Roles
What is Detection engineer?
The person who writes and tunes the rules that decide which activity raises an alert.
A detection engineer writes, tests and tunes the rules that decide which activity raises an alert, in a SIEM, an EDR or a network sensor. The job sits between threat intelligence and the SOC.
Good detection engineering turns a report into something that fires: it maps described behaviour to available telemetry, writes the rule, checks it against real data for false positives and keeps it maintained as the environment changes.