Head of Microsoft Security Platforms and SOC Operations

Willis Towers Watson

We are seeking passionate people to grow the Cyber Security team within WTW and provide an excellent service and trusted expertise to all parts of our business. As part of a business wide transformation, we have an exciting opening for a new role of Head of Microsoft Security Platforms and SOC Operations.

As part of the Cyber Defence and Security Operations department, you will manage the Microsoft security stack, from Sentinel to Defender for “X” and will manage the technical SOC Operations Team.

You will need to have a good technical aptitude, excellent communicative skills to technical and non-technical audiences, and a solid business acumen to deal with other senior stakeholders across the business.

This role would suit those with an extensive history in Sentinel SIEM management, configuration, log ingestion and with extensive experience of managing the Microsoft security stack with a focus on Defender for “X”

As the Head of Microsoft Security Platforms and SOC Operations, your primary responsibilities will be:

• Ensure log ingestion, optimisation and automation is utilised within Sentinel, with man management of a global team of engineers.
• Be the architect and SME for Microsoft Defender for “X” with remit to design, deploy and configure these solutions across WTW, both in the cloud, on premisses and across endpoints.
• Be accountable for the configuration, policy and change management of the Defender security stack and Sentinel.
• Creation and management of a new global Microsoft Security Engineering Team, who will run the Defender ecosystem.
• Vendor management with Microsoft to ensure future roadmap, changes and enhancements are understood and adopted in a reliable manner
• Integrate with managed detection and response partners to ensure holistic coverage of the WTW estate is in place
• Act as the Microsoft SME during minor and major incident response investigations

Secondary Responsibilities

• Transformation / Simplification project liaison to ensure agreed Defender relevant ICS transformation changes are understood and ICS prerequisites are factored into the project
• Review new and emerging technologies proposed for deployment to ensure ICS requirements can be met, value for money is obtained and cost / technology duplication is avoided
• Other relevant tasks as designated by the Director of Cyber Defence

What you will need:

• It is essential that you have in-depth experience managing Sentinel AND defender in a global enterprise organisation.
• Relevant Microsoft qualifications for Sentinel, Defender, Azure and general cyber security
• A solid understanding of cyber risk and how cyber-attacks are conducted across endpoints, cloud and on-premise networks
• Experience securing Office 365, mail filtering (EOP), web filtering (WCF/SmartScreen) and similar protections

Beneficial:

• Experience within a SOC, either within an MSSP function or an internal enterprise level SOC
• Experience across multiple area of technology such as Privileged Access Management, XDR, DLP, NDR, Azure, Active Directory, Email Filtering and Web Filtering ideally in a engineering capacity
• A history of either conducting risk assessments and audits, or working in an environment where this is a mandatory function
• Great verbal and written communication skills, and the ability to write reports, processes and procedures in a structured manner
• Previous exposure to a variety of compliance and regulatory requirements such as FCA, PCI, ISO27001, GDPR and other global regulations
• Experience running a global team sitting in different time zones

At WTW, we believe difference makes us stronger. We want our workforce to reflect the different and varied markets we operate in and to build a culture of inclusivity that makes colleagues feel welcome, valued and empowered to bring their whole selves to work every day. We are an equal opportunity employer committed to fostering an inclusive work environment throughout our organisation. We embrace all types of diversity.