You are a security analyst at an organization that uses Google Security Operations (SecOps).
Google SecOps triggered a medium severity alert of Unusual Cloud Storage Access - High Volume Download for [email protected] from the internal-project-code-repository bucket. This user is a senior developer within your organization who has legitimate access, but their download volume is unusually high and occurs outside working hours. You need to investigate this alert. What should you do first?