Lead investigations and incident response using SIEM and SOAR, design detection alerts, perform threat hunting across endpoints, network, application and logs, analyze compromises and malware, build playbooks and security tools, share findings to improve product/security posture, and mentor junior team members.