Monitor and investigate security alerts across multiple environments in a 24/7 cyber defense operation. Triage incidents, correlate SIEM, EDR, network, cloud, and threat intelligence telemetry, identify root causes, and recommend containment and recovery actions. Develop and tune detection rules, maintain SOC documentation and playbooks, collaborate with threat intelligence, SOAR, and engineering teams, and mentor junior analysts while meeting operational quality standards and SLAs.