• Detect, analyze, and respond to security incidents, ensuring timely remediation, documentation, and lessons learned. • Develop, tune, and maintain detection logic across SIEM, EDR, IDS, and related platforms to improve visibility and reduce false positives. • Build and maintain SOAR playbooks and scripts to automate alert triage, response actions, and routine operational tasks. • Correlate threat intelligence with internal telemetry to identify emerging risks and inform new detection capabilities. • Operate and enhance monitoring systems to identify potential threats across cloud, endpoint, and network environments. • Support awareness and phishing programs, and deliver clear, actionable reporting and communications on security posture and incidents to leadership. • Develop DLP rules and processes to detect and prevent data loss or misuse across cloud, endpoint, and email systems.