Skip to content
sec/atlas
all careers

careers

Detection / SOC Engineer

Turn raw telemetry into decisions: detect abuse quickly, act with care and measure the result.

A detection or SOC engineer builds and runs the pipeline from logs to action: collecting telemetry, writing and tuning detections, operating controls such as WAF and rate limiting, and measuring how well the whole thing works. It is engineering with a stopwatch: speed, precision and cost all matter.

see this path on the journey map

A day in the job

  • Maintain the telemetry pipeline and watch it for gaps, lag and silent failures.
  • Write, test and tune detections for credential stuffing, scraping, injection and abuse.
  • Operate WAF, rate limiting and bot controls: observe first, shadow next, enforce last.
  • Run runbooks during incidents, then turn what you learned into new detections and hardening.
  • Report precision, recall and response times, and use them to decide what to tune next.
0 of 13 studiedNext topic: L7 attacks: what to look for

  1. Stage 1· Foundations

    Know what attacks look like in logs and how telemetry is collected.

    Study here

    Learn elsewhere

    • HTTP in depth: headers, cookies, status codes
    • SQL or a similar query language, used daily
    • The MITRE ATT&CK framework as a vocabulary

    Build this

    Take a sample access log, write queries that expose three attack patterns and document the signature of each.

  2. Stage 2· Practitioner

    Write detections and operate edge controls safely.

    Study here

    Learn elsewhere

    • A scripting language for glue and testing
    • Statistics basics: baselines, z-scores, moving averages
    • A real WAF or CDN account to practice on

    Build this

    Ship a detection through observation, shadow and enforcement, and report its false-positive rate at each stage.

  3. Stage 3· Advanced

    Scale the pipeline, automate the response and prove it works.

    Study here

    Learn elsewhere

    • Data engineering for telemetry: partitioning, aggregation, cost
    • On-call and incident command
    • Presenting results to leadership

    Build this

    Define SLOs for triage and containment, build the dashboard and run a tabletop exercise against them.

What to show

  • A detection library with tests: positive cases (attacks) and negative cases (normal traffic).
  • A runbook with an escalation ladder (challenge, short block, longer block) and TTLs on every action.
  • A one-page report of precision, recall and time to contain for a month of operation.

Certifications (examples)

  • GIAC Certified Detection Analyst (GCDA)
  • Splunk Core Certified Power User
  • Elastic Certified Analyst

Examples, not endorsements or requirements. Check the issuer for current details.

Related roles