Serve as the primary technical responder for security incidents across the enterprise environment, including IT and OT-adjacent systems.
Lead triage, classification, and prioritization of security incidents; execute containment, eradication, and recovery actions with full documentation.
Perform intermediate to advanced digital forensics - artifact collection, memory and disk analysis, log correlation, timeline reconstruction, and chain of custody handling.
Monitor, analyze, and investigate alerts and events across SIEM, EDR (e.g., SentinelOne), and network monitoring platforms.
Operating systems (Windows/Linux)
Produce detailed technical incident reports and contribute to executive-level post-incident summaries.
Develop and maintain incident response playbooks and response procedures.