Build and tune detection logic across SIEM, EDR, and cloud telemetry for Robinhood's SecOps team

Describe a detection rule you built or tuned and its measurable impact on false positives

Walk through an incident investigation from alert to containment

How do you correlate telemetry from multiple sources to spot an attack pattern

Tell me about a threat hunt you initiated without a pre-existing alert

What SOAR playbook or automation have you built or improved

How do you write up incident findings for both technical and cross-team audiences