Microsoft security that operators actually use.

Senior Cybersecurity Consultant at Spirhed Norway, based in Moss. He advises on, designs and implements Microsoft security solutions for Norwegian customers — Sentinel, Defender XDR, Entra ID. Outside of work he runs Håkansson Labs — a portfolio of personal projects including Politipuls (real-time map of Norwegian police incidents), Morgenbrief (a daily Norwegian finance newsletter), and The Conductor (self-hosted orchestration that builds and deploys his own sites).

A Microsoft security consultant designs and operates the security platform Microsoft sells — primarily Microsoft Sentinel (SIEM), Defender XDR (endpoint + identity + email + cloud), Entra ID (identity), and Microsoft Purview (data protection). Day-to-day work covers detection engineering with KQL, incident response playbooks, MDR service design, identity hardening, and architecture reviews — translating Microsoft product capability into outcomes a Norwegian operations team can actually run.

Microsoft Sentinel is the SIEM and SOAR layer — it ingests logs from any source, runs KQL analytics rules, and orchestrates response. Microsoft Defender XDR is the unified extended-detection-and-response platform that natively covers endpoints (Defender for Endpoint), identity (Defender for Identity), email (Defender for Office 365), and cloud apps. In a mature deployment both are used together: Defender XDR for native Microsoft telemetry, Sentinel for everything else plus correlation across the lot.

MDR is the operational service wrapped around detection tooling — 24/7 monitoring, triage, escalation, and response delivered as a service rather than as software. Designing one means choosing the platform (Sentinel + Defender XDR on the Microsoft stack), defining alert tiers and escalation paths, building detection content and runbooks, agreeing SLAs and reporting, and standing up the multi-tenant operations model that makes the economics work across more than one customer.

Moss, Norway. He works for Spirhed Norway across the Nordics, with Norwegian customers as the primary focus. Reachable at [email protected] or via LinkedIn for consulting, speaking, or collaboration inquiries — including remote-friendly engagements across Europe.

For consulting through Spirhed Norway AS, speaking engagements, or collaboration on Håkansson Labs projects, the fastest channel is email at [email protected]. LinkedIn at linkedin.com/in/trym-haakansson works as a secondary route, and the response time on both is typically within one business day.