• Monitor and triage security alerts from a variety of sources including SIEM (SecOps, Sentinel), EDR (SentinelOne, CrowdStrike) and cloud security platforms like Wiz, Orca. • Serve as a primary responder for security incidents, executing the incident response lifecycle from initial detection and containment to eradication and recovery. • Support development of threat detection library, including incorporating threat intelligence, tuning within security tools, and SOAR response actions. • Maintain and draft SOP’s and supporting documents for the Incident Response Plan and strategy • Analyze phishing attempts, malware, and other cyber threats; partner with Security Engineering to devise additional security controls, administer email security, EDR, ZTNA, and other security tooling configurations to block emerging threats. • Participate in a 24/7 on-call rotation to respond to critical security incidents. • Support triage and response for compliance alerts and requests, enabling the continuous compliance program at BlackCloak using tools such as Vanta, Drata. • Prepare and present detailed incident reports and security metrics to technical and leadership audiences.