Monitors, investigates, and responds to complex security incidents; performs forensic analysis, vulnerability management, and security tool administration. The role leads incident containment and recovery, mentors Level 1 SOC engineers, documents investigations, produces security reports, improves SOC processes, and participates in rotating on-call support.