Monitors, investigates, and responds to complex security incidents; performs forensic analysis, vulnerability management, and security tool administration. Leads incident containment and recovery, guides Level 1 SOC engineers, documents response activities, produces security reports, improves SOC processes, and participates in rotating on-call support.

Lead and manage day-to-day SOC operations, incident command, queue health, SLA adherence, QA reviews, playbook governance, team coaching, and operational improvements while reporting KPIs and driving SOC maturity.