NetWitness, Gravwell, Google SecOps, Corelight, forensics (Windows/Linux), including memory, disk, log, and malware analysis, MITRE ATT&CK, adversary TTPs, intrusion kill chain, and threat hunting, • Incident Commander, SLTT, government, or critical infrastructure. Perform host-based forensics, investigate security incidents, analyze threats, coordinate incident response as Incident Commander, and produce executive-level reports.