How to Hire a Detection Engineer When You Have Never Hired One Before

Most detection engineer hiring fails because the job description is wrong. The job description reads like a software engineer with a security focus, and the interview tests for software engineering skills, and the candidate who gets hired is a software engineer who does not know how to do detection engineering.

Here is what to actually look for, what to test in the interview, and the most common mistakes programmes make on the first hire.

What the job is

The job is the editing work. The job is the triage work. The job is the pipeline work. The job is the cadence work. The job is the documentation work. The job is not the clever detection logic. The job is not the threat hunting. The job is not the incident response.

The job description should reflect the actual job. The job description should list the editing, the triage, the pipeline, the cadence, and the documentation. The job description should not list the clever detection logic, the threat hunting, and the incident response. The job description should reflect the actual work, not the work the hiring manager wishes the job was.

The job description that reads like a software engineer is the job description that will attract software engineers. The job description that reads like a security analyst is the job description that will attract security analysts. The job description that reads like a detection engineer is the job description that will attract detection engineers. The job description should read like a detection engineer.

What to look for

The most important thing to look for is the judgement. The judgement is the ability to decide which inputs are worth acting on, which detections are worth writing, and which detections are worth retiring. The judgement is the most important skill. The judgement is the most difficult skill to find.

The judgement is hard to find because the judgement is hard to test. The judgement is not the same as the technical skill. The judgement is not the same as the certification. The judgement is not the same as the experience. The judgement is the ability to make the right call in the ambiguous situation, with incomplete information, under time pressure. The judgement is the skill that the candidate has demonstrated by being a good detection engineer, not the skill that the candidate has on the resume.

The way to test the judgement is to put the candidate in a scenario. The scenario should be a realistic detection engineering scenario. The scenario should be ambiguous. The scenario should have incomplete information. The scenario should have time pressure. The scenario should require the candidate to make a judgement call.

The scenario is not the technical interview. The scenario is the judgement interview. The scenario is the part of the interview that is the most important. The scenario is the part of the interview that is the most under-emphasised.

What to test in the interview

The interview should test four things. The first is the technical foundation. The technical foundation is the ability to write a Sigma rule, the ability to read a SIEM query, the ability to understand the basic mechanics of the endpoint and the network. The technical foundation is the floor of the skill set. The technical foundation is the part of the skill set that is the easiest to test.

The second is the operational fluency. The operational fluency is the ability to think in terms of the SOC analyst, the alert, the response, the documentation. The operational fluency is the ability to talk about the work in the language of the work. The operational fluency is the part of the skill set that is the most under-tested.

The third is the writing. The writing is the ability to write the documentation that the SOC analyst is going to read. The writing is the ability to write the four-section debrief. The writing is the ability to write the rule documentation. The writing is the part of the skill set that is the most under-valued.

The fourth is the judgement. The judgement is the ability to make the right call in the ambiguous situation. The judgement is the part of the skill set that is the most important.

The four parts of the interview should be roughly equal in time. The interview should not be mostly the technical foundation. The interview should not be mostly the writing. The interview should be balanced. The interview should be the four parts.

The most common mistakes

The most common mistake is hiring for the technical skill. The technical skill is the easiest to test. The technical skill is the easiest to verify on the resume. The technical skill is the part of the skill set that the hiring manager is the most comfortable with. The technical skill is the part of the skill set that the hiring manager is the most likely to over-weight.

The technical skill is not the most important part of the skill set. The technical skill is the floor. The technical skill is the part of the skill set that the candidate can learn. The technical skill is the part of the skill set that is the least predictive of the candidate's success in the role.

The second most common mistake is hiring for the certification. The certification is the easy signal. The certification is the part of the resume that the hiring manager can scan quickly. The certification is the part of the resume that the hiring manager is the most comfortable with.

The certification is not the most important part of the skill set. The certification is the floor. The certification is the part of the skill set that the candidate can get. The certification is the part of the skill set that is the least predictive of the candidate's success in the role.

The third most common mistake is hiring for the experience at a specific vendor. The experience at a specific vendor is the easy signal. The experience at a specific vendor is the part of the resume that the hiring manager can scan quickly. The experience at a specific vendor is the part of the resume that the hiring manager is the most comfortable with.

The experience at a specific vendor is not the most important part of the skill set. The experience at a specific vendor is the floor. The experience at a specific vendor is the part of the skill set that the candidate can get. The experience at a specific vendor is the part of the skill set that is the least predictive of the candidate's success in the role.

The fourth most common mistake is hiring for the brand. The brand of the candidate's previous employer is the easy signal. The brand of the candidate's previous employer is the part of the resume that the hiring manager can scan quickly. The brand of the candidate's previous employer is the part of the resume that the hiring manager is the most comfortable with.

The brand of the candidate's previous employer is not the most important part of the skill set. The brand of the candidate's previous employer is the floor. The brand of the candidate's previous employer is the part of the skill set that is the least predictive of the candidate's success in the role.

The honest answer

The honest answer is that the detection engineer you are looking for is the candidate who has the judgement. The honest answer is that the judgement is the part of the skill set that is the most important. The honest answer is that the judgement is the part of the skill set that is the most under-tested.

The honest answer is that the interview should be designed to test the judgement. The honest answer is that the interview should not be designed to test the technical skill. The honest answer is that the interview should be designed to test the writing, the operational fluency, and the judgement.

The honest answer is that the first hire is the most important hire. The honest answer is that the first hire sets the standard for the function. The honest answer is that the first hire should be the candidate who is the best detection engineer, not the candidate who is the easiest to hire.

If you are hiring your first detection engineer, hire the best detection engineer you can find. If you are hiring your first detection engineer, hire the candidate who has the judgement. If you are hiring your first detection engineer, hire the candidate who is going to set the standard for the function.