SIEM Architect

Tata Consultancy Services; Chennai District; On-site; INR 3,000,000 - 5,000,000; Full time

Job summary

Tata Consultancy Services is seeking an experienced Microsoft Sentinel SIEM Architect with deep Azure security expertise to design and optimize modern cloud-native SIEM/SOAR solutions. The role emphasizes AI-driven security, automated threat detection, and efficient SOC operations.

Responsibilities include designing end-to-end Sentinel architectures, configuring data ingestion and retention, and implementing automated playbooks using Logic Apps and Security Copilot.

Qualifications

• Experience in designing Microsoft Sentinel SIEM architectures.
• Experience with Azure security technologies and AI-driven security approaches.
• Knowledge of threat hunting and incident response in cloud environments.

Responsibilities

• Design end-to-end Sentinel architectures with ingestion, normalization, and retention strategies.
• Configure and optimize links between AMA, Event Hub, APIs, and Logic Apps.
• Develop KQL-based analytics rules and SIEM workflows to reduce false positives.
• Build playbooks for automated triage and containment, integrating ticketing systems.
• Map detections to MITRE ATT&CK and ensure compliant logging and RBAC controls.
• Support threat hunting and incident response with L1/L2/L3 SOC workflows.

Skills

Azure security

AI-driven security

Threat detection

Security operations

SOC optimization

Tools

Azure OpenAI

Security Copilot

KQL

Logic Apps

Job description

Microsoft Sentinel SIEM Architect with strong expertise in Azure security technologies.

Desired Experience Range**

10-15 YRS

Location of Requirement

Desired Competencies (Technical/Behavioral Competency)

Must-Have

We are seeking an experienced Microsoft Sentinel SIEM Architect with strong expertise in Azure security technologies, AI-driven security (Azure OpenAI), and Microsoft Security Copilot. The ideal candidate will design, implement, and optimize modern cloud-native SIEM/SOAR solutions, while leveraging AI and automation to enhance threat detection, response, and SOC efficiency.

Good-to-Have

• Use Azure OpenAI for threat analysis, summarization, KQL/playbook generation
• Leverage Security Copilot for investigation and response

Responsibility of / Expectations from the Role

1

Design and implement end-to-end Sentinel architectures. Define ingestion, normalization (ASIM), and retention strategies. Architect multi-region & multi-tenant solutions.

2

3

Configure AMA, Event Hub, APIs, Logic Apps, Implement log filtering, transformation, enrichment.

4

5

Custom Connector , Application log Source onboarding, Develop KQL-based analytics rules, Implement Fusion (ML) and NRT detections, Map to MITRE ATT&CK, Tune alerts and reduce false positives.

6

Build Logic Apps playbooks, Automate triage, containment (IP/user actions), ticketing integration, Define automation lifecycle rules.

7

Design L1/L2/L3 SOC workflows, Define severity, escalation, classification, Support threat hunting & incident response.

8

Implement RBAC, PIM, Ensure ISO 27001, NIST, CIS compliance, Align logging with regulatory requirements.

9

Optimize ingestion filtering, Manage retention (hot/archive), Monitor cost & performance efficiency.

10

Preferred Certifications

• SC-100 – Microsoft Cybersecurity Architect
• SC-200 – Security Operations Analyst
• AZ-500 – Azure Security Engineer
• Azure AI / OpenAI certifications (preferred)

11

• Strong analytical & problem-solving skills