• Perform triage on security escalations and detections to determine scope, severity, and root cause; monitor cybersecurity events and investigate incidents efficiently. • Identify, recommend, and implement automation use cases leveraging AI/ML capabilities to accelerate response times. • Support the deployment, configuration, testing, and maintenance of the Security Orchestration, Automation, and Response (SOAR) platform, specifically focusing on SentinelOne and Splunk integrations. • Create and modify detection rules, signatures, and alerts across SIEM and EDR platforms (Splunk and SentinelOne) to reduce false positives and enhance fidelity. • Analyze alerts from Cloud, SIEM, EDR, and XDR tools; build and maintain comprehensive dashboards and perform complex queries to support decision-making. • Perform vulnerability assessments of discovered CVEs against agency systems and analyze network traffic to provide actionable security recommendations. • Apply security frameworks such as MITRE ATT&CK and NIST to interpret use cases into actionable monitoring solutions. • Effectively communicate technical findings to non-technical audiences and influence stakeholders to comply with security standards and best practices.