"Tell me about a time you were responsible for building a threat detection capability for a newly adopted SaaS tool with limited existing coverage. Walk me through your step-by-step plan, how you prioritized what to detect first, and how you aligned stakeholders when the requirements were still ambiguous."
