• Own detection engineering: SIEM use-cases, data pipelines, parsers, enrichment, and tuning to reduce false positives • Lead threat hunting and purple-team exercises; drive control improvements based on TTPs (ATT&CK) • Architect endpoint and email security baselines; optimize EDR/XDR policies and response automation • Implement and optimize Data Loss Prevention (DLP) technical controls and integrations in alignment with enterprise data protection requirements • Guide vulnerability management strategy (risk-based prioritization, exploitability analysis, compensating controls) • Design partner in network security architectures (micro-segmentation, firewall policies, NDR) and secure remote access (SASE/ZTNA) • Provide key insights for cloud workload protection (CSPM/CWPP/CIEM) and secure identity governance integrations • Perform root-cause analysis and forensics coordination, document findings and corrective actions • Mentor engineers; set coding and automation standards for security tooling and integrations • Drive technology selection, POCs, and reference implementations; maintain technical roadmaps • Track and improve detection quality metrics (e.g., false positives, coverage, MTTR) • Represent security in architecture boards and major program decisions • Develop and maintain security automation and response playbooks in partnership with SOC/MDR providers to improve detection and response efficiency • Familiarity with OT/ICS security considerations in manufacturing environments • Partner with SOC/MDR provider to continuously improve detection coverage and tuning