• Track emerging threats and assess relevance to AWS environment • Triage external and internal inputs and drive validation and investigation • Translate threat intelligence into actions: containment guidance and prioritized remediation • Lead and execute high-severity security incidents across AWS and endpoints • Drive incidents from initial signal through containment and recovery • Reconstruct attacker activity and produce clear incident documentation • Investigate AWS incidents and lead investigations involving common AWS compromise patterns • Improve detection coverage and partner with detection engineering • Build and maintain investigation and response automation using SOAR tools