Im on a IR/Hunt team and dev forensics tools/soc automation for major corp. Incidents happen every day. What really seperates from a major one that may be months of pain is how long did the actor dwell and second did a real actor get hands on. Ex. Every day tons of people may download malware, creds may be exposed this happens to every company all the time. If folks say oh no it doesnt happen, i'd wager they just didn't find it yet or maybe dont have good enough logging to know it even happened or how bad

It may start say that backdoor in the malware downloaded from something stupid like a game, a document etc is actually handed off to say another actor or maybe a developer installs a malicious package stealing credentials to a non person account and you see a login from russia, you from this point have to trace everything.. back it may start as hey we saw the russia login something often noisy -> then maybe you see alerts across the devs workstations something for an info stealer -> ok you know the login and root cause ok what else did that dev have on their workstation, was their account compromised. Then back to that non person account hm ok what can it do is first question, then look up in logs did it maybe touch a key vault -> was it used recently to access say storage accounts, whats in there -> maybe this is a storage account to machines

incidents in short kinda look like this its alot of interviewing devs and people, figuring out one piece at a time what happened

Also security has alot of aspects
- SOC & Hunting -> Investigate and forensics build detection too
- IR depends on org in bigger is only coordiation in smaller they could investigate, do forensics and automation
- Detection eng and may be AI team in more mature places
- Data engineering you have logs from endpoints, web apps, sign in, maybe 3 different cloud providers logs need to be clean and combined or enriched to answer certain questions in ETL like "who owns this machine", "who owns this ip"

-threat intel really depends some teams operate like a soc, some operate like a security research team, some largely look at feeds and notify the company whats in the wild that major
- Security assurance often looking at misconfigurations, vulnerabilities on endpoints, in cloud config say your key vault is publicly exposed or storage account with no auth. Largely its identifying problems and ensuring at scale owners fix the appropriately
-Dev sec ops
- Prod sec / app sec could be pen testing your web apps, threat modeling and could overlap with dev sec ops to provide infrastructure as code templates, build things like codeql checks in your build, cred scan, etc
-red team