Microsoft Sentinel SME

Job Title: Microsoft Sentinel SMELocation: Texas City, Texas – 5 days onsiteRate: OpenDuration: Long termSkills:This role is all about designing, building, and managing a test environment for Microsoft Sentinel and Defender xDR that mirrors the production setup. The focus is on ensuring seamless integration of logs from Windows, Linux, and on premises servers, guiding log forwarding to CRIBL, Sentinel Data Lake, and Azure Data Explorer (ADX).StageDeliverable(s): 1.0 Initiation & PlanningHigh Level TasksCollaborate with the relevant security teams to identify all prerequisites for the test environment, including network configurations, accounts, and necessary resources.Provide recommendations for the architecture of the test environment, ensuring it aligns with best practices for Microsoft Sentinel and Defender XDR.Develop a comprehensive deployment strategy for Microsoft Sentinel and Defender XDR, considering scalability and future integration needs.Establish security configurations for Sentinel and Defender XDR, ensuring compliance with organizational policies.Create a high-level deployment plan that incorporates automation scripts to streamline the setup process.Identify any specialized connectors or integrations required for the test environment.Review existing configurations and propose enhancements to optimize performance and security.Deliverable(s)Detailed Project PlanInitial Design Document (including security configurations)Deployment Guide for Microsoft Sentinel and Defender XDRBest Practices Document for Sentinel and Defender XDR Configuration2.0 Design: Consultant will perform the following:Create Infrastructure Architecture Diagrams (IADs) for the test environment, detailing the components of Microsoft Sentinel and Defender XDR.Design and implement a data flow process for the secure transfer of data between Microsoft Sentinel and Defender XDR, including:Mechanisms for data ingestion from various sources.Procedures for data validation and integrity checks.Protocols for data retention and removal policies.Define the roles and permissions required for users interacting with the test environment.Deliverable(s)Infrastructure Architecture DiagramsData Flow Design DocumentUser Role and Permissions DocumentSolution Architecture Document using organizational templates3.0 Testing/ConfigurationConfigure all necessary prerequisites for the test environment, including network settings, firewall rules, and security measures.Install Microsoft Sentinel and Defender XDR components as per the deployment guide.Configure integration points with existing systems and data sources.Create and test customized data connectors to ensure seamless data flow.Validate the data ingested into Microsoft Sentinel and Defender XDR, ensuring accuracy and completeness.Develop test scenarios to simulate various use cases and failure modes to ensure system resilience.Collaborate with security teams to establish health monitoring mechanisms for ongoing reliability.Deliverable(s)Build and Configuration Document for Microsoft Sentinel and Defender XDRPre-deployment Checklist for environment readinessTest Plan for validating functionality and performanceMonitoring Document for configuring alerts and compliance checksReporting Template for Sentinel and Defender XDR status and troubleshooting4.0 Documentation / TrainingCreate comprehensive documentation for all implemented solutions, detailing architecture, configuration, and operational procedures.Develop troubleshooting guidelines for common issues encountered in the test environment.Provide training sessions for relevant personnel on using and maintaining Microsoft Sentinel and Defender XDR effectively.Deliverable(s)Troubleshooting GuideInstallation issues and resolutionsGeneral operational issues and solutionsTraining Documentation for operating Microsoft Sentinel and Defender XDRUser guides for common tasks and featuresMaintenance tasks and best practices5.0 General ConsultingCollaborate with stakeholders on any additional tasks that may arise during the project.Ensure successful completion of the test environment setup with ongoing operational, technical, or strategic support.Deliverable(s)Updated documentation post-deployment for any changes madeHealth monitoring updates post-deploymentRecommendations for optimization to improve performance and resource utilization