The Incident Response Team (IRT) should take primary responsibility because the scenario describes an active, complex incident involving lateral movement and likely data exfiltration across sensitive systems, requiring coordinated containment, investigation, and recovery. The SOC often detects and initially triages incidents, but when severity and complexity increase—especially with potential data breach implications—IRT leadership is critical to coordinate cross-functional actions: containment steps, evidence preservation, forensics, remediation, system restoration, stakeholder communications, and regulatory considerations. Threat intelligence supports context (adversary patterns, IoCs/TTPs) but does not run response operations. Security engineering provides remediation support (hardening, patching, segmentation) but typically does not manage incident command and coordination. The SOC continues to support with monitoring, telemetry analysis, and detection tuning, but the IRT is the operational owner for managing the incident lifecycle end-to-end. In mature incident response, the IRT also ensures proper documentation, decision logging, and alignment with legal/compliance requirements—especially important when sensitive customer data and potential breach notification obligations are involved.