Monitor, triage, and investigate security alerts across endpoints, network, cloud, and identity. Execute incident response playbooks for analysis, containment, remediation, and reporting. Perform threat hunting, leverage threat intelligence, tune detections with Security Engineering, and support 24/7 on-call rotations and escalation processes. Contribute to playbook and detection improvements.