Cybersecurity and Information Assurance

The heart of the job is log and network analysis. A strong candidate can sit down in a SIEM (ELK/Kibana, Splunk, Sentinel) and build queries to hunt through noise, reconstruct a timeline, and spot the anomaly — that's the single most important skill, and it's the one your lab centers on. Underneath that they need solid network fundamentals: TCP/IP, subnetting, reading an architecture diagram, and understanding segmentation (DMZ vs. LAN, why the firewalls sit where they do). They should be comfortable administering firewalls — reading logs and writing rules to block malicious traffic, which is likely your lab's success condition. Add endpoint investigation on Windows (event logs, process analysis, spotting a malicious binary), identity/Active Directory work (disabling compromised accounts, understanding credential compromise and lateral movement), and a working knowledge of how ransomware actually behaves: initial access, spread, encryption, ransom notes, and safe recovery from backups. Tying it together is incident-response methodology — ideally someone who thinks in the NIST IR lifecycle (prepare → detect/analyze → contain → eradicate → recover → lessons learned) rather than poking around ad hoc.