Stanton House
Microsoft Sentinel Solution Architect
How your CV stacks up
Upload your CV to see how well it fits this job role
?%
Microsoft Sentinel Solution Architect
Microsoft Sentinel Solution Architect
A Microsoft Sentinel Solution Architect is required to support a strategic architecture review and optimisation programme for an enterprise client.
This is an opportunity to assess an existing Microsoft Sentinel deployment, validate its architecture, monitoring coverage and integration model, and help shape the future direction of the organisation's security monitoring capability.
The engagement will focus on reviewing the current state, identifying gaps and risks, and providing practical recommendations to improve scalability, detection coverage, operational effectiveness and overall value from the platform.
Responsibilities
- Provide hands-on Microsoft Sentinel solution architecture expertise during a focused six-week engagement.
- Work directly with the client Product Owner, Security Architect and key stakeholders to assess the current Sentinel design and operating model.
- Review architecture, use cases, integrations, detection content and security monitoring processes.
- Identify risks, constraints, gaps and improvement opportunities across the platform.
- Develop practical recommendations and prioritised next steps to strengthen the client's security monitoring capability.
- Support architecture governance and decision-making activities.
Key Deliverables
- Current-state architecture review of the Microsoft Sentinel implementation.
- Assessment of workspace design, data connectors, log sources, ingestion patterns, retention strategy, access controls and cost considerations.
- Review of analytics rules, detection logic, automation rules, workbooks, playbooks and incident management workflows.
- Enterprise integration assessment covering identity, endpoint, cloud, network, infrastructure, application logging, vulnerability management, ticketing systems and SOC operations.
- Target-state architecture recommendations and prioritised improvement roadmap.
- Architecture decision records, risks, assumptions, dependencies and governance documentation.
Reasons to use Rodeo
Start with a chat, not a search bar
Grad scheme, placement, apprenticeship? Not sure what you want yet — that's fine. Your agent talks it through with you and turns "I have no idea" into a shortlist.
It searches the market for you
Every day your agent scans the market matching roles against what actually matters to you, not just keywords on a CV.
Only hits
No noise. No "maybe this fits." Just roles with a clear explanation of why they're right — and where to focus when applying.
Essential Skills and Experience
- Strong Microsoft Sentinel Solution Architecture experience within large enterprise environments.
- Deep understanding of SIEM architecture, security monitoring, detection engineering and SOC integration.
- Experience reviewing and optimising Sentinel workspace design, connector strategies, analytics rules, KQL, automation rules, Logic Apps, playbooks and workbooks.
- Strong knowledge of the Microsoft security ecosystem, including Microsoft Defender, Entra ID, Microsoft 365, Defender for Cloud and Azure services.
- Experience integrating Sentinel with cloud platforms, network security tooling, infrastructure and application logging, ITSM platforms and vulnerability management solutions.
- Ability to assess monitoring use cases against threat models, operational requirements and cyber risk priorities.
- Strong architecture governance experience with the ability to produce clear findings, recommendations and decision papers.
- Comfortable engaging directly with Product Owners, Security Architects, Security Operations teams, engineers and senior stakeholders.
Get help with your application
Your very own career expert that helps elevate your application to the next level.
Additional Desirable Experience
- Experience within aviation, critical infrastructure or highly regulated environments.
- Familiarity with NCSC, CISA, NIST, CIS or MITRE ATT&CK aligned monitoring frameworks.
- Experience with Sentinel cost optimisation, log retention strategies and ingestion management.
- Experience improving detection effectiveness, alert quality and incident enrichment.
- Experience supporting SOC transformation programmes or managed security service integrations.
Evidence We'd Like to See
- Examples of Microsoft Sentinel architecture reviews, design assessments, HLDs or improvement roadmaps.
- Experience reviewing and enhancing Sentinel use cases and detection capabilities at enterprise scale.
- Examples of integrating Sentinel with Microsoft Defender, Entra ID, cloud platforms, network tooling, ITSM solutions and SOC processes.
- Evidence of KQL development, analytics rule creation, automation playbooks, workbooks or incident enrichment capabilities.
- Examples of presenting architecture recommendations and findings to senior stakeholders.
Contract Details
- This is an initial 6-week contract requiring full-time commitment (100% utilisation) for the duration of the engagement.
- Please include your Outside IR35 day-rate expectations with any application.
- Location: London
- In-Office Requirements
- Hybrid working, with client site attendance as required.
“It took my CV and asked me questions relevant to understanding what kind of jobs to suggest for me. Suggestions were almost perfect. Jobs were exactly what I’ve been looking for.”
Jessica, London
Skills
Location