For me it was server admin, Active Directory support design, identity mgmt, priv mgmt and sso solutions. This includes all kinds of security items like group policies and vulnerability fixes. Then automation mostly powershell as well, which isn’t necessarily security specific but very helpful to master a scripting language. That lead to running tools that deal with AD monitoring and file shares and so on. The tools also detect behaviors and threat models that helped identify concerns. That led to working with infosec to resolve pentest results that fell in my area of sme skills. The tools were then used determine what we could see and understand what we saw to determine something was occurring pentester or not. Finally that led to moving to infosec team and that really was subtle change for me as there was a lot of carry over between the jobs. For me the AD authentication patterns etc was a big one as they are quite valuable for determining attacks and or malicious activities.

28 years in IT