Investigate, triage, and respond to security incidents across hosts, networks, and cloud; perform digital forensics and timeline analysis; manage detection alert queues and MSSP coordination; own incident lifecycle, run after-action reviews, maintain IR documentation, and provide rotating on-call coverage.