A course on intelligence-driven defense and the work of the security operations center. Students learn to collect and apply cyber threat intelligence, engineer detections, hunt for adversary activity, and triage alerts, using frameworks such as MITRE ATT&CK to map and anticipate adversary behavior. Emphasis is placed on graduate-level responsibilities aligned to NICE Protection and Defense and Analyze work roles, including leading detection engineering efforts, defining threat-hunting hypotheses, and improving SOC processes.