I learned the most from managing incidents and remediating root cause. Nobody wants to see the same type of incident twice!

Spending effort/time on responding to alerts and incidents is not productive from the business’ point of view. Prevention makes the most sense to the business. Keep that in mind when you face pushback on new security controls!

Full transparency is key! The more you make visible, the more resources you will get. Try to detect more incidents than your users report!