Build, tune, version-control, peer-review, and deploy detections across endpoint, identity, SaaS, and cloud environments.Measure detection coverage, precision, and time-to-detect, including coverage against MITRE ATT&CK.Own incident response from triage through containment, remediation, and retrospective analysis.Build automation to reduce investigation toil and collaborate acro