Threat Detection & Response Engineer

Builds and tunes detections across SIEM, EDR and cloud telemetry, and owns the response runbooks that fire when they trigger. This person thinks like an attacker, cuts false positives without losing coverage, and writes up each incident so the next one is faster.