4-8 years of experience in Security Operations, Detection Engineering, or Incident Response Demonstrable hands-on experience with advanced incident response (host, identity, or cloud) Strong expertise in SIEM and detection (e.g., Sumo Logic, Splunk, Sentinel, Elastic, Crowdstrike, Panther, Hunters) Familiarity with MITRE ATT&CK framework and modern attacker tradecraft Experience with automation tools (SOAR platforms, Python, etc.) Familiarity with EDR, identity protection, DLP tools, and modern cloud environments Strong written communication and documentation skills