Drive functional design decisions for SIR, including alert-to-incident logic, playbooks and flows, Threat Intelligence Security Center (TISC) enrichment, assignment, post-incident reviews, dashboards, and access models, and document via user stories and design documentation. Own the process design & development workstream: current-state assessment, future-state design, response runbooks, severity and escalation models, major incident procedures, RACI, SLAs, and KPIs (e.g., MTTD, MTTR, escalation rate, automation coverage).