### Who you are 2–4 years of experience in security operations, detection engineering, or incident response Experience analyzing logs and tuning alerts within SIEMs, EDR platforms, and cloud security tools Experience writing detections using query languages (e.g., SQL-like, KQL, or similar) Familiar