Depth in either AWS security telemetry (Security Lake, GuardDuty, Security Hub, CloudTrail, VPC Flow Logs, queried through OpenSearch or Athena) or Microsoft security telemetry (Sentinel, Defender XDR, Defender for Identity, Log Analytics, and KQL), with working familiarity in the other. Build end-to-end collection, parsing, normalization, and routing of security and operational events from Windows and Linux servers, endpoints, network devices, and AWS accounts across every site into a single query layer.