• Lead security design and threat modeling for new and existing systems (cloud, application, data, network) • Implement and manage core controls: IAM/SSO, least privilege, network segmentation, encryption and key management, secrets management, endpoint and email security • Build and operate detection and response capabilities: SIEM/EDR/SOAR, log pipelines, alert tuning, use-case development, threat hunting • Own vulnerability remediation: scanning, triage, risk-based prioritization, remediation with product/IT teams, tracking to closure • Strengthen application and cloud security: SAST/DAST/SCA, secure SDLC, CI/CD guardrails, IaC scanning, container/Kubernetes runtime protections, CSPM/CIEM • Coordinate and support security testing: internal reviews, penetration tests, red/purple team, tabletop exercises; drive remediation and lessons learned • Lead/participate in incident response: triage, containment, eradication, recovery, forensics, root-cause analysis, post-incident reports and runbooks • Define and maintain security standards, baselines, hardening guides, and architecture diagrams • Monitor and report security metrics, KPIs/KRIs, and risk posture to stakeholders • Support audits and compliance efforts (e.g., SOC 2, ISO 27001, PCI DSS, HIPAA) and align controls to frameworks (NIST CSF, CIS Controls) • Conduct third‑party/vendor security reviews and support contract/security requirements • Drive security awareness initiatives and phishing simulations; mentor engineers on secure practices • Contribute to business continuity and disaster recovery planning and testing • Automate repetitive tasks and integrations to improve scale and reliability