Cybersecurity Architect – Microsoft Sentinel
About the assignment
A major organisation is modernising its security operations centre with Microsoft Sentinel as the core SIEM platform. You architect the end-to-end design: data ingestion pipelines, detection logic, automation workflows, and integration with existing tools.
You work on threat detection maturity, incident response optimisation, and scalable security monitoring across hybrid cloud and on-premises environments. Your designs balance detection coverage with operational efficiency.
Your responsibilities
- Design Sentinel architecture including data sources, log pipelines, and storage strategies
- Build and tune detection rules and analytics using KQL (Kusto Query Language)
- Architect automation playbooks for incident response and triage workflows
- Integrate Sentinel with identity, endpoint, and threat intelligence platforms
- Define metrics, dashboards, and SOC operational reporting frameworks
- Mentor security engineers on Sentinel best practices and cloud SIEM design
- Review and optimise query performance and cost efficiency
- Recommend and implement security content from industry benchmarks (MITRE ATT&CK, NIST IR)
Tech Stack & Tools
Platforms & Tooling
Frameworks & Standards
Cloud & Infrastructure
Methodologies
Certifications (preferred)
Must-haves
- 5+ years in security operations or SIEM architecture
- Hands-on experience with Microsoft Sentinel (production environment)
- Strong KQL query writing and performance optimisation skills
- Experience designing detection rules and response automation
- Deep knowledge of cloud security (Azure or hybrid environments)
- Understanding of threat detection and incident response workflows
Nice-to-haves
- Experience with SOAR platforms or Azure Logic Apps for automation
- Familiarity with advanced threat hunting and MITRE ATT&CK mapping
- Background in cost optimisation and cloud monitoring strategy
- Previous mentoring or architecture leadership experience
What we offer
- Lead technical design of a modern security platform
- Work with cutting-edge cloud security technologies
- Shape the future of the organisation's threat detection capability
- Collaborate with cross-functional security and infrastructure teams
- Flexible hybrid working arrangements
- Personal guidance from a dedicated MVPeople consultant who knows your niche
The process
Introduction
Phone call with your MVPeople consultant (within 24 hours)
Match & Brief
We discuss the assignment in detail and prepare you
Client meeting
Introduction to the client
Start
Contracting and onboarding
Details
Type
Freelance / ZZP (MVPeople)
Location
Rotterdam, ZH
Work model
Hybrid
Level
Senior
Industry
digitale-infrastructuur
Market indication
€80 - €105 per hour
Posted
12 October 2026
Job ID
58946
Contact
MVPeople Group
jobs@mvpeoplegroup.com