Perform digital forensics and incident response across endpoint, identity, network, web, email, and cloud telemetry; build timelines, correlate evidence, determine root cause, and document supportable conclusions. Partner with Security Engineering, Identity and Access Management, Networking, Endpoint, Vulnerability/Patching, Threat Intelligence, and other teams to investigate and remediate threats.