Use Story 1 (Defender for Cloud) with the language above:
"Shortly after joining RHS I noticed a visibility gap — Defender for Cloud wasn't onboarded consistently. The proximate cause was inconsistent rollout; the root cause was that there was no policy-based auto-onboarding, so any new VM started outside the security posture. I led the rollout to 100% coverage in 30 days, automated the onboarding policy so new VMs are captured by default, and updated the runbook for re-onboarding stragglers. The preventative action — policy-as-code — means the gap can't reopen without someone explicitly disabling it."
That answer uses: proximate vs root cause, policy-as-code, preventative action, runbook updates, time-bound result. All SRE vocabulary, all grounded in real work.