Lead and mature detection and incident response lifecycle, run day-to-day SOC operations, manage on‑call readiness, drive SIEM detections and automation, coordinate cross‑team responses, maintain playbooks and run readiness exercises, mentor analysts, and ensure regulatory and post‑incident improvements.