Hands-on experience configuring and operating data flows, including log forwarding, data transformation, API integrations, cost-optimised ingestion and observability pipeline tools, with the ability to work with Platform and Cloud teams when existing integrations need changes. Define the threats and behaviours to detect, then review, tune and validate the high-fidelity detections and correlation logic that identify malicious activity across our environment, delivering measurable improvements in detection coverage and alert quality.