Matthias von Ehr — Cloud Security Architect
Security architecture that does not unravel.
The Microsoft Security stack, detection engineering, and the unglamorous discipline of SecOps — built to hold under load, not to fill a slide.
Approach
Defense through architecture, not noise.
I design and operate security architectures on the Microsoft stack — Defender XDR, Microsoft Sentinel, Entra ID, and Intune. The work is detection engineering, identity governance, and endpoint security across multi-tenant enterprise environments.
Based in Saarland, working fully remote. Open to connections across the DACH region, in German or English.
Focus
Four areas, operated as one plane.
Detection Engineering
KQL detections mapped to MITRE ATT&CK, version-controlled, and maintained across tenants — not a folder of one-off queries.
Microsoft Security Stack
Defender XDR, Sentinel, Entra, and Intune operated as one coherent plane, not four products bought separately.
Identity & Access
Conditional Access, PIM, and Just-In-Time access — least privilege that survives an audit and a Monday morning alike.
SecOps
Triage, tuning, and the discipline of closing the findings that actually have consequences today.
Pipeline
From telemetry to a decision.
Work
Things built and shipped.
MITRE KQL Explorer
An open tool for mapping MITRE ATT&CK techniques to KQL detections for Microsoft Sentinel and Defender XDR. Built for practitioners who want coverage they can read.
More to come. Quietly, when it is ready to hold.
Writing
Notes for practitioners, not slideware.
Regular writing on LinkedIn — security architecture, detection engineering, SecOps. Concrete positions, defended with one technical reason at a time.
Follow on LinkedInContact