Security Analyst
You investigate domains and email. You may not own DNS.
Impersonation mechanics first, then authentication as evidence.
Sequence
Covers
How lookalikes are built and detected, what CT proves, and how to read authentication results.
Does not cover
- Takedown workflow and evidence preservation
- Deploying the controls yourself