This role owns advanced detection and response work across endpoint, identity, application and cloud surfaces; leads investigations of escalated alerts; builds automation that removes manual effort from repeatable security tasks; and translates threat intelligence and vulnerability data into prioritized, actionable remediation for platform and application owners. Operate and tune the web application firewall protecting customer-facing and internal web applications and APIs: managed rule sets, custom rules, rate limiting, geo and reputation controls, and bot mitigation.