Microsoft Security Architect

Microsoft Security Architect

Microsoft Security Architecture | Managed Detection and Response (MDR) | Privacy and Compliance | Risk Management

Experience: 6+ Years

Employment Type: Full-Time, Permanent (Santan Infotech Pvt Ltd)

Location: Chennai, Tamil Nadu, India

Reports To: Head of MDR Practice, Santan Intellect

Domain

Microsoft Security Architecture | Managed Detection and Response (MDR) | Privacy and Compliance | Risk Management

Job Description

This position is responsible for architecting, designing, implementing, operationalizing and supporting Microsoft security, privacy, regulatory compliance and risk management solutions for client organizations as part of Santan Intellect's Managed Detection and Response (MDR) practice. Its central focus is leading the assessment, design and transformation of Microsoft-centric MDR services, from the first review of the current security environment through to a stable, operating capability.

This position works closely with client security leadership, SOC operations teams and technology stakeholders to evaluate the current security environment, define the future-state MDR architecture and guide implementation and operationalization. The goal is a scalable, enterprise-grade MDR capability built on Microsoft Sentinel and Microsoft Defender XDR, delivered through Microsoft's unified security operations platform in the Defender portal and integrated with existing security investments wherever they continue to add value.

The value this position creates is a Microsoft-centric MDR capability that detects and responds faster, with security and privacy controls mapped to the regulatory obligations each client answers to. It is designed so that the client's own SOC teams can sustain it after the engagement. This position also contributes reusable reference architectures, solution designs and delivery standards that make every later MDR engagement at Santan Intellect faster and more consistent.

Key Responsibilities

Security Assessment & Gap Analysis

• Assess the current state of security operations, monitoring capabilities, technology landscape and operational processes across the client environment.
• Review existing SIEM, SOAR, endpoint security, threat intelligence, identity, cloud security and incident response capabilities to determine what to retain, integrate or replace.
• Identify the architectural, operational, process and technology gaps that limit MDR effectiveness, and document them with prioritized recommendations.
• Facilitate discovery workshops with security leadership, SOC operations teams and technology stakeholders to validate findings and agree priorities.

MDR Operating Model & Transformation Strategy

• Define the target-state MDR operating model, service framework and transformation roadmap, including phasing, dependencies and measures of success.
• Define MDR use cases, detection strategies, incident response workflows, automation opportunities and SOC operating procedures.
• Establish the governance framework and service catalog artifacts that describe how the MDR service is delivered, measured and improved.
• Lead the transformation from the current operating model to the target-state MDR service, keeping client leadership aligned on scope, risk and progress.

Microsoft Security Architecture & Solution Design

• Design the Microsoft-centric MDR solution using Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Cloud, Microsoft Security Copilot and related Microsoft security services.
• Develop current-state and future-state security architecture diagrams, reference architectures, solution design documents, implementation blueprints and deployment standards.
• Develop the integration architecture for third-party security tools, threat intelligence platforms, ticketing systems and security data sources, with data flow diagrams for each integration.
• Design for scale and multi-tenant delivery using Microsoft Defender multitenant management, GDAP and Azure Lighthouse where the service spans several client environments.
• Define how Microsoft Security Copilot and agentic AI capabilities are introduced into triage, investigation and response workflows, including the identity, data protection and governance controls that apply to AI agents.

Privacy, Regulatory Compliance & Risk Management

• Architect Microsoft Purview solutions for information protection, data loss prevention, insider risk management, data security posture management, eDiscovery, audit and data lifecycle management, aligned to each client's data classification and retention requirements.
• Design privacy controls with Microsoft Purview and Microsoft Priva Privacy Risk Management so that privacy risks in the data estate are identified, prioritized and remediated.
• Map security and privacy controls to the regulatory and industry frameworks each client answers to, such as the NIST Cybersecurity Framework (CSF) 2.0, ISO/IEC 27001, SOC 2, HIPAA, GDPR and India's Digital Personal Data Protection Act.
• Track compliance posture and report remediation gaps using Microsoft Purview Compliance Manager and the regulatory compliance dashboard in Microsoft Defender for Cloud.
• Conduct security and privacy risk assessments, maintain risk registers and recommend risk treatment aligned to each client's risk appetite.
• Design identity governance and access controls with Microsoft Entra ID, Entra ID Governance and Conditional Access that support Zero Trust, least privilege and audit readiness.

Implementation, Tuning & Operationalization

• Develop the implementation and migration plan that sequences data source onboarding, tooling migration and the cutover of monitoring responsibilities.
• Provide guidance and oversight during implementation and onboarding activities, ensuring delivery follows the approved design and deployment standards.
• Support tuning, optimization and validation of detection and response capabilities, using detection engineering, threat hunting and incident response outcomes as feedback.
• Develop operational documentation, runbooks, standard operating procedures and playbooks that allow the SOC to run the service consistently.

Knowledge Transfer, Mentoring & Stakeholder Leadership

• Conduct knowledge transfer sessions and hands-on training workshops for SOC analysts, engineers, architects and service delivery teams.
• Mentor client and Santan Intellect resources so the MDR capability remains sustainable over the long term.
• Present the final executive summary and recommendations to client leadership, covering outcomes achieved, residual risks and next steps.
• Contribute reusable reference architectures, solution designs and delivery standards to Santan Intellect's MDR practice so each new engagement starts from proven patterns.

Expected Deliverables

This position is accountable for the deliverables below on each MDR transformation engagement. Each deliverable is defined by the value it creates, so quality can be judged against outcomes rather than page counts.

Deliverable

Value Created

Current-State Assessment Report

A factual baseline of security operations, tooling and processes that every later decision builds on

Gap Analysis and Recommendations

A prioritized view of the architectural, operational, process and technology gaps that limit MDR effectiveness

MDR Transformation Strategy and Roadmap

A phased plan that connects the target state to priorities, dependencies and expected outcomes

Target-State Security Architecture

A Microsoft-centric architecture that stakeholders can agree on before design and build begin

MDR Reference Architecture and Solution Design

Reusable designs and deployment standards that make delivery consistent across engagements

Integration Architecture and Data Flow Diagrams

Clear data paths between Microsoft services, third-party tools, threat intelligence sources and ticketing systems, with no log source or workflow left undefined

Use Case and Detection Engineering Framework

A structured way to build, test and tune detections against the threats that matter most to each client

SOC Operating Model and Governance Framework

Defined roles, processes, service levels and decision rights that keep MDR operations accountable

Implementation and Migration Plan

A controlled path from existing tooling to the target platform that protects monitoring coverage during cutover

Runbooks, Standard Operating Procedures (SOPs) and Playbooks

Consistent, documented response that does not depend on any single analyst's knowledge

Knowledge Transfer and Training Materials

SOC teams that can run, tune and improve the capability on their own

Final Executive Summary and Recommendations

Leadership-ready outcomes, risks and next steps that support funding and sponsorship decisions

Required Experience

• 6+ years of experience in cyber security architecture, SOC, MDR or security operations.
• Proven experience designing and implementing enterprise MDR or SOC transformation programs.
• Deep expertise in Microsoft security technologies, including Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Cloud, Microsoft Entra ID, Microsoft Security Copilot, Microsoft Purview and Microsoft Priva.
• Strong understanding of SIEM, SOAR, UEBA, threat intelligence, detection engineering, threat hunting and incident response.
• Working knowledge of privacy, regulatory compliance and risk management practice, including mapping security controls to frameworks such as NIST CSF 2.0, ISO/IEC 27001, HIPAA and GDPR.
• Experience integrating Microsoft security solutions with third-party technologies.
• Strong architecture, documentation, stakeholder management and workshop facilitation skills.
• Experience in MSSP, MDR service development or enterprise SOC transformation initiatives is highly preferred.

Required Technical Expertise

Category

Technologies

Security Architecture & MDR Design

Current-state and target-state architecture, MDR reference architecture and solution design, SOC operating model and governance, Zero Trust, multi-tenant MDR delivery with Microsoft Defender multitenant management, GDAP and Azure Lighthouse

Microsoft Sentinel & Defender XDR

Microsoft Sentinel and its data lake, Microsoft Defender XDR, the unified security operations platform in the Defender portal, KQL, analytics rules, automation rules and playbooks

Endpoint, Identity & Cloud Security

Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Microsoft Entra ID, Entra ID Governance, Conditional Access

Privacy, Compliance & Risk

Microsoft Purview (Compliance Manager, Information Protection, Data Loss Prevention, Insider Risk Management, Data Security Posture Management, eDiscovery, Audit), Microsoft Priva Privacy Risk Management, NIST CSF 2.0, ISO/IEC 27001, SOC 2, HIPAA, GDPR, India's DPDP Act

Detection, Threat Intelligence & Agentic AI

SIEM, SOAR, UEBA, detection engineering, threat hunting, incident response, threat intelligence in the Microsoft Defender portal, MITRE ATT&CK, Microsoft Security Copilot agents

Integration & Automation

REST APIs, Microsoft Graph API, Azure Logic Apps, integration of third-party SIEM, SOAR, EDR, ticketing and threat intelligence platforms, data flow design

Familiarity with additional ecosystem tools (for example, Microsoft Agent 365, Microsoft Entra Agent ID or non-Microsoft SIEM and SOAR platforms) is a plus, not a requirement. Training is provided on Santan Intellect's specific configuration and toolset.

Preferred Certifications

• Microsoft Certified: Cybersecurity Architect Expert (SC-100) is strongly preferred. Related Microsoft credentials, including Security Operations Analyst Associate (SC-200), Identity and Access Administrator Associate (SC-300), Information Security Administrator Associate (SC-401) and Cloud and AI Security Engineer Associate (SC-500), are also valued.
• A recognized security architecture or governance certification such as CISSP, CISM, CRISC, SABSA or TOGAF is an advantage.
• A privacy, audit or compliance credential such as ISO/IEC 27001 Lead Implementer or Lead Auditor, CISA or an IAPP certification (CIPM, CIPP/E or CIPT) is also an advantage.
• An equivalent security architecture, SOC or compliance certification is also acceptable in place of the certifications above.

Education

• Bachelor's or master's degree in cyber security, information security, computer science or information technology.
• A cyber security-focused degree combined with strong practical security architecture and MDR delivery experience is preferred.

Soft Skills

• Strong stakeholder management and executive communication, including the ability to present complex architectural trade-offs to senior leadership.
• Excellent workshop facilitation, documentation and written communication skills.
• Ability to mentor and coach SOC analysts, engineers and architects, and to transfer knowledge effectively.
• Structured, analytical problem-solving and sound judgment in balancing security, privacy, compliance and business priorities.
• Ability to influence decisions without direct authority while collaborating across SOC, engineering, privacy, compliance and delivery teams.