Align all simulations to the Citywide Cyber Incident Response lifecycle, including detection, triage, investigation, containment, remediation, and post-incident review. Experience responding to common cyber incidents such as ransomware, phishing, credential compromise, data breaches, and third-party/vendor incidents.