Have led significant security incidents through all phases, including detection, analysis, containment, eradication, recovery, and post‑incident review; maintain and improve incident response playbooks (including ransomware readiness), support required federal and contractual reporting in partnership with Legal, Privacy, and Compliance, orchestrate tabletop and recovery exercises, and participate in on‑call escalation. If you: Can design, build, test, and tune threat-informed detections mapped to the MITRE ATT&CK framework across identity, endpoint, email, network, cloud, and external‑facing applications; govern detections as code; and serve as the technical lead for SIEM migration detection content and log sources.