A cloud SOC analyst begins a shift and finds 47 open alerts in the SIEM queue. Among them: (1) an automated alert that a public S3-equivalent bucket containing customer PII was just made world-readable, (2) a failed nightly backup job on a dev workstation, (3) three brute-force login attempts against a decommissioned test account that no longer exists, and (4) a certificate expiration warning for an internal service due in 21 days. Given limited staff and the need to minimize risk, which alert should the analyst investigate and act on FIRST?