• Continuously monitor, triage, and analyze real-time security alerts and log data across disparate platforms. • Serve as the critical operational hinge and escalation pathway between Tier 1/2 SOC analysts and the Incident Response (IR) team. • Execute initial deep-dive log analysis and technical root-cause investigations to reconstruct threat timelines. • Perform proactive behavioral and pattern analysis on historical network and host logs to identify coverage gaps. • Review and update SOC incident response playbooks, internal workflows, and defensive tool tracking mechanisms.

• Take escalations from L1 and perform in-depth investigations: hypothesis-driven analysis, evidence validation, scoping, impact assessment, and timeline building. • Correlate telemetry across endpoint (EDR), Windows/Linux, AD, firewall/proxy/DNS/IDS, and (when applicable) cloud logs. • Recommend and/or coordinate containment actions (host isolation, credential resets, IOC blocks, temporary control changes) following change control and governance. • Determine severity and communicate clearly in English to technical stakeholders; provide concise executive-style updates when required. • Identify detection gaps and drive improvements: reduce false positives, close false negatives, propose new rules/use cases. • Ensure evidence integrity and proper documentation, coordinate handoffs with IR, IT Ops, Network, and Cloud teams. • Produce post-incident deliverables: probable root cause, lessons learned, and preventive actions.

• Monitor security events and alerts in SIEM and defensive tools; perform initial triage and classification (benign / false positive / suspicious / incident). • Collect and review basic evidence: endpoint telemetry, Windows/Linux logs, firewall/IDS, DNS/proxy; perform initial correlation (host/user/IP/IOC/process). • Execute runbooks/playbooks (e.g., password reset request, IOC block request, host isolation request) when authorized and aligned with procedures. • Create and maintain high-quality tickets with a clear narrative: what happened, supporting evidence, potential impact, actions taken, recommended next steps. • Escalate to L2/L3/IR when there is evidence of compromise, material risk, lateral movement, or uncertainty that requires deeper investigation. • Deliver structured shift handovers (case status, findings, hypotheses, next steps, blockers). • Meet operational SLAs and documentation of quality standards.

• Administer and configure AI tools and platforms • Configure and review security settings for AI tools • Own the platform layer for AI context at scale • Monitor AI tool health and support cloud operations • Own AI transformation analytics and reporting • Partner with Engineering and IT for cloud resource deployment • Develop and maintain AI governance documentation.