Working knowledge of security controls: HIDS, EDR. Responding to security events, requests and incidents logged in management systems.