Lead and conduct forensic host, network, and application investigations; triage high-stakes incidents; develop scripts and tooling; produce technical and executive reports; guide containment, remediation, rebuild, and recovery; work directly with client IT teams and participate in on-call incident response.