{"id":72737,"date":"2026-04-13T03:52:39","date_gmt":"2026-04-13T03:52:39","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/senior-detection-analyst-role-blueprint-responsibilities-skills-kpis-and-career-path\/"},"modified":"2026-04-13T03:52:39","modified_gmt":"2026-04-13T03:52:39","slug":"senior-detection-analyst-role-blueprint-responsibilities-skills-kpis-and-career-path","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/senior-detection-analyst-role-blueprint-responsibilities-skills-kpis-and-career-path\/","title":{"rendered":"Senior Detection Analyst: Role Blueprint, Responsibilities, Skills, KPIs, and Career Path"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">1) Role Summary<\/h2>\n\n\n\n<p>The <strong>Senior Detection Analyst<\/strong> designs, validates, and continuously improves security detections that identify malicious behavior across endpoints, identities, networks, cloud platforms, and applications. This role sits at the intersection of SOC operations, threat intelligence, incident response, and security engineering\u2014turning real-world attacker behaviors into high-fidelity alerts, investigations, and automated response playbooks.<\/p>\n\n\n\n<p>In a software company or IT organization, this role exists because modern environments generate vast telemetry and attackers change tactics quickly; without dedicated detection capability, the organization experiences delayed detection, high false-positive alert fatigue, and inconsistent investigative quality. The Senior Detection Analyst creates business value by reducing time-to-detect, increasing confidence in alerts, improving incident outcomes, and enabling scalable operations through detection-as-code and workflow automation.<\/p>\n\n\n\n<p>This is a <strong>Current<\/strong> (not speculative) role commonly found in SOCs, Detection &amp; Response teams, and Security Operations Engineering functions. Typical interaction points include: SOC analysts, incident responders, threat intel, security engineers, cloud platform teams, IT operations, IAM, application engineering, and compliance\/risk teams.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">2) Role Mission<\/h2>\n\n\n\n<p><strong>Core mission:<\/strong><br\/>\nBuild and maintain a detection capability that reliably identifies high-risk attacker behaviors with minimal noise, enabling fast, consistent, and evidence-based response across the enterprise.<\/p>\n\n\n\n<p><strong>Strategic importance:<\/strong><br\/>\nSecurity programs increasingly succeed or fail based on detection quality\u2014how quickly and accurately the organization can recognize compromise, contain it, and learn from it. The Senior Detection Analyst operationalizes threat knowledge into defensible, measurable detection coverage aligned to business-critical assets and current adversary behaviors.<\/p>\n\n\n\n<p><strong>Primary business outcomes expected:<\/strong>\n&#8211; Reduce exposure time by improving <strong>mean time to detect (MTTD)<\/strong> and <strong>time-to-triage<\/strong>.\n&#8211; Improve SOC efficiency by reducing <strong>false positives<\/strong>, duplicate alerts, and unclear investigations.\n&#8211; Increase enterprise resilience by ensuring detections cover prioritized threats (mapped to <strong>MITRE ATT&amp;CK<\/strong> or equivalent).\n&#8211; Improve incident outcomes by feeding back post-incident learnings into detection content and response workflows.\n&#8211; Enable audit-ready security operations through documented logic, change control, and measurable coverage.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">3) Core Responsibilities<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Strategic responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Detection strategy and coverage planning:<\/strong> Define a detection roadmap aligned to business risks, crown jewels, and current threat landscape; prioritize based on likelihood, impact, and telemetry availability.<\/li>\n<li><strong>Threat-informed defense mapping:<\/strong> Maintain detection coverage mapped to ATT&amp;CK techniques, identity attack paths, cloud threats, and software supply chain risks relevant to the organization.<\/li>\n<li><strong>Detection lifecycle ownership (content program):<\/strong> Establish and run a lifecycle for detection ideation, development, testing, deployment, tuning, deprecation, and documentation.<\/li>\n<li><strong>Telemetry readiness and gaps:<\/strong> Partner with engineering and platform teams to identify logging\/telemetry gaps and define requirements for new data sources and retention.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Operational responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"5\">\n<li><strong>Alert triage escalation quality:<\/strong> Act as a senior escalation point for ambiguous or high-impact alerts; ensure investigations are consistent, evidence-based, and defensible.<\/li>\n<li><strong>Tuning and noise reduction:<\/strong> Continuously refine detections to reduce false positives and improve precision without sacrificing meaningful coverage.<\/li>\n<li><strong>Threat hunting support:<\/strong> Lead or significantly contribute to hunts based on hypotheses, intel, and anomalous patterns; convert hunt findings into detections.<\/li>\n<li><strong>Post-incident detection improvements:<\/strong> Perform detection retrospectives after incidents and near misses; implement detection and response improvements with measurable outcomes.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Technical responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"9\">\n<li><strong>Detection engineering (query development):<\/strong> Write and maintain detection logic in SIEM\/EDR query languages (e.g., SPL\/KQL), Sigma-like abstractions, and rule formats for relevant platforms.<\/li>\n<li><strong>Behavior analytics and correlation:<\/strong> Develop multi-signal detections that correlate identity, endpoint, network, and cloud telemetry to reduce false positives and increase confidence.<\/li>\n<li><strong>SOAR\/workflow enhancement:<\/strong> Collaborate on automation steps (enrichment, containment suggestions, ticket creation) and ensure playbooks support consistent investigations.<\/li>\n<li><strong>Data validation and QA:<\/strong> Test detection logic against representative datasets; validate fields, parsing, normalization, and edge cases before production deployment.<\/li>\n<li><strong>Detection documentation and runbooks:<\/strong> Create investigation steps, expected evidence, triage criteria, containment suggestions, and response handoffs for each detection.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Cross-functional or stakeholder responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"14\">\n<li><strong>Collaboration with Incident Response (IR):<\/strong> Ensure detections align with IR needs, support rapid scoping, and generate actionable artifacts (queries, timelines, IoCs, affected assets).<\/li>\n<li><strong>Partnership with platform\/app teams:<\/strong> Coordinate logging changes, agent deployments, cloud audit enablement, and parser\/normalization improvements.<\/li>\n<li><strong>Threat intelligence operationalization:<\/strong> Turn strategic and tactical intel (campaigns, TTPs, actor profiles) into concrete detection content and hunt plans.<\/li>\n<li><strong>Security awareness and IT operations alignment:<\/strong> Provide feedback loops for recurring issues (e.g., misconfigurations causing alerts, risky admin behaviors) and help remediate root causes.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Governance, compliance, or quality responsibilities<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"18\">\n<li><strong>Change control and auditability:<\/strong> Maintain versioning, approvals, and documentation for detection content; support evidence requests for audits (SOC2\/ISO 27001 or similar where applicable).<\/li>\n<li><strong>Metrics and reporting:<\/strong> Produce regular reporting on detection efficacy, coverage, alert quality, and operational impact.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Leadership responsibilities (Senior IC scope)<\/h3>\n\n\n\n<ol class=\"wp-block-list\" start=\"20\">\n<li><strong>Mentorship and standards:<\/strong> Mentor analysts and junior detection engineers on investigation quality, query writing, ATT&amp;CK mapping, and documentation standards; drive consistent best practices across the program.<\/li>\n<\/ol>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">4) Day-to-Day Activities<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Daily activities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Review high-severity alerts and escalations; validate whether detections behaved as intended.<\/li>\n<li>Perform alert tuning: adjust thresholds, add allowlists\/suppressions with justification, refine correlation logic.<\/li>\n<li>Write or refine SIEM\/EDR queries; validate parsing\/field extraction; confirm expected results.<\/li>\n<li>Investigate emerging threat intel items and assess detection opportunities (e.g., new credential theft or cloud persistence methods).<\/li>\n<li>Respond to SOC questions on alert meaning, triage steps, and evidence collection.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Weekly activities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Conduct detection backlog grooming and prioritization with SOC\/IR leadership.<\/li>\n<li>Run one or more focused threat hunts aligned to current risks (identity abuse, cloud control plane, endpoint persistence).<\/li>\n<li>Hold working sessions with engineering\/platform teams to address logging gaps or telemetry quality issues.<\/li>\n<li>Review false-positive\/false-negative examples; incorporate learnings into detection improvements.<\/li>\n<li>Publish detection program updates (new detections, tuned detections, deprecations, and impact metrics).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Monthly or quarterly activities<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Complete a formal detection coverage review mapped to ATT&amp;CK and top risks; identify gaps and create initiatives.<\/li>\n<li>Execute tabletop or purple-team exercises; validate detections against simulated attacker behaviors.<\/li>\n<li>Conduct quarterly detection rule audits (ownership, documentation completeness, performance, cost impact, and efficacy).<\/li>\n<li>Refresh runbooks and playbooks based on recent incidents and operational feedback.<\/li>\n<li>Deliver a metrics review to security leadership (coverage, alert quality, MTTD trends, improvement ROI).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Recurring meetings or rituals<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SOC daily\/shift handoff (as an escalation resource rather than primary owner).<\/li>\n<li>Weekly Detection Program Standup (priorities, blockers, deployments).<\/li>\n<li>Incident Review \/ Postmortem (focus on detection and telemetry learnings).<\/li>\n<li>Threat Intel Sync (translate intel into action items).<\/li>\n<li>Platform Logging Council (data onboarding, schema\/normalization decisions).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Incident, escalation, or emergency work<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Participate in major incident bridges as the detection\/telemetry subject matter expert:<\/li>\n<li>Provide scoping queries, pivot paths, and event timelines.<\/li>\n<li>Rapidly create \u201chotfix\u201d detections for active threats (with controlled risk and follow-up QA).<\/li>\n<li>Support emergency telemetry enablement (e.g., cloud audit log activation, EDR policy pushes) coordinated with platform owners.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">5) Key Deliverables<\/h2>\n\n\n\n<p>Concrete outputs expected from a Senior Detection Analyst include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Detection Catalog \/ Library<\/strong><\/li>\n<li>Inventory of detections with IDs, owners, severity, data sources, ATT&amp;CK mapping, and last-reviewed date.<\/li>\n<li><strong>Detection Rules and Queries<\/strong><\/li>\n<li>SIEM correlation searches, scheduled analytics, EDR detections, cloud-native detections.<\/li>\n<li><strong>Detection-as-Code Artifacts (where applicable)<\/strong><\/li>\n<li>Version-controlled rule definitions, tests, CI checks, release notes (common in mature orgs).<\/li>\n<li><strong>Alert Runbooks<\/strong><\/li>\n<li>Step-by-step investigation guides, evidence collection, pivot queries, and escalation criteria.<\/li>\n<li><strong>SOAR Playbook Requirements and Enhancements<\/strong><\/li>\n<li>Enrichment steps, ticket routing, auto-tagging, and response recommendations.<\/li>\n<li><strong>Tuning Reports<\/strong><\/li>\n<li>False-positive analysis, suppressions with rationale, threshold changes, and measured outcomes.<\/li>\n<li><strong>Telemetry Gap Assessments<\/strong><\/li>\n<li>Requirements for new logs, schema changes, parsing improvements, and retention adjustments.<\/li>\n<li><strong>Hunt Plans and Hunt Reports<\/strong><\/li>\n<li>Hypotheses, data sources, queries used, findings, and follow-up detection actions.<\/li>\n<li><strong>Post-Incident Detection Improvement Plans<\/strong><\/li>\n<li>Action items from incidents: new detections, modifications, additional logging, and verification steps.<\/li>\n<li><strong>Dashboards and Metrics Packs<\/strong><\/li>\n<li>Coverage metrics, efficacy trends, alert volumes, triage times, and high-noise sources.<\/li>\n<li><strong>Knowledge Base Articles<\/strong><\/li>\n<li>Common investigation patterns, attacker tradecraft notes, and internal detection standards.<\/li>\n<li><strong>Training Artifacts<\/strong><\/li>\n<li>Query-writing guides, ATT&amp;CK mapping patterns, investigation walkthroughs for SOC analysts.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">6) Goals, Objectives, and Milestones<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">30-day goals (initial immersion and baseline)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Understand business context: core products\/services, crown-jewel systems, and most critical threat scenarios.<\/li>\n<li>Gain access to SIEM\/EDR\/cloud logging platforms; validate working knowledge of data schemas and key log sources.<\/li>\n<li>Review top 20 noisy alerts and top 20 highest-impact alerts; propose initial tuning plan.<\/li>\n<li>Establish relationships with SOC, IR, threat intel, IAM, cloud\/platform teams.<\/li>\n<li>Deliver a \u201ccurrent state\u201d assessment:<\/li>\n<li>Detection lifecycle maturity<\/li>\n<li>Coverage gaps (high-level)<\/li>\n<li>Top telemetry quality issues<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">60-day goals (measurable improvements and program traction)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Deploy improvements to high-noise detections with documented before\/after metrics.<\/li>\n<li>Deliver 3\u20136 new or significantly improved detections aligned to current risks (identity abuse, cloud persistence, endpoint credential theft\u2014tailored to the org).<\/li>\n<li>Produce standardized runbook templates and update documentation for priority detections.<\/li>\n<li>Implement a basic QA\/checklist process for new detection deployments (testing, peer review, approval, rollback plan).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">90-day goals (repeatable operating model)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Establish a functioning detection lifecycle with:<\/li>\n<li>intake \u2192 prioritization \u2192 development \u2192 testing \u2192 deployment \u2192 tuning \u2192 review cadence<\/li>\n<li>Demonstrate coverage mapping to ATT&amp;CK for top threat scenarios and create a prioritized gap-remediation backlog.<\/li>\n<li>Reduce measurable noise in the SOC (example: reduce top-5 alert sources by 20\u201340% without loss of true positives).<\/li>\n<li>Deliver a quarterly detection effectiveness report with trends and recommendations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6-month milestones (scale and resilience)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Mature detection engineering practices:<\/li>\n<li>version control for detections (where feasible)<\/li>\n<li>consistent naming, tagging, and ownership<\/li>\n<li>minimum documentation standards met for \u226590% of high\/critical detections<\/li>\n<li>Implement correlation detections combining identity + endpoint + cloud signals for top attack paths.<\/li>\n<li>Establish purple-team validation for a recurring subset of detections (e.g., monthly simulations).<\/li>\n<li>Improve response readiness by integrating SOAR enrichments for high-volume alerts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">12-month objectives (program-level outcomes)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Demonstrably improve detection efficacy and operational outcomes:<\/li>\n<li>Reduced MTTD for key incident types<\/li>\n<li>Improved true-positive rate for critical detections<\/li>\n<li>Reduced repeat incidents due to \u201clessons learned\u201d being codified into detections and telemetry<\/li>\n<li>Build a sustained detection roadmap aligned to evolving threats and business changes (new cloud migrations, new products, acquisitions).<\/li>\n<li>Enable audit-ready detection governance (ownership, review cycles, change history) for regulated or customer-assured contexts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Long-term impact goals (enterprise value creation)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create a detection capability that is:<\/li>\n<li><strong>Threat-informed<\/strong> (grounded in real attacker behaviors)<\/li>\n<li><strong>Measurable<\/strong> (coverage and efficacy tracked)<\/li>\n<li><strong>Scalable<\/strong> (automation and documentation reduce reliance on heroics)<\/li>\n<li><strong>Adaptive<\/strong> (fast iteration during active threats)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Role success definition<\/h3>\n\n\n\n<p>Success is measured by the organization\u2019s ability to detect and respond to threats quickly and confidently, with fewer wasted cycles. The Senior Detection Analyst is successful when detections are trusted, well-documented, validated, and continuously improved based on evidence.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What high performance looks like<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Produces high-signal detections that materially reduce risk and improve response outcomes.<\/li>\n<li>Creates clarity and repeatability: runbooks, standardized logic, and measurable performance.<\/li>\n<li>Acts as a force multiplier: mentoring others, improving telemetry quality, and improving cross-team collaboration.<\/li>\n<li>Balances speed with rigor: can ship emergency detections responsibly and follow up with robust testing and tuning.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">7) KPIs and Productivity Metrics<\/h2>\n\n\n\n<p>The metrics below are designed to be measurable, operationally meaningful, and adaptable across SIEM\/EDR\/SOAR implementations.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Metric name<\/th>\n<th>What it measures<\/th>\n<th>Why it matters<\/th>\n<th>Example target \/ benchmark<\/th>\n<th>Frequency<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Detection True Positive Rate (TPR)<\/td>\n<td>% of alerts that represent confirmed malicious or policy-violating activity<\/td>\n<td>Indicates detection precision and SOC trust<\/td>\n<td>Varies by use case; critical detections often target &gt;30\u201360% confirmed signal (context-dependent)<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>False Positive Rate (FPR)<\/td>\n<td>% of alerts closed as benign\/no action<\/td>\n<td>Quantifies noise and wasted effort<\/td>\n<td>Reduce top noisy detections by 20\u201340% in 90 days; long-term stable downward trend<\/td>\n<td>Weekly\/Monthly<\/td>\n<\/tr>\n<tr>\n<td>Alert-to-Incident Conversion Rate<\/td>\n<td>% of alerts that become incidents<\/td>\n<td>Helps calibrate severity and triage quality<\/td>\n<td>Not \u201cmaximize\u201d; aim for consistent mapping and appropriate severity<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Mean Time to Triage (MTTT)<\/td>\n<td>Time from alert firing to initial analyst disposition<\/td>\n<td>Indicates SOC responsiveness and clarity of alert\/runbook<\/td>\n<td>Critical alerts: minutes to &lt;1 hour (org-dependent)<\/td>\n<td>Weekly<\/td>\n<\/tr>\n<tr>\n<td>Mean Time to Detect (MTTD) by incident type<\/td>\n<td>Time from attacker activity start (estimated) to detection<\/td>\n<td>Core security outcome metric<\/td>\n<td>Continuous improvement; target reductions quarter over quarter<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Detection Coverage (ATT&amp;CK mapped)<\/td>\n<td>% of prioritized techniques with at least one validated detection<\/td>\n<td>Measures completeness against threat model<\/td>\n<td>Example: 70% coverage for prioritized technique set within 12 months<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Detection Validation Rate<\/td>\n<td>% of critical\/high detections tested via simulation\/purple-team in a period<\/td>\n<td>Ensures detections actually work<\/td>\n<td>Example: validate top 25 detections quarterly<\/td>\n<td>Monthly\/Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Rule Review Compliance<\/td>\n<td>% of detections reviewed within defined SLA (e.g., 180 days)<\/td>\n<td>Prevents stale detections and documentation drift<\/td>\n<td>\u226590% on-time reviews<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Detection Deployment Lead Time<\/td>\n<td>Time from request\/idea to production deployment<\/td>\n<td>Measures agility of detection program<\/td>\n<td>Example: &lt;2\u20134 weeks for standard detections; &lt;24\u201372 hours for urgent threats<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Detection Rollback \/ Defect Rate<\/td>\n<td>% of detection releases needing rollback or major fix<\/td>\n<td>Measures quality of testing and change control<\/td>\n<td>Keep low; e.g., &lt;5% needing rollback<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>SOC Analyst Satisfaction (Detection Content)<\/td>\n<td>Analyst feedback on usefulness\/clarity of alerts and runbooks<\/td>\n<td>Ensures deliverables are usable<\/td>\n<td>Example: &gt;4\/5 average satisfaction for priority detections<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Investigation Consistency Score<\/td>\n<td>% of sampled cases meeting documentation\/evidence standards<\/td>\n<td>Improves defensibility and learning<\/td>\n<td>Example: \u226585% for sampled critical alerts<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Telemetry Completeness for Priority Sources<\/td>\n<td>Coverage\/availability of key logs (identity, cloud audit, endpoint)<\/td>\n<td>Detections fail without reliable data<\/td>\n<td>Example: \u226599% ingestion health for critical sources<\/td>\n<td>Weekly<\/td>\n<\/tr>\n<tr>\n<td>Cost Efficiency (SIEM query cost \/ ingestion impact)<\/td>\n<td>Impact of detections on platform performance\/cost<\/td>\n<td>Prevents \u201cexpensive detections\u201d from harming operations<\/td>\n<td>Optimize top costly queries quarterly<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Automation Enablement Rate<\/td>\n<td>% of priority alerts with enrichment\/automation steps defined<\/td>\n<td>Improves speed and reduces toil<\/td>\n<td>Example: 60% of high-volume alerts enriched via SOAR<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<tr>\n<td>Knowledge Artifact Velocity<\/td>\n<td>Number\/quality of runbooks, docs, and reusable queries created<\/td>\n<td>Measures scalable enablement<\/td>\n<td>Target: steady pipeline; quality &gt; quantity<\/td>\n<td>Monthly<\/td>\n<\/tr>\n<tr>\n<td>Cross-team Delivery Reliability<\/td>\n<td>On-time completion of detection roadmap commitments<\/td>\n<td>Demonstrates program predictability<\/td>\n<td>Example: 80\u201390% of committed items delivered per quarter<\/td>\n<td>Quarterly<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<p><strong>Notes on variability:<\/strong> Targets vary significantly by maturity, industry, alert volumes, and telemetry. For example, early-stage SOCs prioritize foundational telemetry and triage; mature SOCs prioritize validation coverage, correlation detections, and automation.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">8) Technical Skills Required<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Must-have technical skills<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SIEM query development (Critical)<\/strong> <\/li>\n<li>Description: Write, optimize, and troubleshoot detection logic in at least one major SIEM query language (e.g., Splunk SPL, Microsoft Sentinel KQL).  <\/li>\n<li>Use: Building detections, scoping incidents, building dashboards, tuning.  <\/li>\n<li><strong>Endpoint and identity telemetry interpretation (Critical)<\/strong> <\/li>\n<li>Description: Understand process trees, authentication flows, token usage, privilege escalation indicators.  <\/li>\n<li>Use: Detecting credential theft, lateral movement, persistence, and admin abuse.  <\/li>\n<li><strong>Detection tuning and alert quality management (Critical)<\/strong> <\/li>\n<li>Description: Reduce false positives through thresholds, context enrichment, allowlisting strategy, and improved logic.  <\/li>\n<li>Use: Keeping SOC workable and alerts trustworthy.  <\/li>\n<li><strong>MITRE ATT&amp;CK mapping and threat behavior understanding (Critical)<\/strong> <\/li>\n<li>Description: Translate adversary techniques into detection hypotheses and coverage metrics.  <\/li>\n<li>Use: Roadmapping and communicating detection gaps.  <\/li>\n<li><strong>Incident investigation fundamentals (Important)<\/strong> <\/li>\n<li>Description: Evidence collection, timeline creation, scoping, and containment recommendations.  <\/li>\n<li>Use: Supporting IR and validating detection outcomes.  <\/li>\n<li><strong>Log source knowledge and data quality validation (Important)<\/strong> <\/li>\n<li>Description: Understand common log sources (EDR, IdP, cloud audit, DNS, proxy) and typical failure modes.  <\/li>\n<li>Use: Ensuring detections rely on reliable data.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Good-to-have technical skills<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SOAR concepts and playbook design (Important)<\/strong> <\/li>\n<li>Use: Enrichment, routing, and standardized responses for repeatable operations.  <\/li>\n<li><strong>Cloud security telemetry (AWS\/Azure\/GCP) (Important)<\/strong> <\/li>\n<li>Use: Detecting cloud control plane abuse, risky IAM changes, and suspicious workload behavior.  <\/li>\n<li><strong>Network security analytics basics (Optional to Important depending on org)<\/strong> <\/li>\n<li>Use: Lateral movement detection, DNS anomalies, proxy patterns, C2 indicators.  <\/li>\n<li><strong>Threat intelligence operationalization (Important)<\/strong> <\/li>\n<li>Use: Turning intel into detections\/hunts and validating relevance to environment.  <\/li>\n<li><strong>Basic scripting (Python\/PowerShell) (Optional to Important)<\/strong> <\/li>\n<li>Use: Parsing artifacts, enrichment, testing, small automation helpers.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Advanced or expert-level technical skills<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Behavioral detections and multi-signal correlation (Critical for senior performance)<\/strong> <\/li>\n<li>Description: Combine identity + endpoint + cloud + network signals to reduce noise and improve confidence.  <\/li>\n<li>Use: Building durable detections resilient to simple IoC evasion.  <\/li>\n<li><strong>Detection-as-code and version control workflows (Important in mature orgs)<\/strong> <\/li>\n<li>Description: PR-based changes, code review, unit tests, CI checks for detection content.  <\/li>\n<li>Use: Scaling detection development with quality and auditability.  <\/li>\n<li><strong>Adversary emulation \/ purple-team validation (Important)<\/strong> <\/li>\n<li>Description: Use simulation frameworks and controlled testing to validate detections.  <\/li>\n<li>Use: Ensuring detections work and are not theoretical.  <\/li>\n<li><strong>Data modeling and normalization (Optional to Important)<\/strong> <\/li>\n<li>Description: Common Information Model (CIM), ASIM, ECS patterns; field mapping.  <\/li>\n<li>Use: Making detections portable and reliable across sources.  <\/li>\n<li><strong>Advanced hunting and anomaly detection methods (Optional)<\/strong> <\/li>\n<li>Description: Statistical baselines, peer-group analysis, outlier detection.  <\/li>\n<li>Use: Detecting novel behaviors when signatures fail.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Emerging future skills for this role (next 2\u20135 years)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>LLM-assisted detection development and triage augmentation (Important)<\/strong> <\/li>\n<li>Use: Faster hypothesis generation, query drafting, runbook summarization\u2014paired with strong validation.  <\/li>\n<li><strong>Security data lake analytics (Important)<\/strong> <\/li>\n<li>Use: Detection across high-volume telemetry with flexible schemas and scalable compute.  <\/li>\n<li><strong>Continuous validation engineering (Important)<\/strong> <\/li>\n<li>Use: Automated attack simulation and detection tests tied to CI\/CD-like pipelines.  <\/li>\n<li><strong>Identity-centric detection specialization (Important)<\/strong> <\/li>\n<li>Use: As identity becomes the control plane, detections increasingly focus on token theft, MFA fatigue, OAuth abuse, and privilege pathways.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">9) Soft Skills and Behavioral Capabilities<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Analytical rigor and hypothesis-driven thinking<\/strong> <\/li>\n<li>Why it matters: Detection quality depends on precise reasoning under uncertainty and noisy data.  <\/li>\n<li>On the job: Formulates hypotheses, tests against telemetry, and adjusts logic based on evidence.  <\/li>\n<li>\n<p>Strong performance: Produces defensible conclusions and avoids \u201cintuition-only\u201d detections.<\/p>\n<\/li>\n<li>\n<p><strong>Operational judgment (balancing speed vs. risk)<\/strong> <\/p>\n<\/li>\n<li>Why it matters: Emergency detections may be needed during active threats, but sloppy rules can overwhelm SOC or miss real attacks.  <\/li>\n<li>On the job: Ships pragmatic improvements fast, with rollback plans and follow-up QA.  <\/li>\n<li>\n<p>Strong performance: Maintains stability while improving security outcomes.<\/p>\n<\/li>\n<li>\n<p><strong>Technical communication (clarity for analysts and leaders)<\/strong> <\/p>\n<\/li>\n<li>Why it matters: Alerts and runbooks are only effective if others can act on them quickly.  <\/li>\n<li>On the job: Writes concise runbooks, explains tradeoffs, and communicates detection intent.  <\/li>\n<li>\n<p>Strong performance: Others can operate the detection confidently without the author present.<\/p>\n<\/li>\n<li>\n<p><strong>Stakeholder management and influence without authority<\/strong> <\/p>\n<\/li>\n<li>Why it matters: Detection depends on telemetry controlled by other teams (cloud, IAM, endpoints).  <\/li>\n<li>On the job: Negotiates logging changes, prioritizes requests, and aligns on shared outcomes.  <\/li>\n<li>\n<p>Strong performance: Gains commitments and delivers improvements without escalation-heavy approaches.<\/p>\n<\/li>\n<li>\n<p><strong>Curiosity and continuous learning<\/strong> <\/p>\n<\/li>\n<li>Why it matters: Adversary tradecraft evolves; detections must evolve too.  <\/li>\n<li>On the job: Tracks emerging techniques, tests assumptions, and refreshes content.  <\/li>\n<li>\n<p>Strong performance: Keeps detection coverage relevant and avoids stagnation.<\/p>\n<\/li>\n<li>\n<p><strong>Coaching and mentorship mindset (Senior IC)<\/strong> <\/p>\n<\/li>\n<li>Why it matters: A strong detection program scales through shared standards and improved analyst capability.  <\/li>\n<li>On the job: Reviews queries, provides constructive feedback, and creates reusable templates.  <\/li>\n<li>\n<p>Strong performance: The broader team improves measurably (quality, speed, consistency).<\/p>\n<\/li>\n<li>\n<p><strong>Bias for documentation and repeatability<\/strong> <\/p>\n<\/li>\n<li>Why it matters: Institutional knowledge must survive staff changes and high-pressure incidents.  <\/li>\n<li>On the job: Documents logic, assumptions, and expected evidence; keeps artifacts current.  <\/li>\n<li>\n<p>Strong performance: Reduced single points of failure and improved audit readiness.<\/p>\n<\/li>\n<li>\n<p><strong>Resilience under pressure<\/strong> <\/p>\n<\/li>\n<li>Why it matters: Detection work often spikes during incidents and high-profile vulnerabilities.  <\/li>\n<li>On the job: Maintains focus and prioritization during ambiguous or urgent situations.  <\/li>\n<li>Strong performance: Calm execution with clear next steps and transparent communication.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">10) Tools, Platforms, and Software<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Tool \/ platform<\/th>\n<th>Primary use<\/th>\n<th>Common \/ Optional \/ Context-specific<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>SIEM<\/td>\n<td>Splunk Enterprise Security<\/td>\n<td>Detection queries, correlation, dashboards, investigations<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>SIEM<\/td>\n<td>Microsoft Sentinel<\/td>\n<td>Analytics rules (KQL), incidents, workbooks<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>SIEM<\/td>\n<td>Google Chronicle \/ SecOps<\/td>\n<td>Large-scale detection and search<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>EDR\/XDR<\/td>\n<td>CrowdStrike Falcon<\/td>\n<td>Endpoint telemetry, detections, response actions<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>EDR\/XDR<\/td>\n<td>Microsoft Defender for Endpoint<\/td>\n<td>Endpoint detection\/response and telemetry<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>EDR\/XDR<\/td>\n<td>SentinelOne<\/td>\n<td>Endpoint detection and response<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Cloud platforms<\/td>\n<td>AWS (CloudTrail, GuardDuty)<\/td>\n<td>Cloud audit telemetry and findings<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Cloud platforms<\/td>\n<td>Azure (Activity Logs, Entra ID logs)<\/td>\n<td>Identity and cloud control-plane telemetry<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Cloud platforms<\/td>\n<td>GCP (Cloud Audit Logs)<\/td>\n<td>Cloud audit telemetry<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Identity<\/td>\n<td>Okta<\/td>\n<td>Auth logs, MFA events, risk signals<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Identity<\/td>\n<td>Microsoft Entra ID (Azure AD)<\/td>\n<td>Identity telemetry, sign-ins, risky users<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>SOAR<\/td>\n<td>Palo Alto Cortex XSOAR<\/td>\n<td>Playbooks, enrichment, case management<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>SOAR<\/td>\n<td>Splunk SOAR<\/td>\n<td>Automation and case workflows<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>ITSM<\/td>\n<td>ServiceNow<\/td>\n<td>Incident\/ticket workflow, escalations, audit trail<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Threat intel<\/td>\n<td>MISP<\/td>\n<td>IoC management and sharing<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>Threat intel<\/td>\n<td>Recorded Future \/ CrowdStrike Intel<\/td>\n<td>Intel feeds and reports<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>Knowledge base<\/td>\n<td>Confluence<\/td>\n<td>Runbooks, documentation, standards<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Collaboration<\/td>\n<td>Slack \/ Microsoft Teams<\/td>\n<td>Operational communications, incident channels<\/td>\n<td>Common<\/td>\n<\/tr>\n<tr>\n<td>Source control<\/td>\n<td>GitHub \/ GitLab<\/td>\n<td>Detection-as-code, reviews, versioning<\/td>\n<td>Common (in mature programs)<\/td>\n<\/tr>\n<tr>\n<td>Data analytics<\/td>\n<td>Elasticsearch \/ OpenSearch<\/td>\n<td>Log analytics and search<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Data analytics<\/td>\n<td>Databricks \/ data lake<\/td>\n<td>Large-scale analytics, hunting datasets<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Observability<\/td>\n<td>Datadog \/ New Relic<\/td>\n<td>Supporting app telemetry correlations<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>Scripting<\/td>\n<td>Python<\/td>\n<td>Enrichment scripts, parsing, testing<\/td>\n<td>Optional (often useful)<\/td>\n<\/tr>\n<tr>\n<td>Scripting<\/td>\n<td>PowerShell<\/td>\n<td>Windows investigation, artifact gathering<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>Adversary simulation<\/td>\n<td>Atomic Red Team<\/td>\n<td>Validating detections against techniques<\/td>\n<td>Optional (maturity-dependent)<\/td>\n<\/tr>\n<tr>\n<td>Adversary simulation<\/td>\n<td>Caldera \/ Prelude \/ AttackIQ<\/td>\n<td>Continuous validation and purple teaming<\/td>\n<td>Context-specific<\/td>\n<\/tr>\n<tr>\n<td>Rule abstraction<\/td>\n<td>Sigma<\/td>\n<td>Portable detection logic patterns<\/td>\n<td>Optional<\/td>\n<\/tr>\n<tr>\n<td>Vulnerability context<\/td>\n<td>Tenable \/ Qualys<\/td>\n<td>Enrichment for asset risk context<\/td>\n<td>Optional<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">11) Typical Tech Stack \/ Environment<\/h2>\n\n\n\n<p><strong>Infrastructure environment<\/strong>\n&#8211; Hybrid environments are common: cloud-first with remaining on-prem components.\n&#8211; Cloud workloads in AWS\/Azure (common), sometimes GCP; use of VPC\/VNet flow logs, cloud audit logs, and managed services.\n&#8211; Corporate IT endpoints: Windows\/macOS fleets; mobile device management (MDM) in many organizations.<\/p>\n\n\n\n<p><strong>Application environment<\/strong>\n&#8211; SaaS\/software company context typically includes:\n  &#8211; Microservices and APIs\n  &#8211; Containerized workloads (Docker) and orchestration (Kubernetes) in many orgs\n  &#8211; CI\/CD pipelines and infrastructure-as-code (Terraform\/CloudFormation) owned by platform engineering\n&#8211; The detection program consumes application logs selectively (auth events, admin actions, sensitive operations) rather than all observability data.<\/p>\n\n\n\n<p><strong>Data environment<\/strong>\n&#8211; Centralized logging platform (SIEM) plus specialized telemetry stores (EDR consoles, cloud-native findings).\n&#8211; Normalization frameworks may exist (CIM\/ASIM\/ECS) or be partially implemented.\n&#8211; Retention varies by cost and compliance; Senior Detection Analyst helps define detection-relevant retention requirements.<\/p>\n\n\n\n<p><strong>Security environment<\/strong>\n&#8211; SOC operations with tiered triage and IR escalation.\n&#8211; Tooling includes SIEM + EDR; often includes IdP logs and cloud audit logs.\n&#8211; Mature orgs run SOAR for enrichment and standardized response workflows.\n&#8211; Threat intel and vulnerability context may be integrated for alert enrichment.<\/p>\n\n\n\n<p><strong>Delivery model<\/strong>\n&#8211; Detection content releases often follow a lightweight SDLC:\n  &#8211; backlog \u2192 development \u2192 peer review \u2192 testing \u2192 release \u2192 monitoring\n&#8211; Mature teams implement detection-as-code with pull requests, automated tests, and change approval.<\/p>\n\n\n\n<p><strong>Agile \/ SDLC context<\/strong>\n&#8211; Many teams operate in Kanban (continuous flow) due to interrupt-driven nature.\n&#8211; Some operate with Scrum-like sprints for planned detection work and reserve capacity for incidents and urgent threats.<\/p>\n\n\n\n<p><strong>Scale or complexity context<\/strong>\n&#8211; Telemetry volume and SIEM cost constraints are often a major design consideration.\n&#8211; Multi-region cloud footprints and numerous SaaS services create a complex identity and access threat surface.<\/p>\n\n\n\n<p><strong>Team topology<\/strong>\n&#8211; Common placements:\n  &#8211; SOC \/ Security Operations Center (with a detection specialization)\n  &#8211; Detection Engineering \/ Detection &amp; Response team (preferred for mature programs)\n  &#8211; Security Operations Engineering (bridging tools and content)\n&#8211; The Senior Detection Analyst is typically an IC with program influence and mentorship responsibilities.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">12) Stakeholders and Collaboration Map<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Internal stakeholders<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>SOC Analysts (Tier 1\/2\/3):<\/strong> Primary consumers of alerts and runbooks; provide feedback on noise and usability.<\/li>\n<li><strong>Incident Response (IR) \/ DFIR:<\/strong> Partners for scoping queries, evidence standards, and post-incident improvements.<\/li>\n<li><strong>Threat Intelligence:<\/strong> Inputs for prioritization and technique selection; validates relevance of actor\/campaign intel.<\/li>\n<li><strong>Security Engineering:<\/strong> Works jointly on integrations, parsers, schemas, and SOAR automation.<\/li>\n<li><strong>Cloud Platform Engineering \/ SRE:<\/strong> Enables logging, cloud security controls, and operational access for investigations.<\/li>\n<li><strong>Identity &amp; Access Management (IAM):<\/strong> Critical partner for identity detections, sign-in logs, MFA policies, and privileged access.<\/li>\n<li><strong>IT Operations \/ Endpoint Engineering:<\/strong> EDR deployment and endpoint logging; helps remediate systemic issues.<\/li>\n<li><strong>Application Engineering (selected teams):<\/strong> Provides app telemetry and implements security logging for key events.<\/li>\n<li><strong>GRC \/ Compliance \/ Risk:<\/strong> Ensures detection governance and evidence readiness for audits and customer assurance.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">External stakeholders (as applicable)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Managed Detection &amp; Response (MDR) provider:<\/strong> If co-managed SOC exists; coordination on alert ownership and rule changes.<\/li>\n<li><strong>Vendors (SIEM\/EDR\/SOAR):<\/strong> Support cases, product features, tuning guidance.<\/li>\n<li><strong>Auditors \/ customer security assessors:<\/strong> Evidence requests about monitoring and detection coverage (indirect interaction).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Peer roles<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detection Engineer, SOC Engineer, Incident Responder, Threat Hunter, Security Data Analyst, Security Architect (operations).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Upstream dependencies<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reliable telemetry ingestion and normalization (EDR, IdP, cloud audit, DNS\/proxy).<\/li>\n<li>Asset inventory and ownership data (CMDB or asset DB).<\/li>\n<li>Identity governance context (privileged groups, admin roles, service principals).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Downstream consumers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SOC and IR (actions, escalations, case notes).<\/li>\n<li>Security leadership (risk and program metrics).<\/li>\n<li>Engineering teams (remediation tasks and logging changes).<\/li>\n<li>Compliance (evidence and control mapping).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Nature of collaboration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>High-frequency operational collaboration with SOC\/IR.<\/li>\n<li>Structured collaboration with platform\/engineering via intake processes and logging councils.<\/li>\n<li>Consultative collaboration with leadership through quarterly reporting and risk alignment.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Typical decision-making authority and escalation points<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The Senior Detection Analyst can generally decide on detection logic and tuning within defined guardrails.<\/li>\n<li>Escalate to <strong>Detection &amp; Response Manager \/ SOC Manager<\/strong> for:<\/li>\n<li>Major detection changes affecting operations broadly<\/li>\n<li>High-risk suppressions<\/li>\n<li>Conflicts over logging priorities or access<\/li>\n<li>Escalate to <strong>Director of Security Operations<\/strong> (or equivalent) for:<\/li>\n<li>Budget\/capacity constraints that materially impact detection outcomes<\/li>\n<li>Cross-org mandates for telemetry enablement<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">13) Decision Rights and Scope of Authority<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Can decide independently<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Detection query logic changes and tuning for owned detections, within documented standards.<\/li>\n<li>Severity adjustments and triage guidance for alerts, based on evidence and stakeholder input.<\/li>\n<li>Runbook content, investigation steps, and recommended pivot queries.<\/li>\n<li>Prioritization within assigned detection backlog (day-to-day), balancing incidents and planned work.<\/li>\n<li>Recommendations for telemetry improvements and new data sources (proposal ownership).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Requires team approval (peer review \/ change control)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>New high-severity detections that may materially increase paging\/escalations.<\/li>\n<li>Suppressions or allowlists that reduce coverage for critical techniques (requires documented justification).<\/li>\n<li>Correlation rules affecting multiple data sources and multiple teams\u2019 workflows.<\/li>\n<li>Detection-as-code merges (PR approvals) where that operating model exists.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Requires manager\/director\/executive approval<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Tooling changes (new SIEM add-ons, major SOAR changes, new data lake adoption).<\/li>\n<li>Budget-impacting changes (large ingestion increases, significant retention changes).<\/li>\n<li>Organization-wide monitoring policy changes (e.g., expanding endpoint logging, enabling additional audit logs).<\/li>\n<li>Hiring decisions, vendor procurement, and contract renewals (role provides input and requirements).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Budget, architecture, vendor, delivery, hiring, compliance authority<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Budget:<\/strong> Typically no direct budget ownership; provides cost\/benefit analysis and requirements.<\/li>\n<li><strong>Architecture:<\/strong> Influences detection architecture and telemetry design; final decisions typically sit with Security Architecture\/SecEng leadership.<\/li>\n<li><strong>Vendor:<\/strong> Provides evaluation input and technical requirements; procurement owned elsewhere.<\/li>\n<li><strong>Delivery:<\/strong> Owns delivery for detection content; coordinates delivery dependencies with other teams.<\/li>\n<li><strong>Hiring:<\/strong> Participates in interviews and skills calibration; may help design exercises.<\/li>\n<li><strong>Compliance:<\/strong> Supports evidence and control mapping; does not \u201cown\u201d compliance decisions but ensures operational readiness.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">14) Required Experience and Qualifications<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Typical years of experience<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>5\u20138+ years<\/strong> in security operations, detection engineering\/analytics, incident response, or threat hunting.<\/li>\n<li>Demonstrated senior-level capability: owning detection improvements end-to-end and influencing how others investigate and respond.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Education expectations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Bachelor\u2019s degree in Computer Science, Information Systems, Cybersecurity, or equivalent experience is common.<\/li>\n<li>Equivalent experience (military, apprenticeships, hands-on SOC\/IR history) is often acceptable in software\/IT organizations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certifications (Common \/ Optional \/ Context-specific)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Common \/ valued (optional but helpful):<\/strong><\/li>\n<li>GIAC (e.g., GCIA, GCIH, GCED, GMON, GCFA) \u2013 choose based on role emphasis<\/li>\n<li>Splunk certifications (Power User\/Admin\/ES) if Splunk-heavy environment<\/li>\n<li>Microsoft security certifications (for Sentinel\/Defender-heavy environments)<\/li>\n<li><strong>Context-specific:<\/strong><\/li>\n<li>Cloud certifications (AWS\/Azure\/GCP security) if cloud-heavy detection scope<\/li>\n<li>SANS purple-team or threat hunting oriented credentials in mature validation programs<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prior role backgrounds commonly seen<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SOC Analyst (Tier 2\/3)<\/li>\n<li>Incident Responder \/ DFIR Analyst<\/li>\n<li>Threat Hunter<\/li>\n<li>Security Engineer (operations-oriented)<\/li>\n<li>Security Monitoring Analyst \/ SIEM Content Developer<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Domain knowledge expectations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Strong understanding of:<\/li>\n<li>Endpoint attack patterns (credential theft, persistence, execution)<\/li>\n<li>Identity attacks (MFA bypass, token theft, OAuth abuse, privilege escalation)<\/li>\n<li>Cloud control plane threats (IAM changes, suspicious API usage, persistence)<\/li>\n<li>Common attacker tradecraft and how it appears in logs<\/li>\n<li>Familiarity with secure operations and evidence standards (chain of reasoning, reproducibility of findings).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Leadership experience expectations (Senior IC)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Not necessarily people management.<\/li>\n<li>Expected to mentor others, lead initiatives, and operate as an escalation resource.<\/li>\n<li>Should demonstrate ownership, accountability, and ability to drive cross-team outcomes.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">15) Career Path and Progression<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Common feeder roles into this role<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SOC Analyst (Tier 2\/3) with strong investigation and query skills<\/li>\n<li>Threat Hunter with proven conversion of findings into detections<\/li>\n<li>DFIR analyst who wants to shift left into prevention\/detection content<\/li>\n<li>Security Engineer who wants to specialize in monitoring and analytics<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Next likely roles after this role<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Lead Detection Analyst \/ Detection Engineering Lead<\/strong> (IC lead or small-team lead)<\/li>\n<li><strong>Detection Engineer (Senior\/Staff)<\/strong> (more engineering-heavy, detection-as-code, platform work)<\/li>\n<li><strong>Staff Security Analyst (Detection &amp; Response)<\/strong> (broader scope across programs, strategy, validation)<\/li>\n<li><strong>Security Operations Manager \/ SOC Manager<\/strong> (people leadership track)<\/li>\n<li><strong>Threat Hunting Lead<\/strong> (specialized hunting program leadership)<\/li>\n<li><strong>Security Data Engineer (Security Analytics)<\/strong> (data pipeline and schema specialization)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Adjacent career paths<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Cloud Security Engineer<\/strong> (if cloud detections become primary focus)<\/li>\n<li><strong>Product Security \/ Application Security<\/strong> (if the analyst becomes focused on app telemetry and abuse detection)<\/li>\n<li><strong>Security Architecture<\/strong> (if the analyst shifts toward governance and design across toolchain and telemetry)<\/li>\n<li><strong>Fraud\/Abuse Detection (for SaaS products)<\/strong> (behavioral analytics applied to customer-facing misuse; context-specific)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Skills needed for promotion (to Staff\/Lead)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Demonstrated ownership of a detection program area (identity, cloud, endpoint) with measurable outcome improvements.<\/li>\n<li>Consistent delivery of validated detections and reduction of noise at scale.<\/li>\n<li>Ability to define standards (documentation, testing, tuning) adopted by the team.<\/li>\n<li>Influence across teams to improve telemetry and operational workflows.<\/li>\n<li>Strategic planning: roadmap creation tied to risk and measurable coverage.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How this role evolves over time<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Early phase: heavy focus on tuning and improving existing detections, stabilizing signal quality.<\/li>\n<li>Mid phase: build correlation and behavior-based detections; formalize validation and governance.<\/li>\n<li>Mature phase: detection-as-code, continuous validation, and strong alignment with threat models and business risk metrics.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">16) Risks, Challenges, and Failure Modes<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Common role challenges<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Telemetry gaps and inconsistency:<\/strong> Missing or unreliable logs, schema drift, incomplete endpoint coverage, or insufficient retention.<\/li>\n<li><strong>Alert fatigue pressure:<\/strong> Stakeholders demand \u201cmore detections,\u201d but SOC capacity and noise limits require careful design.<\/li>\n<li><strong>Ambiguous ground truth:<\/strong> Confirming true positives can be difficult; may require IR support and better enrichment.<\/li>\n<li><strong>Tool constraints and cost:<\/strong> SIEM cost\/performance limitations can restrict detection complexity or data onboarding.<\/li>\n<li><strong>Cross-team dependency friction:<\/strong> Logging changes require other teams\u2019 time; prioritization can be contentious.<\/li>\n<li><strong>Rapidly changing threat landscape:<\/strong> New techniques and platform features can invalidate existing detection assumptions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Bottlenecks<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Limited IR bandwidth for validation and feedback.<\/li>\n<li>Lack of a testing environment or safe simulation tooling.<\/li>\n<li>No standardized data model, making detections brittle.<\/li>\n<li>Slow change management for logging and agent deployments.<\/li>\n<li>Unclear ownership of detections and runbooks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Anti-patterns<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Writing detections without clear intent, threat model alignment, or defined response actions.<\/li>\n<li>Over-reliance on IoCs without behavior-based logic (fragile and quickly evaded).<\/li>\n<li>Excessive suppressions\/allowlists without review, silently reducing coverage.<\/li>\n<li>Shipping detections without documentation, leaving SOC unable to act consistently.<\/li>\n<li>Measuring only \u201cnumber of alerts\u201d or \u201cnumber of rules\u201d rather than outcomes and efficacy.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common reasons for underperformance<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Weak query skills leading to inefficient, noisy, or incorrect detections.<\/li>\n<li>Poor stakeholder communication causing low adoption and recurring operational friction.<\/li>\n<li>Lack of follow-through on tuning and lifecycle hygiene.<\/li>\n<li>Inability to prioritize effectively; chasing low-value detections while critical gaps remain.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Business risks if this role is ineffective<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Increased dwell time and larger breach impact due to late detection.<\/li>\n<li>Higher operational costs from alert fatigue and inefficient triage.<\/li>\n<li>Missed detections for identity or cloud control-plane compromise (often high impact).<\/li>\n<li>Reduced customer trust and increased audit risk if monitoring controls are weak or undocumented.<\/li>\n<li>Repeated incidents due to failure to convert lessons learned into detection and telemetry improvements.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">17) Role Variants<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">By company size<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Small company \/ early-stage SOC:<\/strong> <\/li>\n<li>More generalist; combines triage, hunts, and detection building.  <\/li>\n<li>Focus: establish baseline telemetry, implement high-impact detections quickly, reduce noise.<\/li>\n<li><strong>Mid-size SaaS \/ scaling security org:<\/strong> <\/li>\n<li>Balanced role: tuning + correlation + lifecycle governance.  <\/li>\n<li>Focus: detection roadmap, ATT&amp;CK mapping, SOAR enrichment, cross-team logging projects.<\/li>\n<li><strong>Large enterprise:<\/strong> <\/li>\n<li>Specialized domain ownership (identity\/cloud\/endpoint).  <\/li>\n<li>Focus: detection-as-code, continuous validation, metrics maturity, integration across many tools and business units.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">By industry<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Highly regulated (finance\/health\/public sector):<\/strong> <\/li>\n<li>Heavier governance, evidence collection, retention requirements, formal change control.<\/li>\n<li><strong>Consumer SaaS:<\/strong> <\/li>\n<li>More identity and SaaS admin abuse focus; may integrate product telemetry for account takeover signals.<\/li>\n<li><strong>B2B enterprise software:<\/strong> <\/li>\n<li>Greater emphasis on protecting internal engineering systems (CI\/CD, source control, secrets) and cloud infrastructure.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">By geography<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Core competencies are globally consistent. Variations mainly include:<\/li>\n<li>Data residency constraints affecting telemetry centralization.<\/li>\n<li>Regional compliance expectations affecting retention, monitoring policies, and access.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Product-led vs service-led company<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Product-led (SaaS):<\/strong> <\/li>\n<li>Detections often include SaaS configuration risks, admin actions, identity, and cloud platform activity.<\/li>\n<li><strong>Service-led \/ IT org:<\/strong> <\/li>\n<li>More traditional enterprise telemetry: network, endpoints, identity, and IT service management workflows.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Startup vs enterprise<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Startup:<\/strong> speed, pragmatic detections, fewer tools, heavier reliance on cloud-native logs and managed services.<\/li>\n<li><strong>Enterprise:<\/strong> complexity, formal governance, multiple SIEM tenants\/business units, higher emphasis on standardization and auditability.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Regulated vs non-regulated environment<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Regulated:<\/strong> formal review cycles, documented control mapping, strict access controls for security data.<\/li>\n<li><strong>Non-regulated:<\/strong> more flexibility; still benefits from lifecycle discipline to prevent detection drift.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">18) AI \/ Automation Impact on the Role<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Tasks that can be automated (increasingly)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Drafting initial query logic from natural language requirements (requires validation).<\/li>\n<li>Summarizing alert context and related events into an investigation narrative.<\/li>\n<li>Enrichment steps: asset context, user context, geolocation, reputation checks, sandbox detonation (where applicable).<\/li>\n<li>Clustering\/duplicate detection of similar alerts and incident grouping suggestions.<\/li>\n<li>Baseline modeling for common entities (users, hosts, service principals) to flag anomalies.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Tasks that remain human-critical<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Determining detection intent and aligning it to business risk and threat models.<\/li>\n<li>Making tradeoffs between precision and recall in operational context.<\/li>\n<li>Validating detections against realistic attacker behavior and environment-specific noise sources.<\/li>\n<li>Root cause analysis of false positives\/false negatives and designing durable fixes.<\/li>\n<li>Cross-team influence: negotiating telemetry changes, access, and operational ownership.<\/li>\n<li>Judgement calls during incidents: what to page, what to suppress, what to escalate.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How AI changes the role over the next 2\u20135 years<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The Senior Detection Analyst becomes more of a <strong>detection product owner<\/strong>:<\/li>\n<li>defining high-quality requirements<\/li>\n<li>validating AI-assisted detections<\/li>\n<li>ensuring documentation and governance keep up with faster content production<\/li>\n<li>Increased expectations for:<\/li>\n<li><strong>testing and continuous validation<\/strong> (to prevent AI-generated but incorrect logic)<\/li>\n<li><strong>data literacy<\/strong> (understanding data pipelines and model limitations)<\/li>\n<li><strong>prompting and review discipline<\/strong> (repeatable patterns, bias awareness, correctness checks)<\/li>\n<li>AI will likely increase detection throughput; the differentiator will be <strong>quality, validation, and operational outcomes<\/strong>, not volume of rules.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">New expectations caused by AI, automation, or platform shifts<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Standardized evaluation of detection performance (precision\/recall proxies, sampling, validation exercises).<\/li>\n<li>Faster iteration cycles and tighter integration with CI\/CD-like workflows for detection content.<\/li>\n<li>Greater emphasis on explainability: detections must be explainable to analysts, auditors, and leadership.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">19) Hiring Evaluation Criteria<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to assess in interviews<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Detection thinking:<\/strong> Ability to translate threat behaviors into detection hypotheses and concrete logic.<\/li>\n<li><strong>Query proficiency:<\/strong> Comfort writing and explaining SIEM queries, including performance considerations.<\/li>\n<li><strong>Telemetry literacy:<\/strong> Understanding what specific logs can\/can\u2019t prove; awareness of common gaps and pitfalls.<\/li>\n<li><strong>Tuning strategy:<\/strong> Practical methods to reduce noise without blinding the organization.<\/li>\n<li><strong>Investigation depth:<\/strong> Ability to scope, pivot, and create a coherent narrative from data.<\/li>\n<li><strong>Documentation mindset:<\/strong> Producing runbooks and clear triage instructions.<\/li>\n<li><strong>Collaboration:<\/strong> Ability to drive telemetry changes and adopt feedback loops with SOC\/IR.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Practical exercises or case studies (recommended)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Detection build exercise (60\u201390 minutes)<\/strong>\n   &#8211; Input: a short scenario (e.g., suspicious OAuth consent grant; unusual PowerShell execution; AWS access key misuse).\n   &#8211; Task: write a detection query (SPL\/KQL or pseudo-query), define required fields\/log sources, map to ATT&amp;CK, propose severity, and draft a short runbook.<\/li>\n<li><strong>Tuning and triage exercise (45\u201360 minutes)<\/strong>\n   &#8211; Input: sample alert results showing false positives and true positives.\n   &#8211; Task: identify noise causes, propose logic refinements, and explain tradeoffs.<\/li>\n<li><strong>Incident scoping drill (30\u201345 minutes)<\/strong>\n   &#8211; Input: initial alert and limited telemetry context.\n   &#8211; Task: provide 5\u201310 pivot queries\/questions to scope impact and recommend next steps.<\/li>\n<li><strong>Detection lifecycle design discussion (30 minutes)<\/strong>\n   &#8211; Task: describe how they would implement review cycles, QA, ownership, and metrics.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Strong candidate signals<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Explains detections in terms of attacker behavior and evidence, not just \u201cthis looks suspicious.\u201d<\/li>\n<li>Comfortable discussing precision\/recall tradeoffs, suppression risk, and validation approaches.<\/li>\n<li>Demonstrates structured thinking: hypothesis \u2192 data sources \u2192 detection logic \u2192 expected results \u2192 response actions.<\/li>\n<li>Writes readable, efficient queries and can explain performance considerations.<\/li>\n<li>Prior experience improving a detection program with measurable impact (noise reduction, faster triage, better coverage).<\/li>\n<li>Clear documentation examples (runbooks, investigation guides, detection rationale).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Weak candidate signals<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Focuses on tool names without demonstrating investigative or detection reasoning.<\/li>\n<li>Writes detections that are purely IoC-based with no resilience strategy.<\/li>\n<li>Cannot articulate how to validate a detection or measure whether it works.<\/li>\n<li>Proposes blanket allowlists without governance or review plans.<\/li>\n<li>Struggles to explain what telemetry is required and what assumptions are being made.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Red flags<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Casual attitude toward suppressing alerts that could hide true compromise, without risk assessment.<\/li>\n<li>Inability to distinguish \u201canomalous\u201d from \u201cmalicious\u201d and propose next steps accordingly.<\/li>\n<li>Lack of respect for change control, documentation, and operational impact on SOC.<\/li>\n<li>Overconfidence in AI-generated detections without validation discipline.<\/li>\n<li>Poor collaboration posture (blaming other teams for telemetry gaps without proposing workable solutions).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scorecard dimensions (example)<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Dimension<\/th>\n<th>What \u201cmeets bar\u201d looks like<\/th>\n<th>What \u201cexcellent\u201d looks like<\/th>\n<th>Weight<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Detection design &amp; threat alignment<\/td>\n<td>Maps behaviors to detections and response actions<\/td>\n<td>Produces durable, behavior-based detections with clear scope and assumptions<\/td>\n<td>20%<\/td>\n<\/tr>\n<tr>\n<td>SIEM\/Query skill<\/td>\n<td>Writes correct queries with basic optimization<\/td>\n<td>Writes efficient, readable queries; explains performance\/cost tradeoffs<\/td>\n<td>20%<\/td>\n<\/tr>\n<tr>\n<td>Investigation &amp; IR partnership<\/td>\n<td>Can scope and pivot from initial signal<\/td>\n<td>Builds strong investigation paths and artifacts that speed IR<\/td>\n<td>15%<\/td>\n<\/tr>\n<tr>\n<td>Tuning &amp; operational judgment<\/td>\n<td>Reduces noise responsibly<\/td>\n<td>Demonstrates a systematic tuning program with metrics and governance<\/td>\n<td>15%<\/td>\n<\/tr>\n<tr>\n<td>Telemetry\/data literacy<\/td>\n<td>Understands key log sources and limits<\/td>\n<td>Anticipates gaps; proposes schema\/normalization improvements<\/td>\n<td>10%<\/td>\n<\/tr>\n<tr>\n<td>Documentation &amp; enablement<\/td>\n<td>Writes usable runbooks<\/td>\n<td>Creates templates\/standards that scale across team<\/td>\n<td>10%<\/td>\n<\/tr>\n<tr>\n<td>Collaboration &amp; influence<\/td>\n<td>Works well with SOC\/IR\/engineering<\/td>\n<td>Drives cross-team telemetry improvements and adoption<\/td>\n<td>10%<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h2 class=\"wp-block-heading\">20) Final Role Scorecard Summary<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Category<\/th>\n<th>Summary<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Role title<\/td>\n<td>Senior Detection Analyst<\/td>\n<\/tr>\n<tr>\n<td>Role purpose<\/td>\n<td>Build, validate, and continuously improve security detections that identify attacker behaviors across endpoint, identity, cloud, and network telemetry\u2014improving MTTD, reducing noise, and enabling consistent response.<\/td>\n<\/tr>\n<tr>\n<td>Top 10 responsibilities<\/td>\n<td>1) Own detection lifecycle for assigned domains 2) Write and tune SIEM\/EDR detections 3) Reduce false positives and improve alert fidelity 4) Map coverage to MITRE ATT&amp;CK 5) Partner with IR for scoping and post-incident improvements 6) Lead\/support threat hunts and convert findings into detections 7) Validate detections via testing\/purple-team methods 8) Define and improve runbooks\/playbooks 9) Identify telemetry gaps and drive onboarding\/quality improvements 10) Mentor analysts and set detection standards<\/td>\n<\/tr>\n<tr>\n<td>Top 10 technical skills<\/td>\n<td>1) SPL\/KQL (SIEM query mastery) 2) Endpoint telemetry analysis 3) Identity attack detection (IdP\/Entra\/Okta logs) 4) MITRE ATT&amp;CK mapping 5) Detection tuning methods 6) Incident scoping and investigation pivots 7) Correlation\/behavior analytics 8) Cloud audit log analytics (CloudTrail\/Activity Logs) 9) SOAR concepts and enrichment design 10) Detection-as-code practices (Git, review, testing)<\/td>\n<\/tr>\n<tr>\n<td>Top 10 soft skills<\/td>\n<td>1) Analytical rigor 2) Operational judgment 3) Clear technical writing 4) Influence without authority 5) Collaboration under pressure 6) Mentorship mindset 7) Curiosity\/learning agility 8) Prioritization and backlog management 9) Stakeholder communication 10) Documentation discipline<\/td>\n<\/tr>\n<tr>\n<td>Top tools or platforms<\/td>\n<td>Splunk ES or Microsoft Sentinel; CrowdStrike or Defender for Endpoint; Okta\/Entra ID logs; AWS\/Azure audit logs; ServiceNow; GitHub\/GitLab; Confluence; SOAR tooling (XSOAR\/Splunk SOAR) as applicable<\/td>\n<\/tr>\n<tr>\n<td>Top KPIs<\/td>\n<td>True positive rate; false positive rate; MTTT; MTTD (by incident type); ATT&amp;CK coverage for prioritized techniques; validation rate; rule review compliance; deployment lead time; defect\/rollback rate; SOC analyst satisfaction<\/td>\n<\/tr>\n<tr>\n<td>Main deliverables<\/td>\n<td>Detection catalog; detection rules\/queries; runbooks; tuning reports; hunt reports; post-incident detection improvements; dashboards\/metrics packs; telemetry gap assessments; SOAR enrichment requirements; standards\/templates<\/td>\n<\/tr>\n<tr>\n<td>Main goals<\/td>\n<td>First 90 days: reduce top noise sources, ship priority detections, establish QA and lifecycle hygiene. First 12 months: measurable improvements in MTTD and alert quality, validated coverage mapping, scalable documentation and governance.<\/td>\n<\/tr>\n<tr>\n<td>Career progression options<\/td>\n<td>Lead Detection Analyst; Senior\/Staff Detection Engineer; Staff Security Analyst (Detection &amp; Response); Threat Hunting Lead; SOC Manager (management track); Security Data Engineer (security analytics)<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>The **Senior Detection Analyst** designs, validates, and continuously improves security detections that identify malicious behavior across endpoints, identities, networks, cloud platforms, and applications. This role sits at the intersection of SOC operations, threat intelligence, incident response, and security engineering\u2014turning real-world attacker behaviors into high-fidelity alerts, investigations, and automated response playbooks.<\/p>\n","protected":false},"author":61,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[24453,24460],"tags":[],"class_list":["post-72737","post","type-post","status-publish","format-standard","hentry","category-analyst","category-security"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/72737","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=72737"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/72737\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=72737"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=72737"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=72737"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}