Detection Engineer
What the work looks like, the stacks behind the title, what each level means and the training that helps, then how interviews run and how to prepare for each step.
What a detection engineer actually does
An engineer who writes and tunes the rules that detect real attacks, with as few false alarms as possible, and treats them as code.
A detection engineer builds the detections that tell a security team an attack is happening. They write rules in the SIEM and the EDR or XDR tools, often in query languages such as KQL or SPL, and they map them to attacker techniques with MITRE ATT&CK.
They treat detections as code: rules live in Git, get tested and get deployed through pipelines, often in the Sigma format. They tune rules to reduce false positives and automate the response with SOAR tools.
They work closely with threat hunters, incident responders and red teams, for example in purple team exercises.
- Writing a new detection for an attacker technique
- Tuning a rule that creates too many false positives
- Reviewing an incident to find missing detections
- A purple team exercise with the red team
- Automating a response playbook
The same title, very different stacks
Most detection engineering searches are defined first by the tools the team uses, then by the ground every detection engineer shares.
What each level means in practice
Titles vary from one company to the next. What changes from one level to the next is the scope you own and the decisions you take.
- Writes detections with a senior engineer
- Learns the tools, the logs and the attacks
- Tunes rules with review and guidance
- Builds and tunes detections on their own
- Works on incidents and hunting results
- Works directly with SOC and response teams
- Designs detection coverage for a domain
- Takes choices on priorities and tools
- Mentors other engineers and leads reviews
- Sets the detection strategy across the company
- Leads choices on platforms and coverage
- Writes the guidance others build on
The paths into the role, and what really counts
Companies look first at the controls you have put in place and the incidents or findings you handled. In security, some certifications also weigh a lot in hiring.
- Engineering school or master's in cybersecurityThe most common path in France, and often expected by large companies.
- University degree in computer science or securityThe most common path in the US, at bachelor's or master's level.
- SOC analyst firstMany detection engineers start as SOC analysts and move to writing rules.
- Incident response firstIncident responders who like automation also move into the role.
Our view: for this role, certifications help, and detections that caught real threats count even more.
A conversation with a senior tech recruiter
Your first interview is with one of our senior tech recruiters, who knows the role, the stacks and the levels in this guide. The conversation covers your own work through real examples, and the technical exercises come later, with the company. Before the call, we send you the six themes we will cover so you can prepare your examples.
- What you owned yourselfThe detections, rules or playbooks you were responsible for, and your own part in the team's work.
- Your environment and its constraintsLog sources, tools, team size, false positives or rules: what shaped your technical choices.
- The decisions you madeWhich detections first, which data and which level of automation, the options you compared and the reasons for your choice.
- The impact of your workWhat changed thanks to your work, with numbers when you have them: threats caught, false positives removed, coverage or time saved.
- How you work with other teamsYour work with SOC analysts, responders, red teams and IT teams, and how you settle a disagreement.
- What you want nextThe kind of threats, tools and scope you are looking for in your next role.
- Detections that caught real threats
- Fewer false positives
- Automation
The same ground for every candidate. For a given role, every candidate answers the same final questions, built with the hiring manager around what the role really needs.
Ready for the next steps. After our call, we tell you how the company runs its interviews, who you will meet at each step and what each step is meant to assess.
What the company will assess, step by step
Each company runs its own process, and we walk you through its steps before you start. Detection engineering processes often combine the steps below, and the depth expected at each step grows with your level.
- A detection exerciseLog data and an attack to detect, and a rule to write in KQL, SPL or Sigma.
- A hunting or incident scenarioAn attack to investigate step by step, and the detections you would add after.
- A deep dive on your past workOne detection program or project you led, discussed in depth: the context, your choices and the results.
- Meeting the manager and the teamHow you work, how you take decisions with others and what the team expects in your first months.
- ConfirmedYou write a working rule, test it and explain each choice in simple words.
- SeniorYou lead the investigation, think about false positives and coverage, and point out gaps before you are asked.
- Staff and PrincipalYou run most of the interview as a peer, think about the whole detection program and connect it to the risks of the company.
How to prepare as a detection engineer
Practical advice for each step of a detection engineering process, from the way you introduce yourself to the questions you ask at the end of each interview.
Start with the detections and playbooks you worked on, their scale and your part in them. Mention your stack in one sentence, then close with what you want next.
For each one, prepare the context, the constraints, your decision, the options you set aside, the result and what you would change today. Say "we" for the team and "I" for your own part.
Practise queries in KQL or SPL and rules in Sigma, and explain the attack each one detects.
Prepare how your detections cover attacker techniques in MITRE ATT&CK, and where the gaps are.
Prepare the false positive rate of your rules and one rule you tuned, with the result.
Rules on AI coding assistants differ from one company to the next, and sometimes from one step to the next. Ask before each step, and when they are allowed, explain what you ask the tool and how you check its output.
- Walk us through a detection that caught a real attack.
- How do you reduce false positives and keep catching real attacks?
- How would you detect this technique from these logs?
- How do you test a detection before you deploy it?
- Which SIEM and EDR tools does the team use?
- How are detections stored, tested and deployed?
- How do detection, SOC and response teams work together?
- How does the team measure detection coverage?
- Does the team run purple team exercises?
- How does the team use AI coding tools day to day?
Where detection engineers come from, and where they go
The roles people most often hold before this one, and the ones they most often move to.
Most detection engineers start as SOC analysts or incident responders, and some move to threat hunting or head of SecOps roles.