- Design and operate security operations across cloud, identity, endpoint and SaaS.
- Build pipelines that ingest, normalize and enrich security logs, and monitor pipeline health.
- Select, deploy, configure and tune SIEM, EDR, cloud threat detection and automation tooling.
- Write detections as code, map them to MITRE ATT&CK, and measure and test coverage.
- Own the incident response plan and playbooks, and act as incident commander for security events.
- Coordinate incident containment and recovery across engineering, legal and leadership.
- Run blameless post-incident reviews.
AWSPython