Security operations specialist performs real-time analysis and trending of security log data from various security devices and systems. He/she maintains data sources feeding the log monitoring system, develops and maintains detection and alerting rules. He/she responds to user incident reports and evaluates the type and severity of security events. He/she executes initial triage of incidents to rule out false positives. He/she identifies recurring security issues and risks and develops mitigation plans and recommends process improvements. He/she interprets and applies security policies and procedures. He/she establishes escalation processes for security incidents and develops contingency plans and disaster recovery procedures.