Description
OverviewWith over 17,000 employees worldwide, the Microsoft Customer Experience & Success (CE&S) organization is responsible for the strategy, design, and implementation of Microsoft's end-to-end customer experience. Come join CE&S and help us build a future where customers come to us not only because we provide industry-leading products and services, but also because we provide differentiated and connected customer experience.We are looking for a highly motivated and deeply technical Security Cloud Solution Architect (CSA) with broad experience across the Microsoft Security portfolio, including Defender XDR, Microsoft Entra, Microsoft Purview, and Security Copilot, combined with deep hands-on expertise in Microsoft Sentinel and Microsoft Defender for Cloud. The ideal candidate has designed, deployed, and operated these solutions in enterprise production environments and led complex SIEM modernization, cloud security, and customer transformation engagements from strategy and architecture through implementation, adoption, and operational excellence.ResponsibilitiesTrusted Technical Advisor: Lead security strategy, architecture, and modernization initiatives with deep specialization in Microsoft Sentinel and Microsoft Defender for Cloud. Partner with CISOs, Security Architects, and platform teams to design, deploy, optimize, and scale security solutions across SecOps, Identity, Cloud, Data, and AI Security, driving customer outcomes from strategy through operational excellence. Microsoft Sentinel: Architect, deploy, and operationalize Microsoft Sentinel, including workspace and multi-tenant design, AMA and DCR architecture, native and custom connectors, Syslog/CEF onboarding, KQL detection engineering, incident workflows, UEBA, threat intelligence, hunting, automation rules, and Logic Apps playbooks. Microsoft Defender for Cloud: Drive adoption of Defender CSPM and Cloud Workload Protection Platform (CWPP) across servers, containers, Kubernetes, databases, storage, applications, APIs, and AI workloads. Lead secure score improvement, attack path analysis, regulatory compliance, Azure Policy governance, agentless scanning, DevOps security, and multicloud onboarding. SIEM Modernization: Lead migrations from third-party SIEM platforms to Microsoft Sentinel, including assessment, data onboarding, content translation, parallel-run strategy, validation, and production cutover. AI Security & Security Operations: Help customers secure and operationalize AI workloads using Security Copilot, Sentinel Data Lake, Defender for AI, Defender for Cloud AI-SPM, DSPM for AI, MCP servers, and agentic security capabilities. Drive AI-assisted detection, investigation, response, governance, and protection of AI applications, agents, and underlying data. Consumption & Operational Health: Drive production adoption, operational excellence, and long-term value realization through technical consumption plans, workload onboarding, health assessments, cost governance, retention strategies, and blocker removal. Improve detection coverage, automation maturity, secure score, cloud risk posture, alert quality, ingestion efficiency, and overall platform health through continuous optimization reviews and data-driven recommendations. Unified Security Architecture: Design end-to-end architectures integrating Sentinel and Defender for Cloud with Defender XDR, Microsoft Entra, Microsoft Purview, Security Copilot, and Azure security services to deliver a unified security operations model. Customer Delivery: Lead architecture workshops, design sessions, proofs of concept, health assessments, and hands-on enablement to accelerate customer success. Engineering Partnership: Escalate product gaps, influence roadmap direction, capture customer feedback, and develop reusable guidance and best practices for the field and product teams. Account Collaboration: Partner with account teams, specialists, services, and partners to turn architecture decisions into deployed, consumed, and operationalized solutions. QualificationsBachelor's degree in Computer Science, Information Technology, Engineering, Cybersecurity, or a related field, with 5+ years of relevant experience, or equivalent practical experience. Proven hands-on experience designing, deploying, and operating Microsoft Sentinel in enterprise environments, including security monitoring, detection engineering, automation, and large-scale SOC operations. Proven experience leading enterprise SIEM modernization and migrations to Microsoft Sentinel, including assessment, data onboarding, content migration, validation, parallel operations, and production cutover from legacy SIEM platforms. Proven hands-on experience implementing Microsoft Defender for Cloud, including CSPM, CWPP, cloud governance, workload protection, security posture management, and risk reduction across Azure and multi-cloud environments. Strong experience securing Azure Landing Zones and enterprise-scale cloud environments using Azure Policy, Management Groups, RBAC, Privileged Identity Management (PIM), and Zero Trust principles. Experience designing and securing Azure network architectures, including Azure Firewall, Firewall Manager, Web Application Firewall (WAF), DDoS Protection, Private Link, NSGs, ASGs, Virtual WAN, Secure Access Service Edge (SASE), and micro-segmentation. Experience working with large SOCs, GSOCs, MSSPs, or managed security operations organizations, driving SOC transformation, operational excellence, and security platform adoption. Broad expertise across the Microsoft Security portfolio, including Defender XDR, Microsoft Entra, Microsoft Purview, and Security Copilot, with the ability to integrate these technologies into a unified security architecture. Demonstrated success leading customer-facing engagements focused on SIEM transformation, cloud security, Zero Trust, SOC modernization, and enterprise security architecture. Strong knowledge of security operations disciplines, including threat hunting, detection engineering, security analytics, incident response, automation, and SOC maturity improvement. Experience securing AI-enabled environments, including AI security posture management, governance, data protection, observability, threat protection, and responsible AI controls. Strong automation and scripting skills using KQL, PowerShell, Python, Logic Apps, REST APIs, Microsoft Graph, and security orchestration technologies. Working knowledge of industry security frameworks and standards, including NIST, CIS, ISO 27001, and PCI DSS. Experience embedding security into DevSecOps, CI/CD, and platform engineering practices while collaborating effectively with engineering teams, MSSPs, partners, and operational security stakeholders. CertificationsRequired SC-200: Microsoft Security Operations Analyst Associate AZ-500: Microsoft Azure Security Engineer Associate PreferredSC-100: Microsoft Cybersecurity Architect Expert SC-300: Microsoft Identity and Access Administrator Associate SC-900: Microsoft Security, Compliance, and Identity Fundamentals AI-900: Microsoft Azure AI Fundamentals CISSP, CCSP, GIAC or equivalent industry certification This position will be open for a minimum of 5 days, with applications accepted on an ongoing basis until the position is filled.Microsoft is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to age, ancestry, citizenship, color, family or medical care leave, gender identity or expression, genetic information, immigration status, marital status, medical condition, national origin, physical or mental disability, political affiliation, protected veteran or military status, race, ethnicity, religion, sex (including pregnancy), sexual orientation, or any other characteristic protected by applicable local laws, regulations and ordinances. If you need assistance with religious accommodations and/or a reasonable accommodation due to a disability during the application process, read more about requesting accommodations.