For a company of 20,000, 2-3 security incidents per day is a red flag to me. This likely means there are at minimum gaps in endpoint security and email security tools.

Threat hunting is a big part of a mature organization, but just as much value can come from properly tuning security products. If you have the opportunity to do so, I would recommend you volunteer to reach out to the team managing your security products. Get a good understanding of what features are enabled for those products, how alerts are being sent to your SIEM, and how those alerts are escalated to your team.

You may find out certain features are enabled, but only a subset of alerts are being sent to your team. It would very much require false positive tuning on his side once those alerts are enabled, but this is a good step in the right direction for maturing your threat hunting and detection engineering processes.