Monitor, triage, and investigate alerts from Security Information and Event Management (SIEM) platforms, Endpoint Detection and Response (EDR) tools, intrusion detection and prevention systems (IDS/IPS), authentication logs, NetFlow, packet capture, cloud-security tools, vulnerability data, and other available security sensors. The analyst uses security telemetry, threat intelligence, established analytic procedures, and operational tools to identify suspicious or malicious activity; investigate potential compromises; document findings; and coordinate response actions with senior analysts, incident responders, cyber engineers, system owners, and mission partners.