Becoming a Detection Engineering Contractor, Part II— The Preparation

Malware News
1

You want to become a contractor or an independent consultant in the Detection Engineering (DE) space? This series is for you.

In Part I, I covered the benefits of this career path, including market rates, schedule flexibility, and the growing demand for DE projects.

Now, in Part II (Preparation), I’ll share key tips to help you prepare and boost your chances of landing your first project.

The Topics

  1. Motivation: Why working as a contractor in this space?
    ▶ Market Demand
    ▶ Salary / Rates
    ▶ Schedule Flexibility
  2. Preparation: What are the requirements to land a job?
    ▶ Skillset Needed
    ▶ Technologies & Products
    ▶ Data Literacy x Fluency
  3. Practical Tips
    ▶ Get Inspired
    ▶ Get Exposed

Why Soft Skills Win in the Long Run?

It might sound cliché, but developing soft skills will benefit you not just professionally, but in every area of your life.

Soft skills are the backbone of success in any field, far outweighing hard skills given that technical knowledge alone has little value if you can’t communicate, adapt, or collaborate effectively.

Top soft skills to pursue?

That's of course hard to answer but here are my few cents.

I will later cover Data Literacy as a desired hard skill, but to further tap into it, you will sooner or later need Data Fluency which is the ability to communicate information from data.

For example, how to prioritize a backlog of detection ideas? You need not only data but the ability to articulate why one item should be prioritized over another. Charts/Stats help but the delivery matters even more.

Another one? Critical thinking under pressure (ex.: immediate, post-incident activities) is very different from playing around in a lab.

The next soft skill a very fresh one, especially considering contractors are mostly hired for a single product or specialization (DE, in this case).

Agency is the capacity of an individual to act independently and make free choices, a mix of self-motivation and ownership, something a contractor in this domain should definitely have.

While most hard skills are teachable, the degree to which someone can master them can vary. Most people can learn to program, analyze data, or build a spreadsheet.

On the other hand, most soft skills are developed over time through experience and self-awareness, and mastering those is often more subjective and nuanced.

In a world where automation and AI are replacing repetitive, technical tasks at an unprecedented rate, soft skills are a true differentiator.

So don't skip an opportunity to improve on emotional intelligence, leadership, and problem-solving. Besides anything, you must be curious!

How to develop those?

Well, just face challenges, one after the other. Just do it!

Easier said than done, right? Start by picking one of the following:

  • Practice active listening : Summarize what someone says before responding. This builds clarity and empathy.
  • Write more often: blogs or journal entries improves written communication. Detect.FYI is always looking for new authors! ;-)
  • Become self-aware— Reflect on how you react to criticism and adjust accordingly. I'm sometimes a sucker in this department!
  • Pick a sport and play against/with someone else. That not only teaches you how to handle setbacks but empathy and resiliency.
  • Be humble, admit your fragility and weaknesses, ask for help. Attend trainings, join communities, shadow senior pros, ask questions!

If there's ONE thing I can say about becoming better, but surely, not for everyone, especially at a young age: start meditating. It may seem trivial, but it’s what helped me turn my life around after a burnout a few years ago.

No soft pillows, no background music, no apps needed. Seat comfortably and acknowledge every single thought without engaging on any of them.

And here is one practical book that has helped me a lot to get into the mood. Every topic doesn't take more than 3 or 4 pages and serves well as a starting point for a quick daily meditation session (15–20 minutes).

We learn that stuff every day and there's no end goal. Just start doing it.

Technologies x Products

After all, you won't be shortlisted for a job interview if your CV only lists your soft skills, right?

So the secret lies in aiming to become a Subject Matter Expert (SME).

You need to specialize in one product or set of products, part of the Detection Engineering (DE) or Threat Detection space.

⚠️ But before we get into that, consider this article is focused on those already working in cybersecurity that want to consider freelancing in DE field. ⚠️

Nothing beats the fundamentals. So consider those if you are just starting. You must have basic or foundational knowledge on Network Security, OS Internals, Databases, Web Protocols, etc.

IMHO, the fastest path is to get an internship or junior role at a SecOps or a security consultancy practice. That means working as an analyst or consultant for the likes of Accenture, Big Four firms, etc.

Having said that, which technologies and products should you focus on in order to boost the chances of breaking into the freelancing market when it comes to DE and Threat Hunting?

Which SIEM to focus on?

SIEM is where the (log) data lives. While that may change in the future, it remains the primary data platform for enterprise SecOps teams.

Gartner does a great job compiling a list of top competitors in most cybersecurity product spaces and SIEM is no exception.

Below is the infamous magic quadrant (MQ) for SIEM:

You like it or not, leaders consume those before purchasing major pieces of any technology stack. Go here to learn more: https://www.gartner.com/reviews/market/security-information-event-management

The top-right corner is the "leaders quadrant". Unless you happen to be on a job where something else is being used, start considering learning and getting certified in those top products. This is a no-brainer!

Now, that's just one line of thinking. You should also enjoy working with a given technology. And here's what I also suggest you to evaluate:

  • From a user/developer perspective, how good is the interface and UX for interacting with data? How easy to get fluent in its query language?
  • The question above already removes vendors that do not enable Detection as Code which is another great feature that enables Detection Engineering, in general.
  • How easily can detection prototypes and query artifacts be shared with peers? That's a primary component for the community aspect. It's just easier to learn and stand out if you can easily consume and share ideas.
  • How can your work be recognized? Are there communities around the tech/product? Is the vendor also recognizing champions in the community of partners and users (think MVP programs)?
  • This is VERY important for me: how fast can I get from a hypothesis, to a query, to a chart/report? Data analytics is a must today.

Now, why a strong product, say, in India does not show a strong MQ positioning? There might be a heavy weighting toward US & EU enterprise markets. So, consider local/regional markets!

At Gartner you can also select products per region.

What about Open Source Software (OSS) and other products?

There's no doubt OSS enables anyone to learn the primary concepts needed in cybersecurity. I started with Linux myself: Netfilter, Snort, Squid and a bunch of other creatures you might never heard of!

However, the reality is that while those are really well valued in Big Tech, to really boost your chances in the enterprise market, you must have solid enterprise product experience.

Different from entry-level jobs, most freelancing opportunities demand senior level professionals. So if you are just starting, while you aim at some product certifications, OSS must definitely be part of your lab planning.

Now, back to the main idea here: should you learn Sysmon or EDR? The latter, no doubt about it! And before leaving a comment, check this one.

I leave as an exercise for you to pick the top EDR players but here are the technologies that will make a difference in your CV:

  1. SIEM/XDR and security data platforms, in general. That's where most data is. Have you heard about "Data Gravity"?
  2. EDR and other specialized detection products. Hands down, in enterprise, EDR is the top detection source.
  3. SOAR & 'Hyper Automation' products. Those are used to automate alert triage and Incident Response (IR). Gartner also has a page on that.
  4. Python & Scripting languages. It doesn't matter how good you are at prompt engineering or the latest AI tool, coding is a big asset here.

For all of the above, there should be a path to certification, which is a more credible way to stand out than simply listing product names on your CV.

Now, for #1, the next sub-section describes the real demand in more detail.

Data Literacy

Or should I say Log (Data) Literacy?

Data Literacy is the ability to understand, interpret, analyze, and act upon data to make informed decisions. In our case, it's the ability to leverage data to design and build detection controls and security analytics.

So how to get better at doing that? Well, you need to familiarize yourself with logs, the formats (CSV, JSON, XML), the data sources (endpoint, network, cloud) and how to manipulate them.

In statistics, exploratory data analysis (EDA) is an approach of analyzing data sets to summarize their main characteristics, often using statistical graphics and other data visualization methods — Wikipedia.

If you are into Splunk, here's how to perform EDA, as an example.

To cut it short: you need to know how to interrogate data.

Ultimately, it's about query fluency. SIEM content engineering boils down to questioning log data and for that you need to master the query language.

Also, that's not only needed for hunting or detection, but to build reports and interactive interfaces or dashboards that aid security teams.

For Splunk, that means knowing how to to get the most out of SPL. For Microsoft Sentinel and Defender XDR, it's mastering KQL.

What else?

I'd also add the following as differentiators in the hard skills bucket:

Lastly, for managing detection use cases development, a backlog is often maintained using Jira, Azure DevOps or GitHub.

Needless to say, having experience with those helps a lot, especially when the DE practice is not mature enough, lacking the proper processes, etc. So that's another good point to have in your CV.

Written by Alex Teixeira, independent consultant (contractor)

My new stories are public in the first 24h after publication. So don’t forget to subscribe to get notified when new content comes out!

You can also find me on LinkedIn where I drop Threat Hunting, Detection Engineering and Security Analytics insights.

Becoming a Detection Engineering Contractor, Part II— The Preparation was originally published in Detect FYI on Medium, where people are continuing the conversation by highlighting and responding to this story.

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

Article Link: Becoming a Detection Engineering Contractor, Part II— The Preparation | by Alex Teixeira | Mar, 2025 | Detect FYI