Detection Engineer

Navigate the ATT&CK matrix, distinguish tactic / technique / sub-technique / procedure, and map real adversary writeups to techniques.

Read raw EVTX, syslog, and JSON cloud audit logs; articulate why ECS/OCSF exist; and map fields across schema standards.

Audit-configure Windows for high-fidelity logging, read Sysmon config XML, and identify which EVTX events catch which TTPs.

Read auditd rules, eBPF traces, and cloud audit logs across AWS, Azure, GCP, and Kubernetes; articulate telemetry trade-offs.

Write equivalent searches across SPL, KQL, and EQL given the same hunt; master aggregation, time-bucketing, and joins.

Apply the Pyramid of Pain to rank detection ideas, fill out an ADS document, and articulate the Funnel of Fidelity.

Author, lint, test, and convert a Sigma rule for a real TTP. Learn the universal detection rule format used across 30+ SIEM platforms.

Reason about precision, recall, robustness to evasion, and analyst burden when designing a detection.

Run an FP-reduction loop on a noisy detection and ship a measurably-improved version with documented precision delta.

Run Atomic Red Team tests, Caldera operations, and Stratus Red Team scenarios; interpret which detections fired and why others did not.

Structure a detection repository with PR-based authoring, automated linting, unit tests, and CI deployment pipelines.

Run a PEAK-framework hunt end-to-end — hypothesis, data, search, finding, and detection back-pressure.

Author cloud-specific detections covering identity attack paths, data exfil, persistence, and SaaS log sources.

Score a detection program against DEBMM and DML, build a coverage report from rule frontmatter, and run a detection engineering retro.

Navigate the full DE interview loop — phone screen, take-home, system design, behavioral, and panel rounds.