Direct forensic investigations of security incidents, including analysis of cloud audit logs (e.g., Microsoft 365 Unified Audit Log), endpoint and network telemetry, and identity activity, to identify indicators of compromise, establish attack timelines, and determine scope of impact. This role owns the full incident response lifecycle—detection, triage, containment, eradication, recovery, and post-incident review—and is responsible for building a scalable Incident Response function that pairs reactive response capability with proactive detection engineering and threat hunting.