Most security teams own a SIEM full of vendor rules that nobody fully understands, and the detection engineer is the person hired to turn that pile into tested, documented detections that analysts trust. The role sits between the SOC, threat intelligence and engineering: it takes knowledge of how attackers behave and converts it into queries, rules and analytics that are versioned, tested and tuned like software. This guide covers what detection engineers do day to day, the skills and tools the job demands, realistic routes in, certifications that test the work, and where the career leads. It is written for SOC analysts and threat hunters planning their next move, software and platform engineers curious about security, and managers creating the role for the first time. Programme design is covered in the Detection Engineering Guide; this page is about the person doing it.
Key takeaways
- Detections are code. The job is writing, reviewing, testing and maintaining rules in version control with the same discipline as application code.
- Telemetry knowledge comes first. You cannot detect what you do not log; knowing which events a technique produces, and whether you collect them, is the core skill.
- Every rule needs a test and a reason. A rule without a documented goal, known false positives and a repeatable validation test is a liability, not coverage.
- The SOC is your customer. Alert quality is measured by what analysts can do with it, so precision and clear triage guidance matter as much as catching the attack.
- Most detection engineers come from the SOC or engineering. Analysts bring attacker intuition, engineers bring automation; the best candidates build the half they are missing.
What the role does
The NICE Framework (NIST SP 800-181 Rev. 1) Defensive Cybersecurity work role includes tasks that describe detection engineering directly: "Develop content for cyber defense tools", "Construct cyber defense network tool signatures", "Validate intrusion detection system alerts" and "Distinguish between benign and potentially malicious cybersecurity attacks and intrusions". In practice the role follows a detection lifecycle:
- Intake: a request from threat intelligence, an incident lesson, a red or purple team finding, or a gap found in ATT&CK coverage.
- Research: how the technique works, for example T1003.001 LSASS Memory, and which data sources and fields show it.
- Telemetry check: confirm the events are collected, parsed and retained, for example Windows event 4688 or Sysmon event 1 for process creation.
- Build: write the rule in the SIEM or EDR language, or in Sigma for portability, with an ATT&CK tag and severity.
- Test: reproduce the behaviour in a lab (for example with Atomic Red Team), confirm the rule fires, then run it against historical production data to measure false positives.
- Document and review: peer review through a pull request, with triage guidance for analysts.
- Deploy and monitor: release through a pipeline, watch alert volume and true positive rate, tune or retire.
Palantir's open Alerting and Detection Strategy (ADS) framework is a widely copied documentation template with nine sections: Goal, Categorization, Strategy Abstract, Technical Context, Blind Spots and Assumptions, False Positives, Validation, Priority and Response. Its rule is that every section is completed before an alert goes into production. Teams that adopt something similar make each detection reviewable and maintainable when its author leaves.
Where detection engineers sit: inside an in-house SOC or a dedicated detection team; at MDR providers and security vendors, writing content shipped to many customers; and in cloud-heavy organisations, close to platform engineering. In small teams the same person often does detection engineering, threat hunting and SIEM administration.
Core skills and tools
| Skill area | What good looks like | How to build it |
|---|---|---|
| Telemetry and logs | Know Windows Security and Sysmon events, Linux audit and auth logs, EDR process telemetry, and cloud audit logs (AWS CloudTrail, Azure activity and sign-in logs) | Generate each event in a lab and find it in your SIEM. See the Sysmon Guide and Windows Event Log Guide |
| Query languages | Fluent in at least one of KQL, SPL or EQL/ES|QL, including joins, time windows, aggregation and baselining | Rewrite five vendor rules from scratch. See the SIEM Guide |
| Rule formats | Write Sigma for log detections, YARA for files and memory, and understand Suricata or Snort signatures for network traffic | Contribute or adapt rules from public repositories. See the YARA Rules Guide |
| Attacker techniques | Explain how a technique works, what it looks like in telemetry and how attackers vary it to evade a narrow rule | Map each lab detection to an ATT&CK technique and list two variations it would miss |
| Engineering practice | Git, pull requests, code review, CI pipelines that lint, convert and test rules before deployment | Keep your lab rules in a repository with automated syntax checks |
| Scripting and data | Python for conversion, enrichment and testing; basic statistics for baselines and anomaly thresholds | Script a test that runs an atomic test and checks the SIEM for the alert |
| Communication | Clear triage guidance, honest coverage reporting, constructive tuning conversations with the SOC | Write ADS-style documentation for every rule you publish |
Sigma in brief: the SigmaHQ project describes Sigma as a "generic and open signature format" and its main repository holds more than 3,000 rules, split into generic, threat hunting, emerging threat, compliance and placeholder rules. A rule is YAML with a title, a logsource (product and service), and a detection block of selections and a condition, plus metadata such as tags, falsepositives and level. The sigma-cli tool, built on pySigma, converts rules through backend plugins and field-mapping pipelines into queries for platforms including Splunk, Elasticsearch, Microsoft Sentinel and Microsoft 365 Defender.
Testing tools: Atomic Red Team is "a library of tests mapped to the MITRE ATT&CK framework", run individually or through Invoke-Atomic. Breach and attack simulation platforms and purple team exercises extend this to full attack chains. See the Breach and Attack Simulation (BAS) Guide and Purple Teaming Guide.
Routes into the role
- From SOC analyst: the most common route. Start by recording noisy rules with data (fire count, true positive rate, missing context), propose tuning, then write new rules for gaps you see. See the SOC Analyst Career Guide.
- From threat hunting or incident response: every successful hunt or incident should end in a detection; owning that conversion is the bridge. See the Threat Hunting Guide.
- From software, data or platform engineering: you already have version control, testing and pipelines; the gap is attacker behaviour and telemetry, which a home lab closes.
- From system administration: deep knowledge of how Windows, Active Directory or cloud platforms behave normally makes abnormal behaviour easier to define.
- Direct entry: rare. Few organisations hire detection engineers without prior SOC, IR or engineering experience; the US BLS notes information security analysts typically need a bachelor's degree and some related work experience.
Portfolio: a public repository of 10 to 20 rules, each with an ATT&CK tag, the test used to validate it, known false positives and ADS-style notes, is the strongest evidence you can show. Add a short write-up on a rule you made more robust after testing an attacker variation. Run attack tests only on systems you own.
Certifications that help
Facts below were checked on the awarding bodies' pages on 24 October 2026. Confirm price and current exam version before booking; the table is descriptive, not a ranking.
| Body | Certification | What it tests | Format |
|---|---|---|---|
| GIAC | Certified Detection Analyst (GCDA) | SIEM overview, log collection and enrichment, endpoint, network and application analytics, AWS and Azure logging, Microsoft Defender and Sentinel overview, log analysis and alerting | 75 questions, 2 hours, 76% to pass for exam versions released from 27 April 2026; associated with SANS SEC555 |
| Microsoft | Security Operations Analyst Associate (SC-200) | Managing a security operations environment, responding to incidents, threat hunting with Microsoft tooling | Renewed every 12 months through a free online assessment |
| GIAC | Cyber Threat Intelligence (GCTI) | Intelligence analysis, kill chain and Diamond Model, pivoting; useful for intelligence-led detection | 82 questions, 3 hours, 71% to pass |
| Platform vendors | SIEM and EDR vendor certifications | Query language and content development on one product | Most valuable when your employer runs that platform |
See the Blue Team Certifications Guide and Microsoft Security Certifications Guide for detail. Hiring managers for this role usually weigh a rule repository and a technical interview (write a query, critique a rule) more heavily than any certificate.
Progression
| Stage | Focus | Signals you are ready to move |
|---|---|---|
| Junior detection engineer | Tuning existing rules, converting public Sigma rules, writing tests | Your rules pass review with few changes and rarely need emergency tuning |
| Detection engineer | Owns coverage for a platform or tactic, writes new analytics, runs purple team validation | Analysts ask you for new detections and trust your triage guidance |
| Senior or principal | Detection architecture, CI pipelines, data source strategy, coverage reporting to leadership, mentoring | You set standards others follow and shape logging decisions |
| Detection lead or manager | Team, roadmap, metrics and budget across SIEM, EDR and cloud | See the Detection Engineering Maturity Model |
Sideways moves: security data engineering (pipelines, schemas, cost control), threat hunting, security automation and SOAR, cloud security engineering, and threat research at a vendor. Detection engineers who understand identity telemetry are well placed for identity threat detection roles.
Pay context: official statistics do not separate detection engineers. The US Bureau of Labor Statistics groups most such roles under information security analysts: median wage of $129,180 in May 2025, about 192,900 jobs in 2025 and projected growth of 21% from 2025 to 2035. Treat this only as context for a broad occupation.
Where identity fits
Valid account abuse (T1078) is one of the hardest things to detect because the attacker signs in rather than breaks in. Detection engineers increasingly write analytics on identity provider sign-in and audit logs: impossible travel, new MFA methods, risky OAuth consents, and service principals, API keys or workload identities used from unusual locations or at unusual volumes. Machine identities have stable behaviour, which makes baselining them one of the more reliable detection opportunities. See the ITDR Guide.
Measuring your work
- Precision per rule: true positive share of alerts, reviewed monthly, with a retirement path for rules that never fire usefully.
- Validated coverage: ATT&CK techniques with at least one detection that has passed a repeatable test in the last quarter, not just mapped.
- Time to detection: from intake request or new threat report to production rule.
- Test pass rate: share of production rules whose validation test still fires after platform or logging changes.
- Analyst effort: median triage time for your rules, a proxy for documentation quality.
Framework mapping
| Framework | Where detection engineering sits |
|---|---|
| NICE Framework (NIST SP 800-181 Rev. 1) | Defensive Cybersecurity work role: developing content for cyber defence tools, constructing signatures, validating alerts |
| NIST CSF 2.0 | DE.CM Continuous Monitoring and DE.AE Adverse Event Analysis, for example DE.AE-02 (potentially adverse events are analysed) |
| NIST SP 800-53 Rev. 5 | SI-4 System Monitoring; AU-6 Audit Record Review, Analysis, and Reporting |
| CIS Controls v8.1 | Control 8 Audit Log Management; Control 13 Network Monitoring and Defense |
| ISO/IEC 27001:2022 Annex A | 8.15 Logging; 8.16 Monitoring activities |
| MITRE ATT&CK | Coverage language, for example T1059.001 PowerShell and T1543.003 Windows Service. See the MITRE ATT&CK Coverage Mapping Guide |
Common failure patterns
- Coverage theatre: colouring an ATT&CK heatmap green because a rule is tagged, without ever testing that it fires.
- Brittle string matching: rules that match one tool name or command line, defeated by a renamed binary or obfuscated argument.
- Silent telemetry loss: a parser change or agent failure stops a log source and rules stop firing with no one noticing; health checks on data sources are part of the job.
- Shipping noise to the SOC: deploying untuned rules and leaving analysts to absorb the false positives.
- Undocumented rules: detections only their author understands, which nobody dares tune or retire after that person leaves.
- Bulk-importing public rules: enabling hundreds of community rules without field mapping or tuning for your environment.
Practitioner checklist
- Build a lab with Windows, Linux, Sysmon and a SIEM, with snapshots for rollback.
- Become fluent in one SIEM query language and learn to read Sigma rules.
- Keep every rule you write in Git with an ATT&CK tag, a test and documented false positives.
- Use an ADS-style template for rule documentation.
- Validate each rule with an Atomic Red Team test or equivalent before calling it coverage.
- Add data source health monitoring for every log your rules depend on.
- Track precision and triage time per rule with the SOC.
- Write at least one identity or cloud detection, not only endpoint ones.
- Choose certifications that match your employer's platform once in role.
Standards and references
- CISA NICCS: NICE Framework, Defensive Cybersecurity work role
- SigmaHQ: Sigma Getting Started
- SigmaHQ: Sigma rule repository
- Palantir: Alerting and Detection Strategy Framework
- Red Canary: Atomic Red Team
- GIAC: Certified Detection Analyst (GCDA)
- Microsoft Learn: Security Operations Analyst Associate
- US Bureau of Labor Statistics: Information Security Analysts
Related NHI Mgmt Group resources: Detection Engineering Guide · SOC Analyst Career Guide · SIEM Guide · SOC Guide · Cybersecurity Careers Guide