Cloud security architecture
Security designs for Azure and multicloud estates: posture in Defender for Cloud, guardrails written as Azure Policy, and identity and network boundaries, reviewed against the Microsoft Cloud Security Benchmark.
Cloud security architect · Kolkata, India
Kaushik SahaCloud security architecture that holds up when AI joins in.
Twelve years in cybersecurity, from SOC analyst to architect. I design security for Microsoft cloud estates end to end: posture and policy across Azure and other clouds, detection and response on Sentinel and Defender XDR, and the controls around AI systems and agents, so models draft, people decide and every step is on the record.
- SC-100
- Microsoft Cybersecurity Architect Expert
- AZ-500
- Azure Security Engineer Associate
- 12
- Years in cybersecurity
What I work on
Detection and response
KQL detections mapped to MITRE ATT&CK, detection-as-code pipelines that validate a rule before production, and Logic Apps automation for enrichment and containment on Sentinel and Defender XDR.
Agentic AI for security operations
LangGraph workflows with specialist LLM agents, human approval gates and Langfuse tracing — so AI assists triage and design without acting unchecked.
Securing AI systems
Prompt-injection boundaries, tool permissions and agent governance, mapped to the OWASP LLM Top 10 and the NIST AI Risk Management Framework.
Selected work
Built, tested, and honest about its limits
Some of this runs in private repositories. Happy to walk through the design in a conversation.
sentinel-triage-agent
PublicA LangGraph agent that triages a Microsoft Sentinel incident and stops for human approval before anything is dispatched. Deterministic enrichment and ATT&CK mapping run before any token is spent; incident text is treated as untrusted input. Runs with no API key.
- LangGraph
- Langfuse
- Python
- MITRE ATT&CK
Cyber Orchestrator
PrivateA governed multi-agent framework for security delivery: specialist agents for Sentinel design, KQL authoring, architecture review and documentation, run by a workflow engine with approval gates, an append-only audit journal and full LLM observability.
- LangGraph
- Langfuse
- MCP
- FastAPI
Architecture compiler
PrivateA Python engine that turns a schema-validated architecture model into editable enterprise diagrams, with AI generation behind deterministic confidence gates and an independent reviewer agent that cannot approve its own work.
- Python
- JSON Schema
- draw.io
- ADR-governed
azure-security
PublicA KQL learning path from first query to threat hunt, plus a Sentinel table library with sample logs and MITRE-mapped hunts, built so practitioners can learn the reasoning rather than copy queries.
- KQL
- Microsoft Sentinel
- Labs
Writing
Notes from the work
Governed agentic AI for cybersecurity
Why approval gates, independent review and an audit trail matter more than the prompts.
Langfuse for cybersecurity: an SOC lens
What to trace in a security workflow, and what must never be logged.
Detection-as-Code: the pipeline & governance
Version-controlled detections, validation gates and the review model around them.
Validating Sentinel detections in CI/CD
Catching a broken analytic rule before it reaches the production workspace.
Open to conversations about cloud security architecture and securing AI
Architecture reviews, posture and policy, Sentinel and Defender delivery, or guardrails around agents that touch production. LinkedIn is the quickest way to reach me.