Ideally some experience in the Security Operations field - in both security incident response, and security engineering. Experience with MITRE ATT&CK framework.