Perform advanced security monitoring, threat hunting, incident investigation, and triage across endpoint, server, and network environments. Analyze SIEM and endpoint data, identify indicators of attack and compromise, map customer use cases to MITRE ATT&CK, scope incidents, provide recommendations, maintain documentation, and participate in an after-hours incident-controller rotation.