Presales Consultant

Job Description
K Ey Responsibilities Solution Architecture & Technical Presales
- Lead technical discovery and qualification; translate business, risk and compliance requirements into target security architectures across identity, endpoint, email, data, cloud, network and SOC domains.
- Identity & Zero Trust: design Conditional Access policy frameworks, privileged access management, identity governance (access reviews, entitlement management, lifecycle workflows), hybrid identity, MFA / passwordless, and Zero Trust network access (Entra Global Secure Access, Cisco Duo / Secure Access, Fortinet ZTNA, Check Point Harmony SASE).
- Endpoint & XDR: architect EDR / XDR deployments across Windows, macOS, Linux and mobile — onboarding strategy, attack-surface-reduction and hardening baselines, automated investigation and response, identity threat detection (Defender for Identity), vulnerability management — using Defender XDR, FortiEDR / FortiXDR, Check Point Harmony Endpoint or Cisco Secure Endpoint.
- Email & Collaboration Security: design layered email protection (Defender for Office 365 / Exchange Online Protection with Mimecast, Check Point Harmony Email or Cisco Secure Email), including connector, MX and outbound-routing design, DMARC / DKIM / SPF, attack simulation and awareness training.
- SIEM, SOAR & SOC Modernisation: design Sentinel and FortiSIEM / FortiSOAR solutions — data-connector strategy, log ingestion tiering and Data Collection Rules, analytics and hunting content, SOAR playbooks, single vs multi-workspace and multi-tenant (Lighthouse) designs, Security Copilot — plus migration runbooks from Splunk, QRadar, ArcSight and LogRhythm and MDR / managed SOC service definitions.
- Data Security & DLP: design data-classification and DLP programmes with Purview (sensitivity labels, auto-labelling, Endpoint / Cloud / Exchange DLP, Insider Risk, Data Lifecycle, eDiscovery) and Forcepoint DLP / Risk-Adaptive Protection / Forcepoint ONE, including co-existence designs where Purview labels act as Forcepoint classifiers.
- Cloud Security Posture: architect CSPM / CNAPP and CASB / SSPM solutions — Defender for Cloud (multi-cloud AWS / GCP onboarding, workload protection, regulatory compliance dashboards), Defender for Cloud Apps, Check Point CloudGuard, Fortinet FortiCNAPP, Cisco Multicloud Defense.
- Network Security & SASE: design NGFW, segmentation, SD-WAN and SSE architectures with Fortinet Security Fabric (FortiGate, FortiManager, FortiAnalyzer), Check Point Quantum / Maestro, Cisco Secure Firewall, Umbrella and Secure Access, and Azure Firewall Premium / WAF / DDoS Protection.
- Integration architecture: produce reference designs showing telemetry and control-plane integration between network, endpoint and email controls and the SIEM / XDR layer (API connectors, CEF / Syslog via AMA, automated response through FortiGate, Check Point and Cisco APIs).
- Deliver compelling demonstrations, proofs of concept, pilots and hands-on workshops; own the technical close on every opportunity you are assigned to.
- Respond to RFPs, RFIs and tenders with high-quality technical write-ups, compliance matrices and architecture diagrams, and lead technical clarification sessions with evaluation committees.
- Produce Statements of Work, high-level designs and effort estimates, and run a structured handover to the delivery / SOC teams on every won deal. Commercial Modelling – Bills of Materials & Licensing
- Build licensing models across Microsoft 365 E3 → E5 step-ups, E5 Security and E5 Compliance add-ons, F-series, and standalone SKUs (Entra ID P1 / P2 / Suite, Defender for Endpoint P1 / P2, Defender for Office 365 P1 / P2, Intune Plans, Purview add-ons), mapping each customer requirement to the minimum SKU that unlocks the capability.
- Model cloud consumption for security workloads: SIEM ingestion (pay-as-you-go vs commitment tiers, Basic / Auxiliary log tiers, retention and archive), per-resource CSPM / CWPP pricing, firewall / WAF / DDoS, automation and log-analytics costs, and Security Copilot SCU sizing — presented as monthly and annual run-rate with 3-year projections.
- Build BoMs and subscription models: Fortinet (hardware bundles, FortiCare / FortiGuard tiers, FortiFlex points), Check Point (appliances, software blades / Infinity subscriptions, Harmony per-user), Cisco (Enterprise Agreements, Duo / Umbrella / Secure Access tiers, Secure Firewall Threat Defense licences), Forcepoint and Mimecast per-user plans — with renewal co-termination and multi-year options.
- Produce TCO and consolidation business cases quantifying licence rationalisation (e.g. retiring standalone MFA, EDR, CASB or email security), SIEM ingestion vs incumbent SIEM licensing, hardware-refresh avoidance and operational savings from unified XDR — and justify best-of-breed retention where platform-native controls do not meet the requirement (data sovereignty, OT / network segmentation, regulatory constraints, feature gaps). Security Pract