Monitor and triage security alerts across SIEM, endpoint, email, identity, and cloud platforms. Investigate suspicious activity, analyze phishing and endpoint events, map threats to MITRE ATT&CK, and manage incidents through containment and recovery. Preserve evidence, reconstruct attack timelines, tune detection logic, maintain runbooks, identify automation opportunities, and collaborate on remediation. The role requires flexible availability for evenings, weekends, holidays, and high-severity incidents.

Monitor and investigate security alerts across SIEM, endpoint, identity, email, network, and cloud platforms. Conduct incident response from detection through recovery, including containment, evidence preservation, scoping, and timeline reconstruction. Tune detection logic, reduce false positives, maintain runbooks, identify automation opportunities, and report coverage gaps. Collaborate with security, IT, engineering, and application teams, document investigations, support P1 incidents, and participate in response exercises. The role requires schedule flexibility for evenings, weekends, and holidays.