You are an engineering manager on a security product team. Your backlog includes detection quality improvements, alert latency fixes, onboarding work, and internal tooling, but headcount is fixed and every quarter you need to decide where the next 2 to 3 engineers should spend most of their time. Leadership wants your choices to be driven by metrics, not by the loudest request.