Detection Engineering Strategy - Define and execute the organization's detection engineering roadmap.
- Establish standards and governance for detection lifecycle management.
- Develop a comprehensive threat detection framework aligned to business risks.
- Drive continuous improvement of detection coverage against emerging threats.
Threat Detection Development - Design, develop, and optimize:
- Correlation rules
- Detection use cases
- Behavioral analytics
- Risk-based detections
- Threat intelligence-driven detections
- Develop detections aligned to:
- MITRE ATT&CK
- Cyber Kill Chain
- Industry threat intelligence
- Adversary TTPs
SIEM & Analytics Engineering - Build and optimize detections within:
- Splunk Enterprise Security
- Other SIEM/XDR platforms
- Develop SPL queries and advanced analytics content.
- Implement Risk-Based Alerting (RBA) methodologies.
- Reduce false positives through tuning and contextual enrichment.
Security Content Management - Own end-to-end detection lifecycle:
- Requirement gathering
- Design
- Development
- Testing
- Deployment
- Tuning
- Retirement
- Maintain detection documentation and knowledge repositories.
- Track use case efficacy and operational performance.
Automation & Enrichment - Integrate detections with:
- SOAR platforms
- Threat Intelligence Platforms (OpenCTI, MISP)
- EDR/XDR tools
- IAM platforms
- Vulnerability management systems
- Automate contextual enrichment and alert prioritization.
Detection Metrics & Reporting - Measure:
- Detection coverage
- Detection fidelity
- False positive rates
- Mean Time to Detect (MTTD)
- Detection gap closure rates
Provide executive reporting on detection maturity and effectiveness. |
