MDR Platform Architect and Engineer Freelance Consultant

Managed Detection and Response (MDR) | Microsoft Security Architecture | Platform Engineering | Security Operations

Experience: 8+ Years

Employment Type

Part-Time Consultant / Freelancer (Santan Infotech Pvt Ltd)

Duration: 12 Months

Time Commitment: 40 Hours per Week

Location: Chennai, Tamil Nadu, India (Onsite)

Reports To : Head of MDR Practice, Santan Intellect

Domain

Managed Detection and Response (MDR) | Microsoft Security Architecture | Platform Engineering | Security Operations

Job Description

This position is responsible for architecting, designing, engineering and operationalizing Santan Intellect's Managed Detection and Response (MDR) platform during a 12-month freelance consulting engagement. The platform is built on Microsoft Sentinel and Microsoft Defender XDR, delivered through Microsoft's unified security operations platform in the Defender portal. It is the foundation on which Santan Intellect delivers MDR services to its clients.

This position works as an independent consultant, owning scope, milestones and quality while collaborating closely with Santan Intellect's MDR practice leadership, SOC operations team and threat research team. The scope runs end to end, from architecture and design through hands-on engineering and live operations to knowledge transfer and handover.

The value this position creates is a production-ready, multi-tenant MDR platform on which Santan Intellect can onboard clients quickly and operate consistently. By the end of the engagement the platform is documented, tested and owned by the permanent MDR team, so the service does not depend on the consultant to keep running.

Key Responsibilities

Platform Architecture

- Define the target-state architecture for Santan Intellect's MDR platform across Microsoft Sentinel, Microsoft Defender XDR and Microsoft Security Copilot, with Defender for Endpoint, Identity and Cloud as the core signal sources.
- Design the multi-tenant operating model using Microsoft Defender multitenant management, GDAP and Azure Lighthouse, with clear tenant, data and access boundaries between clients.
- Define the data architecture, including log source priorities, the split between the analytics tier and the data lake tier, retention and ingestion cost controls.
- Develop the integration architecture for ticketing systems, threat intelligence platforms, third-party security tools and client reporting, with data flow diagrams for each integration.

Solution Design

- Create detailed solution design documents, implementation blueprints and deployment standards that engineers can build from without rework.
- Design the customer onboarding blueprint, covering log source discovery, connector selection, access delegation and validation of telemetry coverage.
- Define the detection engineering framework and MDR use case library, mapped to MITRE ATT&CK;, with a managed lifecycle for building, testing, tuning and retiring detections.
- Design incident response workflows and SOAR playbook standards, including where Microsoft Security Copilot and agentic AI add value and the governance controls for AI agents.

Platform Engineering

- Build and configure the platform in Microsoft Sentinel and Microsoft Defender XDR, including workspaces, data connectors, analytics rules, automation rules and workbooks.
- Develop data connectors and API-based integrations using REST APIs, Syslog, CEF, webhooks, Azure Functions, Azure Logic Apps and the Microsoft Graph API.
- Develop SOAR playbooks in Azure Logic Apps for enrichment, ticketing and containment, using reusable components so playbooks behave consistently across clients.
- Implement the platform as code, using infrastructure as code and CI/CD pipelines with Microsoft Sentinel repositories to deploy and version-control platform configuration and detection content.
- Build platform health monitoring for ingestion, connector and rule failures, and service dashboards for measures such as mean time to detect and mean time to respond.

Operationalization & Service Readiness

- Define the SOC operating model, service levels, escalation paths and governance framework for the MDR service, including the service catalog.
- Develop operational documentation, runbooks, standard operating procedures and playbooks that allow SOC analysts to run the platform consistently.




- Lead the onboarding of the first clients onto the platform, validating telemetry coverage, detections and response workflows before wider launch.
- Support tuning, optimization and validation of detection and response capabilities after go-live, using incident outcomes as feedback.

Platform Security, Privacy & Compliance

- Secure the platform itself, applying least-privilege administrative access, Conditional Access and tenant isolation to all delegated and privileged access.
- Protect client data in the platform through classification, retention and residency controls aligned to obligations such as HIPAA, GDPR and India's Digital Personal Data Protection Act.
- Map platform controls to recognized frameworks such as the NIST Cybersecurity Framework (CSF) 2.0, ISO/IEC 27001 and SOC 2, and maintain a risk register for the platform.
- Design platform resilience and continuity, including backup of detection content, recovery procedures and service availability targets.

Knowledge Transfer, Mentoring & Handover

- Conduct knowledge transfer sessions and hands-on training workshops for SOC analysts, detection engineers and service delivery teams throughout the engagement.
- Mentor the permanent MDR team so ownership of the platform transfers fully by month 12.
- Maintain a platform backlog and roadmap for the permanent team to continue after handover.
- Report progress at agreed milestones and present the final executive summary and recommendations to Santan Intellect leadership.

Indicative 12-Month Engagement Plan

Phase

Timing and Outcomes

Phase 1: Architect

Months 1 to 2. Review existing tooling and processes. Agree the target architecture, tenancy model and data model. Publish the build roadmap. Outcome: an approved platform reference architecture.

Phase 2: Design

Months 3 to 4. Complete the solution designs and deployment standards. Define the onboarding blueprint, detection engineering framework and SOAR standards. Outcome: a build-ready design baseline.

Phase 3: Engineer

Months 5 to 9. Build the platform as code, including connectors, detections, playbooks and dashboards. Onboard the first clients and tune against real telemetry. Outcome: a working, monitored platform.

Phase 4: Operationalize and Hand Over

Months 10 to 12. Finalize runbooks and the operating model. Complete knowledge transfer and mentoring. Transfer ownership to the permanent MDR team. Outcome: a platform that Santan Intellect runs without the consultant.

Expected Deliverables

This position is accountable for the deliverables below across the 12-month engagement. Each is defined by the value it creates, so quality is judged against outcomes rather than page counts.

Deliverable

Value Created

MDR Platform Reference Architecture

A single agreed blueprint for tenancy, data flow, integration and security that all build work follows

Solution Design and Deployment Standards

Build-ready designs that let engineers deploy consistently and without rework

Integration Architecture and Data Flow Diagrams

Clear data paths between Microsoft services, ticketing, threat intelligence and client reporting, with no log source or workflow left undefined

Customer Onboarding Blueprint and Automation

Faster, repeatable client onboarding with consistent telemetry coverage from day one

Detection Framework and Use Case Library

A governed catalog of tested detections mapped to MITRE ATT&CK; and to client risk

SOAR Playbook and Automation Library

Consistent triage, enrichment and containment with less manual analyst effort

Platform as Code and CI/CD Pipeline

Version-controlled, reviewed and repeatable changes to platform configuration and detection content

Platform Health and Service KPI Dashboards

Early visibility of ingestion gaps, detection quality and service performance

SOC Operating Model and Governance

Defined roles, service levels and escalation paths that keep MDR delivery accountable

Runbooks, SOPs and Playbooks

Consistent operations that do not depend on any single person's knowledge





Knowledge Transfer and Handover Pack

A permanent MDR team that can run, tune and evolve the platform after the engagement ends

Final Executive Summary and Recommendations

Leadership-ready outcomes, risks and a roadmap for the platform after handover

Required Experience

- 6+ years of experience in cyber security architecture, SOC, MDR or security operations.
- Proven experience architecting and engineering a SIEM, XDR or MDR platform and taking it into live operation, preferably on Microsoft Sentinel and Microsoft Defender XDR.
- Deep expertise in Microsoft security technologies, including Microsoft Sentinel, Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Cloud and Microsoft Entra ID.
- Hands-on engineering experience with KQL, analytics rules, automation rules, playbooks, data connectors and API-based integrations.
- Experience applying infrastructure as code and CI/CD to security platforms and detection content.
- Solid understanding of SIEM, SOAR, UEBA, threat intelligence, detection engineering, threat hunting and incident response.
- Experience designing multi-tenant or managed-service security platforms.
- Experience in MSSP or MDR service development is highly preferred.
- Track record of delivering fixed-duration consulting engagements independently, with strong architecture, documentation and knowledge transfer skills.

Required Technical Expertise

Category

Technologies

Platform Architecture & Design

MDR platform reference architecture, multi-tenant design with Microsoft Defender multitenant management, GDAP and Azure Lighthouse, data architecture, Zero Trust, solution design documentation

Microsoft Sentinel & Defender XDR

Microsoft Sentinel (analytics tier and data lake tier), Microsoft Defender XDR, the unified security operations platform in the Defender portal, KQL, analytics rules, automation rules, workbooks

Endpoint, Identity & Cloud Security

Microsoft Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, Microsoft Entra ID, Conditional Access

Integration & Automation

REST APIs, Microsoft Graph API, Azure Logic Apps, Azure Functions, Syslog, CEF, webhooks, integration of third-party EDR, ticketing and threat intelligence platforms

Platform Engineering & DevSecOps

Infrastructure as code (Bicep, Terraform or ARM templates), CI/CD with Azure DevOps or GitHub, Microsoft Sentinel repositories, PowerShell or Python scripting, platform health monitoring

Detection, Threat Intelligence & Agentic AI

Detection engineering, threat hunting, UEBA, MITRE ATT&CK;, threat intelligence in the Microsoft Defender portal, Microsoft Security Copilot agents

Familiarity with additional ecosystem tools (for example, Microsoft Agent 365, Microsoft Entra Agent ID or non-Microsoft SOAR platforms) is a plus, not a requirement. Orientation on Santan Intellect's existing configuration and toolset is provided at the start of the engagement.

Preferred Certifications

- Microsoft Certified: Cybersecurity Architect Expert (SC-100) is strongly preferred. Related Microsoft credentials, including Security Operations Analyst Associate (SC-200), Identity and Access Administrator Associate (SC-300) and Cloud and AI Security Engineer Associate (SC-500), are also valued.
- A recognized security architecture or detection engineering certification such as CISSP, SABSA, TOGAF, GIAC GCDA or GIAC GCIH is an advantage.
- An equivalent security architecture, SOC or cloud security certification is also acceptable in place of the certifications above.

Education

- Bachelor's or master's degree in cyber security, information security, computer science or information technology.
- A cyber security-focused degree combined with strong practical platform engineering and MDR delivery experience is preferred.

Soft Skills

- Strong ownership and the ability to deliver independently as a consultant against agreed scope, milestones and quality standards.
- Excellent documentation, workshop facilitation and written communication skills.
- Ability to mentor and coach SOC analysts and engineers, and to transfer knowledge effectively.
- Structured, analytical problem-solving and sound judgment in balancing security, delivery speed and cost.
- Ability to influence decisions without direct authority while collaborating across SOC, threat research, engineering and delivery teams.

📌 MDR Platform Architect and Engineer as a Freelance Consultant (Chennai)
🏢 Santan Intellect
📍 Chennai