Conduct hypothesis-driven threat hunts across customer environments using endpoint, network, identity, and SIEM telemetry; validate advanced threats and escalations; translate findings into durable detection content; integrate threat intelligence; support incident response; document and report findings; contribute to threat hunting program maturity.