SIEM and SOAR platforms, malware functionality and persistence mechanisms, coding for automation, DevOps toolsets and programming languages, data analysis modeling and correlation, AWS security controls and services, detections, alert enrichment