<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
  <channel>
    <title>Threat-Led Detection Engineer - WTW RSS Feed</title>
    <link>https://jobs.co.uk/job/threat-led-detection-engineer-wtw--b9b642e4-72c9-47f1-9135-7c4300e71639</link>
    <description>RSS feed for Threat-Led Detection Engineer at WTW.</description>
    <language>en-gb</language>
    <lastBuildDate>Sun, 28 Jun 2026 16:21:35 GMT</lastBuildDate>
    <item>
      <title>Threat-Led Detection Engineer - WTW</title>
      <link>https://jobs.co.uk/job/threat-led-detection-engineer-wtw--b9b642e4-72c9-47f1-9135-7c4300e71639</link>
      <guid>https://jobs.co.uk/job/threat-led-detection-engineer-wtw--b9b642e4-72c9-47f1-9135-7c4300e71639</guid>
      <pubDate>Sun, 28 Jun 2026 11:51:19 GMT</pubDate>
      <description>Location: London | Salary: 10000-500000 Annual | Type: Permanent | The Threat-Led Detection Engineer will design, build, and maintain high-quality threat detections within WTW''s Global Information and Cyber Security Defence (ICSD) function, helping WTW detect adversary activity quickly and accurately across its global estate. This is a hands-on engineering role for someone with a strong cyber security mindset and a genuine interest in how attackers operate. You will write and tune detection rules, map coverage to real adversary behaviour, and contribute to a well-maintained, version-controlled detection library. Working closely with SOC, Threat Hunting, Cyber Threat Intelligence (CTI), and Incident Response, you will turn intelligence and hunt findings into reliable detections, embracing a threat-led, Detection-as-Code approach. The individual will work as part of a global, multi-disciplined security community with strong support across the business, helping to foster a security-aware culture while ensuring WTW remains a great place to work. With WTW''s large global footprint, this role offers a varied and stimulating range of work, and occasional global travel may be required. The role is based in London and follows a hybrid working model, with ...</description>
      <category>Permanent</category>
    </item>
  </channel>
</rss>