Strong technical depth to step into an active incident independently - reading SIEM queries, evaluating automation workflows, investigating alerts, and assessing case quality with deep expertise in SOC-relevant domains (digital forensics & incident response, threat hunting, cloud security, detection engineering, log analysis, malware analysis, or security automation). Experience developing detections and response playbooks for AI/ML systems, coordinating with product or supply‑chain security teams, and integrating or migrating SIEM/EDR across hybrid multi‑cloud environments, including CSP log sources, MDR partners, and co‑managed detection and response models.