activity to ensure timely closure of security risks.</li>
</ul></li><li>Security Assessments &amp; Posture
<ul><li>Plan and execute internal security assessments and technical reviews across infrastructure and sites.</li>
<li>Identify security gaps, prioritise risk, and define pragmatic remediation plans.</li>
<li>Continuously improve technical security controls and configuration standards.</li>
</ul></li><li>Policy, Standards &amp; Process
<ul><li>Establish, maintain, and improve cyber security policies, standards, and supporting processes.</li>
<li>Ensure security controls align with best practice while remaining workable in operational environments.</li>
<li>Support audits and information security reviews through clear documentation and evidence.</li>
</ul></li><li>Projects &amp; Change
<ul><li>Act as a security point of contact during the design and implementation of IT and business projects.</li>
<li>Review architectures, designs, and deployments to ensure security requirements are met.</li>
</ul></li><li>Regional Coordination &amp; Enablement
<ul><li>Coordinate and delegate security activities across regional IT teams.</li>
<li>Provide technical guidance to ensure consistent application of security standards globally.</li>
<li>Build effective working relationships with regional stakeholders.</li>
</ul></li></ul>The items shared are the essence of a day in the life of a Cyber Security Engineer but we&rsquo;ll make sure you are provided with specifics on how we care for our company.
The hours of operation for this role are Monday to Friday 9:00am to 5:30pm, with a core requirement of on-call support outside of these working hours. We are based in our corporate office in Knightsbridge.
</div><h3 class="jobSectionHeader">What you'll bring</h3>
<div>Essential Skills:
<ul><li>You&rsquo;ll bring your unique personality and passion to the role and the team</li>
<li>Strong background in IT infrastructure and IT systems engineering.</li>
<li>Hands-on experience remediating security vulnerabilities.</li>
<li>Experience with penetration test and vulnerability management outputs.</li>
<li>Strong experience securing Active Directory on premise and Azure cloud environments.</li>
<li>Understanding of identity, access management, patching, and monitoring.</li>
<li>English is the primary language used in our office. You can comfortably communicate in this language, both verbally and written</li>
</ul>Desirable Skills:
<ul><li>Experience supporting ISO 27001, CIS or similar security and audit frameworks.</li>
<li>Security certifications such as SSCP, CISSP, GIAC, or Microsoft Security certifications.</li>
<li>Hands‑on experience managing or supporting next-gen firewall (Palo Alto preferred).</li>
<li>Experience working with XDR platforms, including alert triage, investigation, and response.</li>
<li>Experience operating within hybrid on‑premises and cloud environments at enterprise scale.</li>
</ul></div></div><div><h2 class="jobSectionHeader">Position location</h2>
<h3 class="jobSectionHeader">Job Location</h3>
United Kingdom
<h3 class="jobSectionHeader">Location</h3>
<div>3rd Floor, 1 Knightsbridge SW1X 7LX London</div></div></div>

Cyber Security Engineer

ByDesign Secure

This role is delivered within secure environments. Candidates must be eligible for UK SC and DV clearance and hold UK Citizenship.Opening: Join the MissionAt ByDesign Secure, we believe that world-class security shouldn't be an afterthought&mdash;it should be the foundation. We are an independent, outputs-based consultancy dedicated to solving the most complex data assurance challenges in the UK public sector. Currently, we are working on a landmark transformation of a cross-government secure IT system. This is an exciting opportunity to help architect a private cloud environment from the ground up and modernize the end-user services that power national decision-making. We don't believe in &quot;billing by the hour&quot; or rigid hierarchies; we are a lean, expert team focused on delivering high-impact technical outcomes. If you are a self-starter who thrives on autonomy and wants to see your engineering or architectural decisions shape the future of sovereign security, we want to talk to you.About the Opportunity<ul><li>We are seeking a skilled Cloud Security Engineer to design and implement secure workloads within a Google Distributed Cloud (GDC) environment.</li><li>This role is ideal for a security professional with a strong GCP background (Other CSP experience also considered) and an active Professional Cloud Security Engineer certification, as these competencies are directly transferable to managing security in air-gapped or edge configurations.</li><li>You will be responsible for ensuring security, rigour, and compliance within mission-critical government secure delivery.</li></ul>What You&rsquo;ll Be Doing<ul><li>Identity &amp; Access Management: Designing and managing complex identity architectures, including single sign-on (SSO) integration, multi-factor authentication (MFA), and the automated lifecycle management of privileged user accounts.</li><li>Authorisation &amp; Resource Hierarchy: Defining granular resource hierarchies and implementing the principle of least privilege using advanced identity policies, conditions, and organizational constraints.</li><li>Boundary &amp; Perimeter Protection: Configuring robust network defences, including next-generation firewalls, web application firewalls (WAF), and secure service perimeters to isolate sensitive workloads.</li><li>Data Protection &amp; Encryption: Implementing discovery and redaction services for sensitive data (PII) and managing full-lifecycle encryption through hardware or software-based key management systems.</li><li>Securing the Software Supply Chain: Automating vulnerability scanning and policy enforcement within continuous integration and delivery (CI/CD) pipelines to ensure only authorised code is deployed.</li></ul>Key Tools/Working practices<ul><li>Use GDC Console, gdcloud CLI, and kubectl to manage infrastructure, users, workloads, security policies, and platform resources across projects and clusters</li><li>Implement Terraform and Ansible with Git‑based workflows to deliver repeatable, version‑controlled infrastructure and configuration (GitOps), including Config Sync for consistent environments</li><li>Configure IAM, RBAC, service accounts, and identity provider integration to enforce least‑privilege access and secure authentication, with policy enforcement via OPA Gatekeeper</li><li>Define and secure network boundaries using project network policies (ingress/egress control) and manage encryption and trust with KMS and Certificate Authority services</li><li>Build and package applications using Docker and Helm, store images in Harbor, and integrate vulnerability scanning (e.g. Trivy) to detect and remediate issues before deployment</li><li>Test and interact with APIs using curl/REST tools and develop AI capabilities using Vertex AI libraries and notebook environments (e.g. JupyterLab)</li><li>Monitor and troubleshoot using Grafana, Prometheus, and Loki for metrics and logs, with audit logging and SIEM integration for security and compliance</li><li>Configure alerting for failures, anomalies, and SLO breaches, and implement backup and restore processes for resilience and disaster recovery</li><li>Use platform documentation and support channels to validate configurations, follow operational procedures, and resolve issues</li></ul>What You&rsquo;ll Bring<ul><li>Demonstrable experience as a practicing Security Engineer, with the ability to transition cloud-native security best practices to a distributed/edge platform.</li><li>Deep proficiency in configuring network security defences, threat monitoring, and regulatory compliance controls.</li></ul>Bonus Points For<ul><li>Current, non-expired Professional Cloud Security Engineer certification.</li><li>Experience operating within or alongside classified UK Government secure environments (e.g., SECRET or above).</li><li>Familiarity with GDS Service Standards or equivalent public sector delivery frameworks.</li><li>Experience working in air-gapped or disconnected environments with little or no internet connectivity</li></ul>Clearance Requirements:<ul><li>This role requires either an existing Security Clearance (SC level) or for one to be passed before commencement. There must be a willingness to undergo Developed Vetting (DV).</li></ul>Work Location: Hybrid remote in LondonJob Types: Temporary, Fixed term contract (Outside of IR35)Job Types: Fixed term contract, TemporaryPay: &pound;650.00 per dayApplication question(s):<ul><li>Do you currently hold active UK SC clearance? </li><li>Do you hold UK nationality? (Required due to client security restrictions) </li><li>Are you eligible and willing to undergo UK SC/DV clearance for this role? (Applications without this cannot be considered)</li><li>Does your delivery approach allow for on-site presence in London when required (typically around 3 days per week)?</li></ul>Work Location: Hybrid remote in London

Cloud Security Engineer – SC Eligible – Government Projects

<div><h2 class="jobSectionHeader">Description</h2>
<div>
The Threat-Led Detection Engineer Lead will drive WTW&rsquo;s detection engineering capability within the Global Information and Cyber Security Defence (ICSD) function, owning the strategy, quality, and continuous improvement of how WTW detects threats across its global estate in AI era. This role blends deep technical detection expertise with team leadership, driving a threat-led, intelligence-informed approach to detection that maps directly to real adversary behaviour.

The Lead will set the standard for how detections are designed, written, tested, documented, and maintained &ndash; championing Detection-as-Code, measurable detection coverage, and a strong engineering culture. Working closely with SOC, Threat Hunting, Cyber Threat Intelligence (CTI), Incident Response, and Vulnerability

Management teams, the Lead will ensure WTW&rsquo;s detection library evolves ahead of the threat landscape. 
The individual will work as part of a global, multi-disciplined security community with strong support across the business, helping to foster a security-aware culture while ensuring WTW remains a great place to work. With WTW&rsquo;s large global footprint, this role offers a fascinating range of work, and occasional global travel may be required.

The Threat-Led Detection Engineer Lead will grow WTW&rsquo;s detection engineering function within the Global Cyber Security Defence team. Responsibilities of this role will include:
<ul>
<li>Drive WTW&rsquo;s detection engineering strategy, setting the vision, standards, and roadmap for threat-led detection across cloud, endpoint, identity, network, and SaaS environments.</li>
<li>Lead, mentor, and grow a team of detection engineers, establishing engineering best practices, peer review, and a culture of high-quality, well-documented detections.</li>
<li>Drive a threat-led detection approach, prioritising detection development against adversary tradecraft using the MITRE ATT&amp;CK framework, the Cyber Kill Chain, and the Diamond Model of Intrusion Analysis.</li>
<li>Translate Cyber Threat Intelligence and threat-hunting findings into robust, high-fidelity detections with low false-positive rates.</li>
<li>Establish, own, and maintain the central detection library, ensuring detections are version-controlled, tested, documented, and mapped to MITRE ATT&amp;CK coverage.</li>
<li>Champion Detection-as-Code, implementing Git-based workflows, CI/CD pipelines, automated testing, and peer review for all detection content.</li>
<li>Define and track detection coverage, efficacy, and quality metrics (e.g. ATT&amp;CK coverage, detection fidelity, time-to-detect) and report on detection posture to senior leadership.</li>
<li>Lead detection validation and tuning through adversary emulation, purple-team exercises, and breach-and-attack-simulation tooling (e.g. Atomic Red Team, Caldera).</li>
<li>Support the integration of AI and automation into detection workflows &ndash; including AI-assisted detection authoring, enrichment, and triage &ndash; and lead detection efforts for AI/GenAI-specific threats.</li>
<li>Partner with SOC, Threat Hunting, CTI, Incident Response, and Vulnerability Management to close detection gaps identified during incidents and hunts.</li>
<li>Govern the full detection lifecycle: intake, development, testing, deployment, monitoring, tuning, retirement, and continuous improvement.</li>
<li>Evaluate and onboard new log sources, telemetry, and tooling to expand detection coverage across the global estate.</li>
<li>Set standards for detection documentation, runbooks, and response guidance so every detection is clear and actionable for the SOC.</li></ul> 

</div>
<h2 class="jobSectionHeader">Qualifications</h2>
<div>
We are looking for a candidate for the Threat-Led Detection Engineer Lead role who has the following:
Must-have
<ul>
<li>5+ years in cyber security with detection engineering experience, including a track record of leading, mentoring, or coordinating technical teams.</li>
<li>Strong cyber security mindset with a deep, thorough understanding of adversary behaviour, attacker tradecraft, and the modern threat landscape.</li>
<li>Expert knowledge of the MITRE ATT&amp;CK framework, the Cyber Kill Chain, and the Diamond Model, with proven ability to map and drive detection coverage against them.</li>
<li>Proven expertise writing, testing, and maintaining detection rules across SIEM and EDR/XDR platforms (e.g. Microsoft Sentinel, Splunk, Elastic, CrowdStrike, Microsoft Defender XDR), using query languages such as KQL, SPL, EQL, or Sigma.</li>
<li>Demonstrated ability to develop high-fidelity detections swiftly in response to emerging threats, intelligence, and live incidents.</li>
<li>Experience owning and maturing a detection library, including detection lifecycle governance and ATT&amp;CK coverage mapping.</li>
<li>Hands-on experience with Detection-as-Code: Git, version control, CI/CD pipelines, and automated testing of detection content.</li>
<li>Understanding of AI/ML in security operations and awareness of AI-specific threats (prompt injection, model/data poisoning, sensitive-data exposure via GenAI), with familiarity with the OWASP LLM Top 10 and MITRE ATLAS.</li>
<li>Exceptional written and verbal communication skills, able to convey complex technical concepts to both engineers and non-technical stakeholders, including executives.</li></ul> 


Good to have
<ul>
<li>Strong threat-hunting mindset and hands-on hunting experience to proactively surface detection gaps and feed detection development.</li>
<li>Scripting and automation skills (e.g. Python, PowerShell) for tooling, enrichment, and SOAR integration.</li>
<li>Familiarity with detection data pipelines (log routing, parsing, normalisation, data lakes) and how they affect detection quality.</li></ul> 


We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidate.helpdesk@willistowerswatson.com.</div></div>

Threat-Led Detection Engineer - Lead

Bridewell

<div>Start Date: 14th September 2026
About Bridewell
One of the most exciting prospects in the UK cyber security sector today, Bridewell is a leading cyber security services company specialising in protecting and transforming critical business functions for some of the world&rsquo;s most trusted organisations. We are the trusted partner for operators of essential services and provide end-to-end cyber security capabilities that help our clients overcome their security challenges, allowing them to operate safely and securely.
Bridewell holds the Gold level, Investors in People award which we feel solidifies and reflects on the outstanding calibre that makes us truly one team.
The Opportunity
In the first three months of the Bridewell Academy, you will undergo comprehensive onboarding, where you will meet your manager and assigned buddy, who will guide you through the initial stages of your journey. During this period, you will gain exposure to our Cloud Engineering team, allowing you to familiarise yourself with cloud architecture, modern engineering practices, and the Microsoft 365 security stack &mdash; including Microsoft Defender (XDR), Microsoft Sentinel, and Microsoft Purview &mdash; alongside equivalent capabilities across other hyper-scalers. You will complete foundational training, such as the Microsoft Certified: Azure Fundamentals (AZ-900), Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900), and AWS Certified Cloud Practitioner courses, and become acquainted with our learning management systems, setting a solid foundation for your professional development.
As you progress into the three to six-month mark, you will begin shadowing and contributing to client-facing cloud projects, where you'll apply your skills in real-world scenarios. This hands-on experience will be invaluable as you collaborate with senior consultants on deployments, configuration tasks, and technical documentation across Microsoft Azure, Microsoft 365, AWS, and GCP environments &mdash; with early exposure to security tooling such as Microsoft Defender, Microsoft Entra and Microsoft Sentinel.
Between six to eighteen months, you will continue working on client-facing projects both independently and as part of a squad, enhancing your practical experience in the field. During this time, you will focus on completing essential certifications such as:
<ul><li>Microsoft Certified: Azure Administrator Associate (AZ-104)</li><li>
Microsoft Certified: Security Operations Analyst Associate (SC-200)</li><li>
Microsoft Certified: Information Protection and Compliance Administrator Associate (SC-401)
</li><li>Microsoft Certified: Cloud and AI Security Engineer (SC-500)</li><li>
AWS Certified Solutions Architect &ndash; Associate or Google Associate Cloud Engineer</li></ul>
Achieving these qualifications will further prepare you for your future role, culminating in your pathway to becoming academy certified. This structured progression ensures you are well-equipped with the knowledge and hands-on experience needed to thrive in a modern multi-cloud and cloud-security engineering career. 
Requirements 
Responsibilities<ul><li>
Support Client Engagements: Assist in the delivery of high-quality cloud engineering projects. Help clients design, deploy, and operate workloads across Microsoft Azure, Microsoft 365, AWS, and GCP, contributing to activities such as landing zone builds, identity and access configuration, network design, and the deployment and tuning of Microsoft Defender, Microsoft Sentinel, and Microsoft Purview alongside equivalent native security services in other clouds.</li><li>
Stay Informed: Actively engage in professional development by attending relevant training sessions, hackathons, vendor workshops (Microsoft, AWS, Google), and industry conferences to remain current with the latest cloud services, security tooling, architectural patterns, and engineering best practices.</li><li>
Collaborate with Consultants: Work closely with senior cloud and security engineers on project tasks &mdash; helping to gather requirements, build proofs-of-concept, author detections and analytics rules in Sentinel, configure Defender policies, script automation (e.g. PowerShell, KQL, Bicep, Terraform, ARM, CloudFormation), and prepare technical documentation to ensure project objectives are met efficiently and effectively.</li><li>
Participate in Team Meetings: Join regular squad stand-ups, design reviews, and retrospectives to discuss project progress, share insights, and gather feedback, fostering a collaborative engineering culture and enhancing your personal learning.</li><li>
Conduct Technical Research: Help with preliminary research on emerging cloud and security services, reference architectures, and comparative analysis between vendors (Azure/M365 vs. AWS vs. GCP) to support project work and internal capability development.</li><li>
Engage with Clients: Participate in client meetings, technical workshops, and whiteboarding sessions as needed, providing support and gathering information to understand client requirements and contribute to high-quality service delivery.</li></ul>
Experience<ul><li>
A degree in Computer Science, Cloud Computing, Cyber Security, an equivalent qualification, or completion of a cloud/engineering-focused training course or bootcamp.</li><li>
Minimum grade of 4/C in GCSE English Language and Maths (or equivalent).</li><li>
Three A-levels or five Highers (or equivalent).</li><li>
No work experience is needed as this is an entry-level position. We are looking for someone who will show potential for these roles through their transferable skills. Curiosity about cloud and security technology, confidence, relationship building, and a self-starter mentality are all welcome &mdash; alongside a huge eagerness to learn and build!</li></ul> 

Benefits 
Why join us?
Our vision is to create a safe, inclusive digital world where people and organisations can thrive. Our values of Do the Right Thing, One Team and Above and Beyond emphasises the importance of the part we play in society, and our commitment to our people and clients. Our story to-date has been phenomenal, but success doesn&rsquo;t end here and as we continue to grow and scale, we want to keep the same culture, passion and commitment to high quality that has enabled us to get this far. Bridewell will provide a great career opportunity with continual development as well as the following:
<ul><li>25 Days Holiday - Plus buy and sell options
</li><li>Flexible Working (around core office hours)
</li><li>Company Pension
</li><li>Employee Shareholder Scheme
</li><li>Personal Day &amp; Birthday Off - After 1 year of service
</li><li>Family Leave &ndash; After 1 year of service
</li><li>Life Assurance
</li><li>Electric Vehicle Scheme &amp; Cycle to Work Scheme</li><li>
Private Healthcare (incl. Gym discounts and vison care)</li></ul>
Location: Bridewell operates a hybrid and flexible working policy, however you will be required to travel to different sites on occasion, in particular our London office.
Note: To be eligible for this job you must either hold UK Security Clearance or be eligible and willing to go through this security clearance Bridewell values diversity and is an equal opportunity employer. We are dedicated to fostering an inclusive environment where all employees feel respected, supported, and empowered to do their best work. If you require any reasonable adjustments throughout the interview process please let us know.</div>

Academy Cloud Security Consultant

Humanoid

<div>Here at Humanoid, we believe in a future where robots amplify human potential. That&rsquo;s why we&rsquo;ve set out on a mission to build the world&rsquo;s most capable, commercially-scalable, and safe humanoid robots. We&rsquo;re bringing that mission to life with HMND‑01 Alpha - our rapidly developed humanoid platform now running in real industrial pilots - and we&rsquo;re growing the team to take it even further.<h1 class="jobSectionHeader">
About the Role</h1>
We are seeking a Principal Product Cybersecurity Assurance Engineer with deep expertise in product security, threat modelling, and risk assurance for highly regulated electromechanical systems. In this role, you will lead the delivery of product cybersecurity across Humanoid's HMND 01 platform family &mdash; the Alpha Wheeled industrial robot and the Alpha Bipedal home robot &mdash; both powered by our KinetIQ VLM/VLA-based AI framework. Working alongside product, firmware, autonomy, and hardware teams as part of the Systems Engineering and Architecture Team, you will define and maintain the cybersecurity assurance strategy for all product security activities from first concept through post-market deployment. Security at Humanoid is an engineering discipline inseparable from functional safety and central to our mission of creating the world's most reliable, commercially scalable, and safe humanoid robots. To excel in this position, you must demonstrate the authority to influence security architecture decisions across complex, cross-functional programmes, the rigour to build defensible security cases for novel cyber-physical systems, and the leadership to grow and guide a cross team of security engineers operating at the frontier of robotics.<h1 class="jobSectionHeader">
What You'll Do</h1><ul><li>
Team Leadership &amp; Product Security Delivery<ul><li>
Lead and develop a cross-functional team of security engineers, maintaining accountability for the delivery of product security services within product teams throughout the HMND 01 development lifecycle.</li><li>
Define product security requirements and advise development teams on suitable implementation standards, techniques, and toolchains for embedded and AI-enabled robotic systems.</li><li>
Partner with cross-functional teams to develop security protocols, tools, and processes that keep HMND 01 technologies ahead of emerging threats &mdash; including attack surfaces specific to the KinetIQ AI inference pipeline and cloud-to-robot communication architecture.</li><li>
Own and maintain key security artefacts for audit-ready cybersecurity documentation including Security Management Plans, Threat Analysis and Risk Assessment (TARA) reports, Risk Assessments, and Remediation Action Plans across both platforms.</li></ul>
Security Assurance &amp; Certification<ul><li>
Drive security assurance through the full product lifecycle, ensuring every HMND 01 design is robust, compliant, and resilient. Contribute to the continual improvement of security engineering capability across the organisation.</li><li>
Ensure compliance with cybersecurity obligations under the EU Machinery Regulation 2023/1230 where cyber controls intersect with safety-critical functions and compliance to IEC 62443 (for industrial/OT product security), and the EU Cyber Resilience Act.</li><li>
Provide independent Information Assurance (IA) reviews and risk assessments on complex, high-impact projects &mdash; with particular focus on cyber-physical systems where a digital compromise could result in physical harm to operators or end users.</li><li>
Review and provide guidance on security risk assessments, risk mitigation plans, mitigation gap analysis, and security management documentation in support of system cybersecurity certification.</li></ul>
Incident Response &amp; Lifecycle Security<ul><li>
Establish and maintain a Product Security Incident Response (PSIR) process, encompassing coordinated vulnerability disclosure, patch deployment pipelines, and post-field incident analysis.</li><li>
Define and oversee security monitoring requirements for deployed fleets, ensuring field data feeds back into risk files and security artefacts in line with post-market surveillance obligations.</li></ul>
Commercial &amp; Bid Support<ul><li>
Support the production of work package descriptions and cost estimates for product bids, services, and proposals that include product security scope.</li><li>
Represent Humanoid's security posture in customer and partner engagements, including regulatory consultations and certification body interactions.</li></ul></li></ul><h1 class="jobSectionHeader">
What We're Looking For</h1><ul><li>
Proven, hands-on experience with ISO 27001/27004/27005 and the NIST Risk Management Framework (RMF), applied to regulated hardware or embedded product programmes.</li><li>
Experience owning a security risk management system for highly regulated, safety-critical products &mdash; with background drawn from automotive, commercial vehicle, or industrial automation environments.</li><li>
Working knowledge of IEC 62443, with the ability to adapt ISO/SAE 21434 lifecycle methodologies to robotic or electromechanical product context.</li><li>
Solid understanding of engineering development lifecycles and how the product cybersecurity specialism aligns with systems engineering, functional safety, and hardware/software co-development.</li><li>
Ability to interpret Penetration Test reports and author Remediation Action Plans that address identified vulnerabilities in a structured, risk-prioritised manner.</li><li>
Clear, structured communication skills &mdash; able to articulate complex security risk arguments to both technical engineers and executive stakeholders with equal confidence.</li></ul>
Preferred:<ul><li>
Familiarity with Threat Analysis and Risk Assessment (TARA) or equivalent threat modelling methodologies (STRIDE, PASTA) applied to embedded or OT/IT convergent systems.</li><li>
Understanding of secure-by-design principles for AI/ML-enabled systems, including securing inference pipelines, model integrity, and cloud-to-edge communication paths.</li><li>
Exposure to CAN bus, Ethernet backbone, or wireless interface security in mobile, vehicular, or robotic systems.</li><li>
Experience contributing to or establishing a Product Security Incident Response (PSIRT) process or coordinated vulnerability disclosure programme.</li><li>
Knowledge of UL 4600, UL 3300, or ISO 13482 and an appreciation of how cybersecurity evidence integrates into safety case arguments.</li><li>
Prior engagement with certification bodies (TUV, UL, BSI) or standards development organisations (ISO TC 184, IEC TC 65, SAE, IEEE RAS).</li></ul><h1 class="jobSectionHeader">
What We Offer</h1><ul><li>
Competitive equity: stock options with meaningful upside as we scale.</li><li>
30+ days off, including 23 days annual leave, all UK bank holidays, and additional company closure days (including Christmas&ndash;New Year shutdown).</li><li>
Private healthcare, including virtual and in-person care.</li><li>
Pension scheme with 8% total contribution (5% employee, 3% employer) on full earnings.</li><li>
Free daily breakfast, catered lunch, and snacks in-office.</li><li>
Work at the frontier - collaborate daily with world-class engineers, researchers, and product experts building the next generation of AI and humanoid robotics.</li><li>
Real ownership - direct access to founding leadership, meaningful input on product direction, and the ability to drive key initiatives from day one.</li></ul></div>

Principal Product Cybersecurity Assurance

<div><h2 class="jobSectionHeader">Description</h2>
<div>
The Principal Microsoft Defender XDR, IRM &amp; Deception Engineer, working within the Global Information and Cyber Security Defence (ICSD) function, is the technical leader for enterprise cyber deception and unified detection and response across the Microsoft security ecosystem. The role focuses on building, operating, and continuously evolving an enterprise-grade Insider Risk Management (IRM) and deception programme - including honeypots, honeytokens, decoy users, decoy devices, deceptive credentials, and breadcrumbs - fully integrated with Microsoft Defender XDR (Defender for Endpoint, Defender for Identity, Defender for Office 365, and Defender for Cloud Apps), Microsoft Sentinel, and Microsoft Security Copilot.

The role exists to detect adversaries earlier in the kill chain by deceiving attackers into engaging with high-fidelity traps, while delivering unified detection, automated investigation, and response across endpoint, identity, email, and cloud workloads. It combines deep deception engineering expertise with hands-on Defender XDR mastery and the use of Agentic AI to drive proactive, intelligence-led, and largely autonomous security operations.

The Role:
<ul>
<li>Deception Engineering Leadership<ul>
<li>Own and lead the enterprise cyber deception programme end-to-end, including strategy, architecture, deployment, operations, and continuous improvement.</li>
<li>Design, deploy, and operate a layered deception fabric across on-premises, hybrid, and multi-cloud environments using honeypots, honeytokens, decoy accounts, decoy devices, deceptive files / shares, and breadcrumbs.</li>
<li>Act as the technical authority for deception engineering and Microsoft Defender XDR across the enterprise.</li>
</ul></li><li>Honeypots, Honeytokens, Decoys &amp; Breadcrumbs<ul>
<li>Design and operate the full deception asset lifecycle, ensuring high-fidelity, low-noise detections that are realistic, attacker-grade, and resilient to evasion.</li>
<li>Deploy and manage Microsoft Defender for Identity deceptive accounts, deceptive devices, and honeytoken accounts across Active Directory and Microsoft Entra ID.</li>
<li>Build and maintain a portfolio of deception assets, including:<ul>
<li>Honeypot systems (low-, medium-, and high-interaction) across on-prem, Azure, AWS, GCP, and OCI</li>
<li>Honeytoken credentials, API keys, OAuth tokens, secrets, and SaaS accounts</li>
</ul></li><li>Decoy users, decoy devices, decoy shares, decoy files, and decoy databases<ul>
<li>Plant attacker-grade breadcrumbs across endpoints, identities, and cloud workloads, including:</li>
<li>Saved credentials, browser cookies, RDP and SSH artefacts</li>
<li>LSASS-resident credentials and cached tokens on selected lures</li>
<li>Fake Kerberos service accounts and SPNs to bait Kerberoasting and AS-REP roasting</li>
</ul></li><li>Continuously evolve deception techniques, lure design, and trap placement aligned to current attacker TTPs, red-team findings, and breach intelligence.</li>
<li>Govern the deception programme with clear standards for asset realism, segmentation, monitoring, and safe operation (no production impact).</li>
<li>Validate deception coverage through red-team, purple-team, and breach-and-attack simulation (BAS) exercises.</li>
</ul></li><li>Microsoft Defender XDR Leadership<ul>
<li>Lead the design, implementation, and optimisation of Microsoft Defender XDR across endpoint, identity, email, and cloud-app workloads.</li>
<li>Integrate all deception signals (honeypot, honeytoken, decoy, breadcrumb) into Defender XDR and Microsoft Sentinel as first-class, high-fidelity detections.</li>
<li>Define and enforce a unified detection and response strategy across the Microsoft security stack.</li>
</ul></li><li>Defender for Identity &amp; Identity Deception<ul>
<li>Lead operation and optimisation of Microsoft Defender for Identity (MDI) to detect identity-based attacks, including:<ul>
<li>Credential theft, Kerberoasting, AS-REP roasting, Pass-the-Hash, and Pass-the-Ticket</li>
<li>Lateral movement, reconnaissance, and privilege escalation</li>
<li>Misuse of deceptive / honeytoken accounts as early-warning tripwires</li>
</ul></li><li>Integrate MDI, deception, and Microsoft Entra ID signals into Defender XDR, Microsoft Sentinel, and SOAR workflows for unified investigation and response.</li>
</ul>
</li><li>Data Protection, DLP &amp; Insider Risk Management
<ul>
<li>Lead the design and implementation of Microsoft Purview Data Loss Prevention (DLP) policies across endpoints, cloud apps, and collaboration platforms</li>
<li>Define and enforce data protection controls to prevent unauthorised data exfiltration and misuse</li>
<li>Leverage Microsoft Insider Risk Management (IRM) to detect risky user behaviour, including data leaks, policy violations, and insider threats</li>
<li>Correlate DLP, IRM, and identity signals with Microsoft Defender XDR to provide unified incident context</li>
<li>Collaborate with Risk, Compliance, and Legal teams to align DLP and insider risk controls with regulatory and business requirements</li>
<li>Continuously optimise detection use cases combining identity, data, and behavioural analytics</li>
</ul></li><li>Endpoint, Email &amp; Cloud App Detection<ul>
<li>Lead detection engineering across the Defender XDR stack, ensuring deception assets are continuously monitored alongside production telemetry:</li>
<li>Microsoft Defender for Endpoint (MDE) - EDR policies, ASR rules, and decoy-device monitoring</li>
<li>Microsoft Defender for Office 365 (MDO) - anti-phishing, Safe Links, Safe Attachments, and honeytoken inboxes</li>
<li>Optimise automatic attack disruption, automated investigation and response (AIR), and self-healing capabilities to:<ul>
<li>Disrupt in-progress attacks at machine speed, including deception-triggered intrusions</li>
<li>Reduce analyst workload through high-confidence automation</li>
<li>Improve coverage for ransomware, BEC, and identity-based attacks</li>
<li>Ensure consistent telemetry ingestion and detection parity across Windows, macOS, Linux, mobile, and deception assets.</li>
</ul></li></ul></li><li>Multi-Cloud Deception &amp; Detection (AWS, GCP, OCI)<ul>
<li>Extend the deception programme and Defender-style detection capabilities consistently across AWS, GCP, and OCI, including:</li>
<li>Cloud honeypots, decoy IAM roles, and honeytoken cloud credentials / API keys</li>
<li>Control-plane, workload, container, and Kubernetes threat detection</li>
<li>Cross-cloud identity and access misuse detection</li>
<li>Ensure consistent detection, deception, and response coverage across hybrid and multi-cloud environments.</li>
</ul></li><li>Automation, Agentic AI &amp; Continuous Improvement<ul>
<li>Drive automation of deception deployment, detection, investigation, and response workflows using Microsoft Sentinel SOAR, Logic Apps, and Microsoft Security Copilot.</li>
<li>Define KPIs and metrics covering deception engagement, detection coverage, and response maturity.</li>
<li>Continuously improve detection, hunting, and deception capabilities to align with emerging threats and adversary tradecraft.</li>
</ul></li><li>Stakeholder Engagement &amp; Technical Leadership<ul>
<li>Lead and grow a team of Defender XDR and Deception Engineers, setting technical direction, standards, and delivery priorities.</li>
<li>Partner with SOC, CTI, Identity, Cloud, and Engineering teams to embed deception and Defender XDR detection into all enterprise platforms.</li>
<li>Provide mentorship and leadership to deception engineers, detection engineers, threat hunters, and SOC analysts.</li>
<li>Communicate deception strategy, detection coverage, residual risk, and security improvements to senior stakeholders.</li></ul></li></ul> 


</div><h2 class="jobSectionHeader">Qualifications</h2>
<div>
What you'll bring:

Required Skills &amp; Experience:
<ul>
<li>Proven experience designing and operating enterprise cyber deception programmes (honeypots, honeytokens, decoy users, decoy devices, breadcrumbs) at scale.</li>
<li>Extensive hands-on experience operating and engineering Microsoft Defender XDR (MDE, MDI, MDO, MDA) in large enterprises.</li>
<li>Deep expertise across the Microsoft security stack, including:<ul>
<li>Microsoft Defender for Identity (MDI) deceptive accounts, deceptive devices, and honeytokens</li>
<li>Microsoft Sentinel (analytics rules, workbooks, hunting, SOAR)</li>
<li>Microsoft Security Copilot, automated investigation &amp; response, and attack disruption</li>
<li>Microsoft Defender for Cloud Apps and Defender for Cloud</li>
</ul></li><li>Hands-on experience with:<ul>
<li>Open-source and commercial deception / honeypot platforms (e.g., Thinkst Canary, T-Pot, Cowrie, OpenCanary, Zscaler Deception)</li>
<li>Advanced KQL for detection engineering and threat hunting at scale</li>
<li>Detection-as-code, CI/CD of detection content, and security content management</li>
</ul></li><li>Strong knowledge of adversary tradecraft and frameworks:<ul>
<li>MITRE ATT&amp;CK, MITRE Engage, MITRE D3FEND, and the cyber kill chain</li>
<li>Experience leveraging Agentic AI, Microsoft Security Copilot, or AI/ML in security operations (detection, hunting, IR, automation).</li>
</ul></li><li>Proven experience leading incident response across identity, endpoint, email, and cloud domains.</li>
<li>Strong scripting / automation experience (PowerShell, Python, or equivalent).</li>
<li>Deep understanding of Zero Trust architecture and identity-centric defence.</li></ul> 


Preferred Qualifications:
<ul>
<li>Experience contributing to red-team / purple-team exercises and breach-and-attack simulation (BAS) programmes.</li>
<li>Microsoft certifications:<ul>
<li>Microsoft Certified: Security Operations Analyst Associate (SC-200)</li>
<li>Microsoft Certified: Azure Security Engineer Associate (AZ-500)</li>
<li>Microsoft Certified: Cybersecurity Architect Expert (SC-100)</li>
<li>Industry certifications (CISSP, GCIA, GCFA, GCIH, OSCP, or equivalent)</li>
<li>Cloud certifications across AWS, GCP, or OCI</li></ul></li> 
</ul>
What we offer:

Enjoy a benefits package designed to help you thrive, both professionally and personally. You'll receive 25 days of annual leave plus an extra WTW day to relax and recharge. Our comprehensive health and wellbeing offering includes private healthcare, life insurance, group income protection, and regular health assessments, all giving you peace of mind. Secure your future with our defined contribution pension scheme, featuring matched contributions up to 10% from the company.

We support your growth and balance with hybrid working options, access to an employee assistance programme, and a fully paid volunteer day to make a difference in your community. On top of these, you can opt into a variety of additional perks including an electric vehicle car scheme, share scheme, cycle-to-work programme, dental and optical cover, critical illness protection, and much more. Start making the most of your career and wellbeing with a range of benefits tailored for you.

Equal Opportunity Employer

We&rsquo;re committed to equal employment opportunity and provide application, interview and workplace adjustments and accommodations to all applicants. If you foresee any barriers, from the application process through to joining WTW, please email candidatehelpdesk@wtwco.com</div></div>

Principal Microsoft Defender XDR & Deception Engineer

GSMA

<div>Department: Technology
Team: Security
Location: London with hybrid ways of working
Position type: Permanent
What the hiring manager says
This is a hands on engineering role at the heart of GSMA&rsquo;s TISAC platform transformation. You will be responsible for building, evolving, and maintaining the technical backbone that enables cyber threat intelligence sharing for the global telecoms ecosystem. We&rsquo;re looking for a T-ISAC Platform Software Engineer who thrives on solving complex architectural challenges, automating largescale systems, and bringing engineering excellence to a critical industry capability.
You&rsquo;ll work closely with CTI analysts, architecture teams, and platform vendors to deliver a secure, scalable, and resilient T‑ISAC service. If you are passionate about infrastructure, automation, API integrations, platform reliability, and delivering secure-by-design services to a global community, this role is your opportunity to help shape the future of telecom security.
If you thrive on working with cutting-edge intelligence platforms, enjoy mentoring others and want to help mature a global security community, this is an opportunity to truly influence the future of telecom security.
Agwu Nwoke, Industry Security Programme Director
About the Team
The GSMA Industry Security Team is the mobile industry&rsquo;s focal point for the mobile network security. The team is responsible for co-ordinating GSMA member security working groups, leading industry wide security initiatives and engaging with global regulators to ensure security is an enabler and not a barrier to next generation mobile services.
The team is responsible for a number of industry wide Cybersecurity schemes including:<ul><li>
Telecommunications Information Sharing and Analysis Center (T-ISAC).</li><li>
Mobile Co-ordinated Vulnerability Disclosure (CVD).</li><li>
Network Equipment Assurance Scheme (NESAS).</li></ul>
About the GSMA T-ISAC
The Telecommunication Information Sharing and Analysis Centre (T-ISAC) is the cybersecurity threat intelligence community for the telecommunication industry, dedicated to facilitating collaboration and intelligence sharing among mobile network operators, mobile virtual network operators and industry stakeholders. T-ISAC provides GSMA members with critical cyber threat intelligence, fostering a trusted environment where telecommunication stakeholders can proactively address cybersecurity threats and reduce risks through the development of best practices. By uniting telecommunication MNOs, MVNOs, manufacturers, service providers and industry in a shared mission, T-ISAC enhances the mobile ecosystem&rsquo;s resilience against cyber threats. For more information, visit www.gsma.com/T-ISAC.
About the Role
As the Platform Software Engineer for T‑ISAC, you will be responsible for the engineering, operation and continuous improvement of the platforms, tooling and integrations that power the T‑ISAC service.
Key Responsibilities
Platform Engineering &amp; Development
Design, develop and maintain the T-ISAC platform, delivering secure, scalable data workflows, automation capabilities and collaboration tools that support threat intelligence sharing and enrichment.
Service Reliability &amp; Operations
Lead the operational reliability of the T-ISAC platform through proactive monitoring, incident management, performance optimisation and secure-by-design engineering practices.
Integration &amp; Interoperability
Deliver and support integrations, APIs and data exchange capabilities that enable secure, scalable intelligence sharing across members and third-party security platforms.
Platform Roadmap &amp; Technical Strategy
Shape the evolution of the T-ISAC platform by defining future-state architecture, driving technical improvements and evaluating emerging technologies.
Security &amp; Compliance
Maintain a secure and compliant platform through secure engineering practices, automated controls, vulnerability management and adherence to regulatory and governance standards.
Collaboration &amp; Community
Foster collaboration across members, analysts, security teams and industry partners to improve platform adoption, effectiveness and community engagement.
About You
You will bring enthusiasm and ownership to this specialised senior role in cyber threat intelligence analysis, joining a dynamic and ambitious team. Your drive will be key to transforming bold ideas into impactful programmes and seeing them through to successful delivery.
You will have telecoms experience gained from working at an operator, with an operator or within the wider telecom industry.
You will have proven knowledge and expertise in designing, building and operating the core platforms and infrastructure that enable scalable, reliable, secure and efficient software delivery across operations in Intelligence, Cybersecurity, Data Analytics or a related field (equivalent experience will be considered). You will also have experience working with ISACs or other information sharing organisations.
About Your skills
In addition to technical skills, you will have :
Teamwork &ndash; you will be comfortable when working collaboratively in a virtual, distributed team environment.
Communication &ndash; you will have exceptional verbal and written communication skills, with a track record of presenting to executive audiences.
Leadership &ndash; you will have proven leadership and mentoring skills, ideally within an intelligence team.
Analysis &ndash; you will have strong analytical, critical thinking and problem solving skills, with ability to analyse cybersec intelligence.
Essential<ul><li>
Extensive experience of building and implementing intelligence platforms e.g. OpenCTI, MISP.</li><li>
Experience of using collaborative open source tools as part of your analysis and research processes.</li><li>
Understanding of Nation-State Actors, Cyber Crime, Hacktivism and advanced threat actor tactics, techniques and procedures (TTPs).</li><li>
Experience in cybersecurity intelligence, including collection, analysis and dissemination.</li><li>
Professional experience within the telecom industry, whether gained at an operator, in partnership with an operator, or through work in telecom related organisations, vendors, academia or the wider mobile ecosystem.</li></ul>
Preferable<ul><li>
Understanding of mobile data, protocols and technology such as, but not limited to SS7, MOTIF, HRN, IRSF, URLs, GTs.</li><li>
Knowledge of mobile network architectures and services.</li><li>
Understanding of mobile network and services, threat landscape and the common attacks to which they are exposed.</li><li>
Comprehensive understanding of telecommunication industry operations and challenges.</li><li>
Expertise in using and applying the Mitre ATT&amp;CK&reg; framework, MISP, OpenCTI, Meta, EclecticIQ, Governments, Law Enforcement and other COIs (national and international) for threat analysis and strategy development.</li></ul>
We strive to offer a meaningful and inclusive application experience for all candidates. Should you require any accommodations or adjustments due to a disability or for any other reason during the hiring process, please contact talent@gsma.com with your request.
Contract type
Regular
Worker type
Employee<h2 class="jobSectionHeader">
What We Offer</h2>
Working at the GSMA offers you unparalleled access to the mobile industry. We offer a chance to truly shape the direction of mobile, whatever your role. By joining the GSMA, you will be exposed to a fast-paced rapidly evolving environment, working on global solutions, genuinely fascinating and industry-changing projects and a stimulating and dynamic environment designed to enable you to flourish.
In addition to architect-designed offices and competitive compensation, our benefits include fantastic learning &amp; development opportunities, generous holiday allowances, four additional days off for professional development and many others.
To learn more about the GSMA, visit our career site, our LinkedIn page and our Twitter page.
Being You at the GSMA
We care deeply about diversity, equity and inclusivity and aspire to be the best at it. Your well-being and work/life balance is important, so flexi-time and remote working is available to all staff. We're keen to ensure everyone is equal, represented and connected so we particularly encourage applications from all demographics. The sucess of the GSMA year on year will continue to be contributed by people from all walks of life.
GSMA Values
Our values not only drive our culture &ndash; they shape how we work and interact inside and outside our global organisation.
Passionately driven
We approach everything we do with unparalleled capability, tenacity and commitment, knowing that the challenging scale, pace and complexity of our work is what leads to its world-changing impact.
Insightful leaders
We continually develop and engage our expertise, insight and creativity so that we&rsquo;re always ready to respond to the changing landscape with authority, agility and nuance.
Stronger together
We lean on each other so the industry can lean on us, embracing our diversity by actively seeking out perspectives and skill sets beyond our own, fuelling each other&rsquo;s successes and constantly asking how we can help.
Underpinning our values is our collective mindset to show up purposefully as good human beings every day, in every situation. When we&rsquo;re at our best &ndash; we are collaborative, considerate and compassionate to others, and we create a safe space for one another to thrive, assuming positive intent in our colleagues. And if we aren&rsquo;t at our best and the pressure is on &ndash; we feel free to be ourselves but still remain curious, lean into the tough stuff and we are always respectful to others and accountable for the part we play.</div>

T-ISAC Platform Software Engineer

Explore 268+ Cyber security engineer in London this July. Find roles across top companies and apply now to boost your career.