Microsoft Cloud Security Architect Lead
Description We are seeking a visionary Lead Microsoft Cloud Security Architect to join WTW’s Global Information and Cyber Security Defence (ICSD) function. This role is pivotal in designing and implementing next-generation cloud security architectures, securing WTW cloud environments, and driving automation and innovation with WTW’s ICS Function. The candidate will work closely with the CISO, other ICS leads as well as Cyber Defence to ensure a holistic architectural approach to WTW’s technology estate. The ideal candidate will have deep expertise in Microsoft Azure, Palo Alto, AWS and Oracle technology with detailed knowledge of Microsoft security tools and the Software Development life Cycle. Key Responsibilities
- Microsoft Cloud Security Architecture & Strategy
- Design and implement Microsoft Cloud Security Architectures for Azure, Microsoft, AWS, OCI and hybrid cloud environments.
- Ensure the Defender ecosystem is optimised for advanced threat detection and response.
- Develop enterprise-wide security frameworks and standards to align with industry best practices (NIST, ISO 27001, CIS, GDPR, etc.).
- Assess and improve cloud security postures using CSPM and CWPP tools.
- Maintain a list of all ICS Technologies and vendors
- Programme Integration
- Act as the lead architect across several complex enterprise-wide projects spanning multiple technologies to ensure a risk based architectural approach is adopted, gaps are highlighted, risks are known, and architecture solutions are fit for purpose
- Agentic AI for Security & Sentinel Advanced Capabilities
- Lead the adoption and integration of Agentic AI for Security to enable autonomous threat detection, adaptive response, and continuous security posture improvement.
- Architect and optimise Microsoft Sentinel for SIEM, UEBA, and threat intelligence integration, leveraging Microsoft Sentinel Model Context Protocol (MCP) for advanced context-aware analytics and automation.
- Develop and maintain security analytics and data pipelines within Sentinel Data Lake to support large-scale threat detection, incident response, and threat hunting, while optimizing cost and enabling Agentic AI-driven security operations.
- Integrate and automate security workflows using Microsoft Sentinel Graph for unified threat intelligence, incident correlation, and automated response.
- Defender XDR & Wiz Cloud
- Design and help optimise Microsoft Defender XDR (Defender for Endpoint, Defender for Identity, Defender for Cloud Apps, Defender for Office 365) for holistic security coverage.
- Advise on the design and rollout of Wiz Defend, Wiz Runtime Sensor, Wiz Code, Defender solutions, Sentinel Data Lake, and SOAR automation to enhance threat detection and response.
- Security Automation
- Develop security automation workflows using Microsoft Sentinel playbooks, Logic Apps, and Power Automate.
- Document security architectures, integrations, and automation processes in runbooks, SOPs, and technical guidelines.
- Establish security governance frameworks to ensure compliance and risk management alignment.
- Collaboration & Continuous Improvement
- Work closely with all ICS Teams and senior leadership to align cloud security strategies with business needs.
- Stay up to date with emerging threats, Microsoft security innovations, and industry trends to drive continuous security enhancements.
- Provide training and mentorship to SOC teams on Microsoft cloud security best practices.
- Team Management
- Manage and mentor a team of Security Engineers.
- Act as an escalation point for complex security issues.
- Agentic AI for Security: Leading the adoption and integration of agentic AI to enable autonomous threat detection, adaptive response, and continuous security posture improvement.
- Sentinel Data Lake: Leveraging Sentinel Data Lake not only for advanced analytics and threat detection, but also to optimize cost and drive the capabilities of Agentic AI for Security.
- Microsoft Sentinel Model Context Protocol (MCP): Utilising MCP for advanced context-aware analytics, automation, and to enhance the effectiveness of AI-driven security operations.
- Microsoft Sentinel Graph: Integrating and automating security workflows using Sentinel Graph for unified threat intelligence, incident correlation, and automated response.
- Deep expertise in architecting, deploying, and managing Microsoft Sentinel, with a strong focus on Agentic AI for Security, Sentinel Data Lake Skills (including cost optimization and AI enablement), Microsoft Sentinel Model Context Protocol (MCP), and Microsoft Sentinel Graph.
- Strong hands-on experience with Wiz Defend, Wiz Runtime Sensor, Wiz Code and cloud security posture management (CSPM) and workload protection (CWP).
- Experience integrating and automating security workflows using Microsoft Sentinel Graph and Microsoft Graph Security API.
- Proficiency in Microsoft Sentinel SIEM for threat detection, incident response, and threat hunting.
- Experience designing SOAR workflows for automated security response and incident triage.
- Expertise in KQL queries, custom detection rules, and UEBA use cases.
- Strong understanding of Entra ID Security, Conditional Access, Identity Protection, and Privileged Access Management (PIM).
- Experience with Just-in-Time (JIT) access, Zero Trust identity models, and identity compromise detection.
- Hands-on experience securing email environments using Microsoft Defender for Office 365 (MDO) and Darktrace Email AI-driven security.
- Expertise in anti-phishing, Safe Links/Safe Attachments, attack simulation, and email threat intelligence.
- Experience automating security tasks using Microsoft Sentinel playbooks, Logic Apps, Power Automate, and KQL-based automation.
- Ability to write clear and detailed documentation for security architecture, processes, and incident response procedures.
- Excellent communication and stakeholder management skill
- Experience with working with global Cyber Defence/SOC teams
- Knowledge of MITRE ATT&CK framework and its application in threat detection and response.
- Understanding of compliance standards (ISO 27001, NIST CSF, GDPR, SOC 2).
- Familiarity with third-party integrations (e.g., Threat Intelligence Platforms, SOAR tools, Security APIs).
- Microsoft Certified: Cybersecurity Architect Expert (SC-100)
- Microsoft Certified: Azure Security Engineer Associate (AZ-500)
- Microsoft Certified: Security Operations Analyst Associate (SC-200)
- Microsoft Certified: Identity and Access Administrator Associate (SC-300)
- Certified Information Systems Security Professional (CISSP)
- Certified Cloud Security Professional (CCSP)