- 01Detection engineering is a distinct discipline. Successful detection engineers come from one of two paths: SOC analysts who picked up engineering rigor, or software engineers who immersed themselves in attacker tradecraft. Both work; both require deliberate investment.
- 02Core skills: fluent reading of attacker tradecraft (ATT&CK, threat reports, blogs), strong query language (your SIEM's, KQL, SQL, Sigma), software engineering basics (version control, testing, code review), data engineering basics (schemas, joins, performance), statistical reasoning (false-positive math, base rates, anomaly detection).
- 03How to develop them: pair-program detections with senior engineers, rotate through SOC investigation roles to build the consumer's intuition, run purple-team exercises monthly, read postmortems voraciously. None of it is reading a course; all of it is craft developed over years.
- 04Career arc: detection engineer → senior detection engineer → staff (architecting content programs across SIEMs and data platforms) → principal (leading detection strategy across multiple business lines or contributing to industry frameworks). Ceiling is high; demand is sustained.
Detection engineering is a distinct discipline. The successful detection engineers we have hired and developed come from one of two paths: SOC analysts who picked up engineering rigor, or software engineers who immersed themselves in attacker tradecraft. Both work; both require deliberate investment.
Core skills
- 01Fluent reading of attacker tradecraft (ATT&CK, threat reports, blogs)
- 02Strong query language — your SIEM's, KQL, SQL, Sigma
- 03Software engineering basics — version control, testing, code review
- 04Data engineering basics — schemas, joins, performance
- 05Statistical reasoning — false-positive math, base rates, anomaly detection
How to develop them
Pair-program detections with senior engineers. Rotate through SOC investigation roles to build the consumer's intuition. Run purple-team exercises monthly. Read postmortems voraciously. None of this is reading a course; all of it is craft developed over years.
What the career looks like
Detection engineer → senior detection engineer → staff (architecting content programs across SIEMs and data platforms) → principal (leading detection strategy across multiple business lines or contributing to industry frameworks). The ceiling is high; the demand is sustained.