SOC Triage & Log Analysis
25%
Alert validation, timeline construction, and noise reduction.
Threat Hunting & Detection Engineering
20%
Hypothesis-driven hunts, query logic, and rule tuning.
Incident Response Workflow
20%
Containment, eradication, evidence handling and stakeholder updates.
DFIR Artifact Analysis
20%
Host/network artifacts, persistence traces, and attacker activity reconstruction.
Reporting & Post-Incident Improvement
15%
Actionable incident reports, root-cause and control-improvement roadmap.