Lead and own incident response engagements: manage client communications, set strategy, direct technical workstreams, mentor team members, track budgets/SOWs, ensure timely containment, evidence preservation, log collection, and recovery guidance while identifying upsell opportunities and maintaining SLA deliverables.

Lead technical incident response efforts: support SentinelOne EDR deployment/troubleshooting, forensic collections, infrastructure recovery, backup validation, and remediation. Serve as escalation point, mentor staff, document findings, coordinate with clients and internal teams, and contribute technical details to strategic plans.