• Running detection & response monitor SIEM/EDR telemetry, triage alerts, contain and eradicate threats, then lead root-cause analysis and post-mortems. • Enhancing signal quality by designing correlation searches, refining detection rules, and automating SOAR playbooks to reduce false positives and MTTR. • Analyzing vulnerabilities by extracting findings from platforms like Wiz, Vulcan, Grype, Tenable, and quantifying infrastructure impact to prioritize effectively. • Ensuring remediation governance by generating tickets, assigning owners, enforcing deadlines, and verifying resolutions through rescans and evidence collection thoroughly. • Creating visibility and KPIs by maintaining dashboards tracking vulnerabilities, remediation speed, SLA adherence, MTTR/MTTD, patch age, and risk trends. • Strengthening controls by mapping emerging TTPs to defenses, recommending new detections, and implementing safeguards across cloud, container, and on-prem environments.