Microsoft Cybersecurity Architect

The attacks that stop businesses are ransomware and compromised suppliers. You design to limit blast radius, protect backups and privileged paths, and reduce trust in software and vendors you do not control.

• How a ransomware attack progresses
• Protecting backups and recovery paths
• Limiting lateral movement and blast radius
• Securing the software supply chain
• Vendor and third-party risk in the design
• Designing a recovery plan that works under attack

You build A ransomware resilience design with protected backups and an isolation plan.

Good designs borrow from proven ones. You align with Microsoft’s reference architectures and security benchmarks, set secure landing zone baselines, and judge where a design must depart from them.

• Microsoft cybersecurity reference architectures
• The Microsoft cloud security benchmark
• Secure landing zones and baselines
• Security design for Azure, hybrid and multicloud estates
• Measuring a design against a benchmark
• Recording deliberate deviations

You build A benchmark gap analysis of an existing cloud environment against its landing zone design.

AI workloads bring new data flows and new attack paths. You design controls for models, prompts, grounding data and agents, and set the governance that lets an organization adopt AI without losing track of what it exposes.

• Threats to AI workloads and AI-enabled apps
• Protecting prompts, models and grounding data
• Shadow AI and discovery of unsanctioned use
• Governing agents and their access
• Security reviews for AI projects

You build A security design for an AI application, with its threats and the controls that answer them.

Operations design decides how fast an attack is noticed and contained. You design how XDR and SIEM work together, route signals, automate response, and measure the result.

• XDR and SIEM: what each one is for
• Log sources and data connector design
• Detection engineering and analytics rules
• Automating response and orchestration
• Incident workflow and escalation
• Measuring detection and response

You build A detection and response architecture with its sources, rules and automated actions.

Detections should follow how attackers actually work. You use threat intelligence and the MITRE ATT&CK framework to find coverage gaps, prioritize new detections, and test whether a design would see a real attack path.

• ATT&CK tactics, techniques and coverage mapping
• Sources of threat intelligence
• Turning intelligence into detections
• Threat hunting as a design input
• Attack simulation and purple teaming

You build An ATT&CK coverage map of an existing detection set, with the gaps identified.

Identity is where most attacks land. You design how people, workloads and AI agents authenticate, how privileged access is limited in time and scope, and how external and machine identities are governed.

• Identity architecture in Microsoft Entra
• Conditional Access design at scale
• Privileged access: PIM, access reviews and separate accounts
• Identities for workloads and AI agents
• External and guest identity governance
• Protecting identity infrastructure itself

You build An identity and privileged access design that covers staff, partners, workloads and agents.

Regulation sets requirements that a design must meet and be able to evidence. You translate rules into controls, design data governance with Purview, and plan the audit evidence from the start.

• Translating regulation into security controls
• Compliance management and assessment tools
• Data governance and discovery with Purview
• Audit logging and evidence collection
• Privacy requirements and data residency
• Compliance for AI systems and their data

You build A control mapping from one regulation to designed controls, with the evidence each produces.

You cannot defend what you cannot measure. You design posture management with Defender for Cloud across Azure, on-premises and other clouds, set the policies and recommendations to act on, and decide who owns remediation.

• Cloud security posture management concepts
• Defender for Cloud across multiple clouds
• Policies, standards and secure score
• Attack path and exposure analysis
• Ownership and remediation workflow
• Governing exceptions

You build A posture management design spanning Azure and one other environment, with remediation owners.

Devices and servers set the floor of an estate’s security. You specify baselines for endpoints, servers, containers and cloud services, and design how they are enforced, monitored and exempted.

• Endpoint security baselines and hardening
• Server and virtual machine protection
• Container and Kubernetes security design
• Securing PaaS and serverless services
• Mobile and unmanaged device access
• Enforcement and exception handling

You build A baseline specification for endpoints, servers and one cloud service.

The network is no longer the boundary, but it still matters. You evaluate segmentation, firewall and DDoS designs, and Security Service Edge options such as Entra Internet Access and Private Access.

• Segmentation and microsegmentation
• Perimeter, firewall and DDoS design
• Security Service Edge: concepts and components
• Entra Internet Access and Private Access
• Replacing VPN with identity-aware access
• Evaluating a vendor network design

You build A network security design that segments a workload and replaces VPN access with Security Service Edge.

Applications and collaboration tools hold the work. You evaluate Microsoft 365 security, threat-model applications, and design security into each stage of the development lifecycle, from code to deployment.

• Evaluating Microsoft 365 security controls
• Threat modeling an application
• Security in the development lifecycle
• Application identity and API protection
• Securing software pipelines
• Web and API threat protection

You build A threat model for a business application, with the controls added to its design.

Data protection follows the data. You design classification and labeling, encryption and key management, and loss prevention, including for the data that AI systems train on, ground on and generate.

• Data discovery and classification
• Sensitivity labels and protection policies
• Encryption, key management and confidential computing
• Data loss prevention design
• Data governance for AI inputs and outputs
• Retention and disposal

You build A data protection design that classifies, labels and encrypts one dataset used by an AI feature.

Bring every domain into one design. You assess a realistic organization, produce a Zero Trust aligned architecture across identity, operations, infrastructure, applications and data, and defend the sequence of work.

• Assessing the organization’s risk and current state
• Designing across identity, infrastructure and data
• Aligning to benchmarks and regulations
• Sequencing the roadmap
• Presenting and defending the architecture

You build A security architecture document and a staged roadmap for one organization.