Identity Threat & Exposure (ITDR / ISPM) Service Architect

Must have skills

• Architected and productised identity security services (reference architecture, platform evaluation and selection, service definition), not implementation only
• Active Directory and Microsoft Entra ID security internals (Kerberos, ACLs, delegation, tiering, conditional access, token model); Okta an advantage
• Identity attack techniques at reproduction depth, mapped to MITRE ATT&CK credential access, privilege escalation, lateral movement and persistence (Kerberoasting, pass-the-hash/ticket, DCSync, ADCS abuse, token theft and replay, MFA fatigue, OAuth and consent abuse), and the telemetry each leaves
• Attack path analysis as a graph problem, including cloud role escalation (BloodHound, PingCastle, Purple Knight)
• ITDR platforms: hands-on with at least one of Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Silverfort, Semperis, Vectra AI
• ISPM platforms: hands-on with at least one of Radiant Logic, Semperis, Veza, Tenable Identity Exposure, Silverfort
• Detection engineering and behavioural baselining (Sentinel/KQL, Splunk, Sigma), with detection coverage mapped to MITRE ATT&CK and false-positive management
• Response automation and containment design: SOAR playbooks, API-level containment actions, containment authority model
• Security operations fluency: has introduced detection content or containment authority into a SOC and can hold the alert-quality conversation

Good to have

• Threat hunting and deception design (honeytokens, decoy accounts)
• Exposure management platforms (Tenable One, Microsoft Security Exposure Management, Wiz)
• PAM platforms at API level (Idira/CyberArk, BeyondTrust) as signal and containment lever
• NIS2 and DORA incident reporting obligations; GDPR constraints on behavioural monitoringRole & responsibilities

Preferred candidate profile