Monitors SIEM, infrastructure, and cloud applications for security events; triages indicators of compromise; supports incident containment, remediation, and recovery; conducts post-incident reviews and threat hunting; tunes alerts with SIEM engineering; develops SOAR playbooks and automated workflows; collaborates with threat intelligence teams; and prepares threat hunt reports.