Build, tune, version-control, peer-review, and deploy detections across endpoint, identity, SaaS, and cloud environments.Measure detection quality using coverage, precision, and time-to-detect metrics.Own EMEA-hours incident response, including triage, containment, remediation, and retrospectives.Build automation to reduce investigation toil and coordinate incident context across gl