Build and operate high-signal detections across cloud, identity, endpoints, and SaaS. Improve detection platforms, automation, and triage tooling (including LLM-based workflows). Translate threat TTPs into telemetry and detections, participate in incident response/on-call, track metrics like MTTD and alert quality, and drive detection engineering improvements across the org.

Build and maintain corporate security controls across identity, endpoints, and SaaS. Harden IAM (Okta, Google Workspace), run endpoint security for a macOS-first fleet, secure AI tool usage, reduce SaaS risk with SSPM and automation, and write Python/Terraform to automate access reviews, onboarding/offboarding, and audit evidence. Partner with Detection & Response and support SOC 2/ISO 27001 compliance and corporate incident response.