Operational management of cybersecurity incidents: incident response procedures, threat containment, forensic analysis, eradication, and recovery. Includes methodologies, frameworks (NIST, SANS), SIEM/SOAR tools, response playbooks, and coordination with CSIRTs to minimize the impact of attacks, data breaches, and compromises.