Working knowledge of security controls: HIDS, EDR. Respond to security events, requests and incidents logged in management systems.