Microsoft Sentinel Architect

Mizuho Global Services Pvt Ltd (MGS) is a subsidiary company of Mizuho Bank, Ltd, which is one of the largest banks or so called ‘Mega Banks’ of Japan. MGS was established in the year 2020 as part of Mizuho’s long-term strategy of creating a captive global processing center for remotely handling banking and IT related operations of Mizuho Bank’s domestic and overseas offices and Mizuho’s group companies across the globe.
At Mizuho we are committed to a culture that is driven by ethical values and supports diversity in all its forms for its talent pool. Direction of MGS’s development is paved by its three key pillars, which are Mutual Respect, Discipline and Transparency, which are set as the baseline of every process and operation carried out at MGS.

What’s in it for you?
o Immense exposure and learning
o Excellent career growth
o Company of highly passionate leaders and mentors
o Ability to build things from scratch

Know more about MGS:
- Job Title:

Microsoft Sentinel Architect

Location:

Chennai

Role Summary
We are seeking a highly experienced Microsoft Sentinel Architect with 10+ years of hands-on experience designing, deploying, and operating SIEM/SOAR solutions with a deep specialization in Microsoft Sentinel. This role requires a self-starter with strong self-confidence, capable of owning outcomes end-to-end—from use case engineering and tuning to automation and scripting for security operations at scale.

Key Responsibilities

Microsoft Sentinel Engineering & Operations
- Lead the architecture, implementation, and optimization of Microsoft Sentinel across enterprise environments.
- Own onboarding and management of data sources (e.g., Microsoft Defender, Entra , M365, Azure, Windows/Linux, network/security tools).
- Define and implement best practices for workspace design, data ingestion strategy, retention, and cost optimization.

Use Case Development & Tuning
- Design, build, and maintain Sentinel analytics rules (scheduled, near real-time, and advanced detections).
- Develop and continuously improve detection use cases, aligned to MITRE ATT&CK and organizational threat models.
- Perform use case tuning to reduce false positives/negatives:
- Query optimization and refinement in KQL
- Thresholding, suppression, entity mapping, and alert grouping
- Baseline behavior analysis and exception handling
- Establish governance around detection lifecycle: requirements → build → test → deploy → tune → retire.

Automation, SOAR & Scripting
- Develop and enhance automation workflows using:
- Logic Apps / Sentinel Playbooks
- Automation Rules and incident orchestration
- Build scripts and tooling for operational efficiency (e.g., enrichment, bulk rule updates, incident handling, IOC management).
- Create reusable automation components integrating with APIs and security tooling (ticketing, CMDB, threat intel, EDR/XDR).

Leadership & Ownership
- Act as a self-driven technical owner for Sentinel delivery and continuous improvement.
- Provide technical leadership, mentoring, and guidance to SOC analysts and engineers.
- Drive collaboration across Security, Cloud, Identity, Infrastructure, and Compliance teams.

Required Qualifications
- 10+ years of experience with Microsoft Sentinel, including enterprise-scale deployment and operational ownership.
- Advanced proficiency in KQL (Kusto Query Language)—writing, troubleshooting, and optimizing complex queries.
- Demonstrated experience building and tuning Sentinel use cases and analytics rules in production SOC environments.
- Strong hands-on experience with SOAR automation (Logic Apps/Playbooks, Automation Rules).
- Strong automation and scripting skills, such as:
- Power Shell, Python, Azure CLI
- Working with REST APIs, JSON, authentication mechanisms (OAuth, managed identity)
- Proven ability to work independently as a self-starter with high ownership and confidence in decision-making.

Preferred Qualifications (Nice to Have)

- Experience with Microsoft Defender XDR, Defender for Cloud, Entra , M365 security tooling.
- Familiarity with ASIM, data normalization strategies, and advanced hunting concepts.
- Relevant certifications (preferred, not mandatory):
- Microsoft SC-200, AZ-500 (or equivalent security certifications)
- Experience integrating Sentinel with third-party tools (EDR, firewalls, proxies, ITSM like Service Now/Jira).

Core Skills Summary
- Microsoft Sentinel (SIEM/SOAR)
- KQL (advanced)
- Use case engineering + tuning
- Automation & orchestration (Logic Apps/Playbooks)
- Scripting (Power Shell/Python)
- Incident lifecycle optimization & SOC enablement
- Self-starter mindset, confident ownership, stakeholder collaboration

Address  16th Floor, Tower-B Brigade, World Trade centre, 142, Rajiv Gandhi Salai, OMR, Perungudi, Chennai, Tamil Nadu 600096