Strong proficiency in investigating and correlating security telemetry across identity, endpoint, network, cloud, and email environments, including (but not limited to) Entra ID sign-in logs, Microsoft 365 audit logs, Windows event logs (including Sysmon), DNS, proxy, VPN, firewall, EDR, and network flow data; capable of identifying credential compromise, privilege escalation, lateral movement, command-and-control activity, persistence mechanisms, and data exfiltration. An Associate's degree in Computer Science, Information Technology, or related field, OR completion of a two (2) year accredited vocational training program in information technology or related field; AND four (4) years of information systems experience in: Microsoft Defender for Endpoint, Identity, Office 365, and Cloud Apps, Attack surface reduction (ASR), device timeline, evidence & response actions, Live response sessions and EDR forensics; OR.