Soc Architect

Tata Consultancy Services; Chennai District; On-site; INR 2,500,000 - 5,500,000; Full time

Job summary

Tata Consultancy Services is seeking an experienced Microsoft Sentinel SIEM Architect for Chennai to design, implement, and optimize cloud-native SIEM/SOAR solutions. You will leverage AI-driven security, Azure OpenAI, and Security Copilot to enhance threat detection, response, and SOC efficiency.

The role requires designing end-to-end Sentinel architectures, integrating Azure, M365 Defender, on-prem sources, and cloud platforms across regions.

Qualifications

• Experience designing and implementing Sentinel SIEM architectures.
• Strong Azure security expertise and Defender/M365 integration.
• Experience with AI-driven security technologies (Azure OpenAI) and Security Copilot.
• Experience in multi-region, multi-tenant SIEM/SOAR deployments.
• Knowledge of MITRE ATT&CK mapping and alert tuning.

Responsibilities

• Design and implement end-to-end Sentinel architectures. Define ingestion, normalization (ASIM), and retention strategies. Architect multi-region & multi-tenant solutions.
• Develop HLD & LLD documentation, Integrate Azure, M365, Defender, on-prem (Syslog/CEF), AWS, GCP.
• Configure AMA, Event Hub, APIs, Logic Apps, Implement log filtering, transformation, enrichment.
• Develop HLD & LLD documentation, Integrate Azure, M365, Defender, on-prem (Syslog/CEF), AWS, GCP
• Custom Connector , Application log Source onboarding, Develop KQL-based analytics rules, Implement Fusion (ML) and NRT detections, Map to MITRE ATT&CK, Tune alerts and reduce false positives.
• Build Logic Apps playbooks, Automate triage, containment (IP/user actions), ticketing integration, Define automation lifecycle rules.
• Design L1/L2/L3 SOC workflows, Define severity, escalation, classification, Support threat hunting & incident response.
• Implement RBAC, PIM, Ensure ISO 27001, NIST, CIS compliance, Align logging with regulatory requirements.
• Optimize ingestion filtering, Manage retention (hot/archive), Monitor cost & performance efficiency.

Skills

Sentinel SIEM

Azure security

AI security

Security Copilot

KQL

Automation

Incident response

Tools

Logic Apps

Event Hub

Syslog/CEF

Azure Defender

M365 Defender

Job description

Company: TCS
Skill : SOC Sentinel
Experience: 10 to 15
Location : Chennai

Job Description

Must-Have

We are seeking an experienced Microsoft Sentinel SIEM Architect with strong expertise in Azure security technologies, AI-driven security (Azure OpenAI), and Microsoft Security Copilot. The ideal candidate will design, implement, and optimize modern cloud-native SIEM/SOAR solutions, while leveraging AI and automation to enhance threat detection, response, and SOC efficiency.

Good-to-Have

• Use Azure OpenAI for threat analysis, summarization, KQL/playbook generation
• Leverage Security Copilot for investigation and response
• Build AI workflows using prompt engineering & automation

Responsibility of / Expectations from the Role

• Design and implement end-to-end Sentinel architectures. Define ingestion, normalization (ASIM), and retention strategies. Architect multi-region & multi-tenant solutions.
• Develop HLD & LLD documentation, Integrate Azure, M365, Defender, on-prem (Syslog/CEF), AWS, GCP.
• Configure AMA, Event Hub, APIs, Logic Apps, Implement log filtering, transformation, enrichment.
• Develop HLD & LLD documentation, Integrate Azure, M365, Defender, on-prem (Syslog/CEF), AWS, GCP
• Custom Connector , Application log Source onboarding, Develop KQL-based analytics rules, Implement Fusion (ML) and NRT detections, Map to MITRE ATT&CK, Tune alerts and reduce false positives.
• Build Logic Apps playbooks, Automate triage, containment (IP/user actions), ticketing integration, Define automation lifecycle rules.
• Design L1/L2/L3 SOC workflows, Define severity, escalation, classification, Support threat hunting & incident response.
• Implement RBAC, PIM, Ensure ISO 27001, NIST, CIS compliance, Align logging with regulatory requirements.
• Optimize ingestion filtering, Manage retention (hot/archive), Monitor cost & performance efficiency.

Preferred Certifications

• SC-100 Microsoft Cybersecurity Architect
• SC-200 Security Operations Analyst
• AZ-500 Azure Security Engineer
• Azure AI / OpenAI certifications (preferred)

Key Competencies

• Strong analytical & problem-solving skills
• Enterprise-scale architecture design
• AI-driven SOC transformation expertise
• Stakeholder & SOC communication skills