Lead complex security investigations and medium- to high-impact incident response as an Incident Commander. Coach junior analysts, conduct post-incident reviews, improve detections and runbooks, and coordinate security initiatives. Build automations and AI-assisted workflows with appropriate guardrails, collaborate with detection engineers, apply threat intelligence, and communicate clearly with customers and internal stakeholders. The role operates in a global follow-the-sun team with shared after-hours on-call responsibilities.

Design, build, and operate production security capabilities for threat detection and response. Develop detection, monitoring, automation, and response workflows across SIEM, SOAR, EDR, and cloud security platforms. Improve detection coverage, control effectiveness, and operational reliability while applying AI safely to security engineering. Lead complex technical initiatives, collaborate across security and engineering teams, and communicate technical risks and trade-offs clearly.

Designs and operates identity and access controls across AWS, GCP, and Azure. Builds Terraform modules, policy guardrails, automation, and internal tooling to enable secure cloud access at scale. Leads technical design discussions, improves reliability, establishes IAM performance metrics, closes identity gaps, and mentors engineers. Collaborates with platform, security, and product teams to integrate secure-by-default controls and improve developer experience.