Microsoft Security Architect

Santan Intellect LLC; Chennai; On-site; INR 4,000,000 - 7,000,000; Full time

Job summary

Santan Intellect is seeking a Microsoft Security Architect to lead the design, implementation and operation of Microsoft-centric MDR capabilities. You will collaborate with client security leaders and SOC teams to shape the target MDR architecture, define governance, and drive multi-tenant deployment across environments.

Responsibilities include developing reference architectures, integration designs, privacy controls and incident response playbooks while mentoring client and Santan resources

Qualifications

• 6+ years of experience in cyber security architecture, SOC, MDR or security operations.
• Proven experience designing and implementing enterprise MDR or SOC transformation programs.
• Deep expertise in Microsoft security technologies (Sentinel, Defender XDR, Defender for Cloud, etc.).
• Strong knowledge of SIEM, SOAR, UEBA, threat intelligence and incident response.
• Experience mapping controls to frameworks such as NIST CSF 2.0, ISO/IEC 27001, HIPAA, GDPR.

Responsibilities

• Architect, design, implement and Operate Microsoft-centric MDR services for clients.
• Lead assessment, design and transformation from current security to future-state MDR architecture.
• Define target-state MDR operating model, use cases, workflows and governance.
• Develop reference architectures, deployment standards and integration with third‑party tools.
• Plan multi‑tenant delivery using Defender multitenant, GDAP and Azure Lighthouse.
• Incorporate Microsoft Copilot and AI capabilities into triage, investigation and response workflows.
• Design privacy controls with Microsoft Purview and Priva; map to regulatory frameworks.
• Produce runbooks, SOPs and playbooks; mentor SOC and delivery teams.

Tools

Microsoft Sentinel

Microsoft Defender XDR

Defender for Endpoint

Defender for Identity

Defender for Cloud

Microsoft Entra ID

Microsoft Security Copilot

Microsoft Purview

Microsoft Priva

Job description

Microsoft Security Architect

Microsoft Security Architecture | Managed Detection and Response (MDR) | Privacy and Compliance | Risk Management

Experience: 6+ Years

Employment Type: Full-Time, Permanent (Santan Infotech Pvt Ltd)

Location: Chennai, Tamil Nadu, India

Reports To: Head of MDR Practice, Santan Intellect

Microsoft Security Architecture | Managed Detection and Response (MDR) | Privacy and Compliance | Risk Management

Job Description

This position is responsible for architecting, designing, implementing, operationalizing and supporting Microsoft security, privacy, regulatory compliance and risk management solutions for client organizations as part of Santan Intellect's Managed Detection and Response (MDR) practice. Its central focus is leading the assessment, design and transformation of Microsoft-centric MDR services, from the first review of the current security environment through to a stable, operating capability.

This position works closely with client security leadership, SOC operations teams and technology stakeholders to evaluate the current security environment, define the future-state MDR architecture and guide implementation and operationalization. The goal is a scalable, enterprise-grade MDR capability built on Microsoft Sentinel and Microsoft Defender XDR, delivered through Microsoft's unified security operations platform in the Defender portal and integrated with existing security investments wherever they continue to add value.

The value this position creates is a Microsoft-centric MDR capability that detects and responds faster, with security and privacy controls mapped to the regulatory obligations each client answers to. It is designed so that the client's own SOC teams can sustain it after the engagement. This position also contributes reusable reference architectures, solution designs and delivery standards that make every later MDR engagement at Santan Intellect faster and more consistent.

Key Responsibilities

Security Assessment & Gap Analysis

• Assess the current state of security operations, monitoring capabilities, technology landscape and operational processes across the client environment.
• Review existing SIEM, SOAR, endpoint security, threat intelligence, identity, cloud security and incident response capabilities to determine what to retain, integrate or replace.
• Identify the architectural, operational, process and technology gaps that limit MDR effectiveness, and document them with prioritized recommendations.
• Facilitate discovery workshops with security leadership, SOC operations teams and technology stakeholders to validate findings and agree priorities.

MDR Operating Model & Transformation Strategy

• Define the target-state MDR operating model, service framework and transformation roadmap, including phasing, dependencies and measures of success.
• Define MDR use cases, detection strategies, incident response workflows, automation opportunities and SOC operating procedures.
• Establish the governance framework and service catalog artifacts that describe how the MDR service is delivered, measured and improved.
• Lead the transformation from the current operating model to the target-state MDR service, keeping client leadership aligned on scope, risk and progress.

Microsoft Security Architecture & Solution Design

• Design the Microsoft-centric MDR solution using Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Cloud, Microsoft Security Copilot and related Microsoft security services.
• Develop current-state and future-state security architecture diagrams, reference architectures, solution design documents, implementation blueprints and deployment standards.
• Develop the integration architecture for third‑party security tools, threat intelligence platforms, ticketing systems and security data sources, with data flow diagrams for each integration.
• Design for scale and multi‑tenant delivery using Microsoft Defender multitenant management, GDAP and Azure Lighthouse where the service spans several client environments.
• Define how Microsoft Security Copilot and agentic AI capabilities are introduced into triage, investigation and response workflows, including the identity, data protection and governance controls that apply to AI agents.

Privacy, Regulatory Compliance & Risk Management

• Architect Microsoft Purview solutions for information protection, data loss prevention, insider risk management, data security posture management, eDiscovery, audit and data lifecycle management, aligned to each client's data classification and retention requirements.
• Design privacy controls with Microsoft Purview and Microsoft Priva Privacy Risk Management so that privacy risks in the data estate are identified, prioritized and remediated.
• Map security and privacy controls to the regulatory and industry frameworks each client answers to, such as the NIST Cybersecurity Framework (CSF) 2.0, ISO/IEC 27001, SOC 2, HIPAA, GDPR and India's Digital Personal Data Protection Act.
• Track compliance posture and report remediation gaps using Microsoft Purview Compliance Manager and the regulatory compliance dashboard in Microsoft Defender for Cloud.
• Conduct security and privacy risk assessments, maintain risk registers and recommend risk treatment aligned to each client's risk appetite.
• Design identity governance and access controls with Microsoft Entra ID, Entra ID Governance and Conditional Access that support Zero Trust, least privilege and audit readiness.

Implementation, Tuning & Operationalization

• Develop the implementation and migration plan that sequences data source onboarding, tooling migration and the cutover of monitoring responsibilities.
• Provide guidance and oversight during implementation and onboarding activities, ensuring delivery follows the approved design and deployment standards.
• Support tuning, optimization and validation of detection and response capabilities, using detection engineering, threat hunting and incident response outcomes as feedback.
• Develop operational documentation, runbooks, standard operating procedures and playbooks that allow the SOC to run the service consistently.

Knowledge Transfer, Mentoring & Stakeholder Leadership

• Conduct knowledge transfer sessions and hands‑on training workshops for SOC analysts, engineers, architects and service delivery teams.
• Mentor client and Santan Intellect resources so the MDR capability remains sustainable over the long term.
• Present the final executive summary and recommendations to client leadership, covering outcomes achieved, residual risks and next steps.
• Contribute reusable reference architectures, solution designs and delivery standards to Santan Intellect's MDR practice so each new engagement starts from proven patterns.

Expected Deliverables

This position is accountable for the deliverables below on each MDR transformation engagement. Each deliverable is defined by the value it creates, so quality can be judged against outcomes rather than page counts.

Deliverable

Value Created

Current‑State Assessment Report

A factual baseline of security operations, tooling and processes that every later decision builds on

Gap Analysis and Recommendations

A prioritized view of the architectural, operational, process and technology gaps that limit MDR effectiveness

MDR Transformation Strategy and Roadmap

A phased plan that connects the target state to priorities, dependencies and expected outcomes

Target‑State Security Architecture

A Microsoft-centric architecture that stakeholders can agree on before design and build begin

MDR Reference Architecture and Solution Design

Reusable designs and deployment standards that make delivery consistent across engagements

Integration Architecture and Data Flow Diagrams

Clear data paths between Microsoft services, third‑party tools, threat intelligence sources and ticketing systems, with no log source or workflow left undefined

Use Case and Detection Engineering Framework

A structured way to build, test and tune detections against the threats that matter most to each client

SOC Operating Model and Governance Framework

Defined roles, processes, service levels and decision rights that keep MDR operations accountable

Implementation and Migration Plan

A controlled path from existing tooling to the target platform that protects monitoring coverage during cutover

Runbooks, Standard Operating Procedures (SOPs) and Playbooks

Consistent, documented response that does not depend on any single analyst's knowledge

Knowledge Transfer and Training Materials

SOC teams that can run, tune and improve the capability on their own

Final Executive Summary and Recommendations

Leadership‑ready outcomes, risks and next steps that support funding and sponsorship decisions

Required Experience

• 6+ years of experience in cyber security architecture, SOC, MDR or security operations.
• Proven experience designing and implementing enterprise MDR or SOC transformation programs.
• Deep expertise in Microsoft security technologies, including Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Cloud, Microsoft Entra ID, Microsoft Security Copilot, Microsoft Purview and Microsoft Priva.
• Strong understanding of SIEM, SOAR, UEBA, threat intelligence, detection engineering, threat hunting and incident response.
• Working knowledge of privacy, regulatory compliance and risk management practice, including mapping security controls to frameworks such as NIST CSF 2.0, ISO/IEC 27001, HIPAA and GDPR.
• Experience integrating Microsoft security solutions with third‑party technologies.
• Strong architecture, documentation, stakeholder management and workshop facilitation skills.
• Experience in MSSP, MDR service development or enterprise SOC transformation initiatives is highly preferred.