SOC Architect - Consultancy

Our client is a specialist cybersecurity and information assurance consultancy, supporting organisations across both the public and private sectors. They provide expert guidance in areas such as cloud security, GRC, data protection, and risk management,  helping clients build and maintain robust, compliant, and secure digital environments.

We are seeking a highly skilled SOC Architect to lead the design and build of a modern Security Operations Centre (SOC) leveraging the Microsoft Azure security stack - including Azure Sentinel, Defender XDR, Log Analytics, and associated tools.

This is a strategic, greenfield opportunity to define the SOC architecture end-to-end, working closely with stakeholders to ensure the solution meets technical, operational, and compliance needs.

If you are interested in this opportunity, get in touch and apply today! 

Key Responsibilities:

• Lead the full design and architecture of a new SOC based on Microsoft Azure technologies
• Define the SOC strategy, technical architecture, and operational model
• Design and implement Azure Sentinel, including custom connectors, workbooks, analytics rules, and automation
• Integrate Defender for Endpoint, Defender for Cloud, and Microsoft 365 Defender into the SOC environment
• Establish logging, alerting, and monitoring baselines using Log Analytics and Kusto Query Language (KQL)
• Define use cases, playbooks, and incident response workflows
• Collaborate with security, infrastructure, and cloud teams to ensure seamless deployment and integration

Required Skills & Experience:

• Proven experience in SOC design and architecture, ideally from scratch
• Deep knowledge of Microsoft Azure security stack:
• Azure Sentinel
• Microsoft Defender suite (Endpoint, Cloud, Identity, etc.)
• Log Analytics/KQL
• Strong understanding of SIEM, SOAR, threat detection, and incident response
• Experience with compliance and regulatory requirements (eg ISO 27001, NIST, CIS)

Contract Details:

• Rate: £500 per day
• Duration: 3 months (possible extension)
• Location: Fully Remote
• IR35: Outside IR35