Primary responsibilities include: Research attacker tradecraft including intrusion sets, malware families, red team tooling, and emerging Windows TTPs, and translate findings into precise, resilient behavioral detections mapped to MITRE ATT&CK. Expert understanding of modern Windows attack TTPs: initial access, execution, persistence, privilege escalation, credential access, defense evasion, lateral movement, and impact, including how real malware and operators behave on Windows.