WHAT IS A DETECTION ENGINEER?

Summary from the TLDR InfoSec newsletter

The first part of Zach Allen's Detection Engineering Field Manual introduces the concept of detection engineering, which primarily focuses on detecting when a threat actor circumvents controls. Allen models SOC operations in three loops: Loop 1 identifies assets and utilizes controls to protect them, Loop 2 employs rules to detect threats and responds with containment, and finally, Loop 3 focuses on recovering and learning from incidents. A detection engineer can focus on one loop or all of them and should, at a minimum, possess some coding expertise and a customer-centric mindset.