• Security operations center (SOC) analysts, threat hunters, and incident responders
• Cybersecurity professionals seeking to validate mid-level skills in threat detection & response
• IT security specialists moving from infrastructure roles toward analysis and defense
• Professionals aiming to take and pass CompTIA CySA+ (CS0-003)

• Fundamental knowledge in networking, operating systems, and cybersecurity (e.g. via Network+, Security+)
• Approximately 3–4 years of experience in information security or related roles is recommended by CompTIA
• Familiarity with monitoring tools, log analysis, and security tools (SIEM, EDR)

• Monitor and analyze security data to detect malicious activities
• Apply threat intelligence and threat-hunting techniques to refine alerting
• Conduct vulnerability scans, interpret results, and prioritize remediation
• Plan and manage incident response efforts following structured methodologies
• Communicate findings, risks, and remediation plans effectively to technical and non-technical stakeholders
• Define and track security KPIs and metrics for vulnerability and incident management
• Leverage automation and integration to improve SOC operational efficiency
• Develop a mindset aligned with continuous security improvement
• Be thoroughly prepared to take and pass CompTIA CySA+ (CS0-003)

• System, network, and infrastructure architecture in security operations
• Log ingestion, time synchronization, data normalization
• Identity & access management, encryption, data protection
• Threat intelligence vs threat hunting
• Analyzing indicators of malicious activity (network, host, application)
• Use of tools & techniques: SIEM, EDR, packet capture, scripting
• Efficiency and process improvement, automation, tool integration

• Vulnerability scanning methods and strategies (internal/external, agent vs agentless, credentialed vs non-credentialed)
• Asset discovery, baseline configuration, security posture scanning
• Analyzing scan output, interpreting findings
• Prioritization of vulnerabilities using CVSS, exploitability, business context
• Controls recommendation and mitigation strategies
• Vulnerability response lifecycle: patching, exception handling, compensating controls

• Incident response frameworks & methodologies (Kill Chain, Diamond Model, MITRE ATT&CK)
• Phases of incident response: preparation, detection & analysis, containment, eradication, recovery, post-incident
• Scenario-based handling of incidents
• Post-incident reviews, lessons learned, process improvements

• Reporting and communicating vulnerabilities: stakeholder reporting, compliance reports
• Incident response communications: escalation, status updates, root cause, lessons learned
• Key performance indicators (KPIs), metrics, dashboards
• Audience awareness: technical vs non-technical stakeholders, action items, remediation plans