Work the alert queue: triage, phishing, web and endpoint investigations, incident response and forensics.
The rest is deciding what to look at first, writing a handover the next shift can actually use, and telling a manager what happened in two sentences without overstating it. Shifts that run well feel boring from the outside. Boring is the goal.