• Serve as the primary implementer for the new SIEM solution, configuring data ingestion and tuning the platform for optimal performance • Own the security observability platform on Grafana (Loki/LogQL, Prometheus/PromQL, Grafana Alerting; OTel for collection), including onboarding sources, parsing, enrichment, and alert routing • Own the "Content Engineering" lifecycle: Write, test, and tune detection rules and queries (LogQL, PromQL, SPL, KQL, SQL, etc.) to identify malicious activity with low false-positive rates • Partner with the Engineering team to ensure the new observability platform captures the right security telemetry and logs • Serve as the primary operator for security monitoring and initial incident triage, participating in the on-call rotation