Digital Forensics and Incident Response: operational methodologies for incident response, acquisition and preservation of digital evidence, chain of custody, timeline reconstruction, memory forensics, malware analysis, threat containment, and integration with SOC processes, threat hunting, and legal or compliance requirements.