Develop and maintain high-fidelity detections across identity, endpoint, SIEM, and operating-system environments. Conduct hypothesis-driven threat hunts across large-scale telemetry, translate threat intelligence and investigations into detection rules, tune detection efficacy, investigate ambiguous attacker activity, and escalate likely intrusions with clear incident reports. The role also involves building hunting queries and dashboards, contributing to security content, and validating AI-assisted analysis and detection workflows.

Investigate and respond to cybersecurity alerts and hands-on intrusions in a managed SOC. Analyze EDR and SIEM telemetry, logs, forensic artifacts, malware, Microsoft 365, and Google Workspace activity. Provide remediation guidance, tune detections, support escalations, and collaborate with Product and Engineering teams to improve MDR capabilities and security workflows.