Lupe Tabasco

Dear Aspiring Security Engineer, Detection & Response (DART) is one of the most hands-on areas of security you can work in. Here are 5 things you need to know about it. ⬇️ - 1️⃣ Detection engineering builds the signals This is the build side. You write detections, tune out noise, make sure the right data exists, and build the platform the detections run on. Data → Detection Logic → Alert → Response A detection is only as good as the response it enables. 2️⃣ Incident response acts on the signals An alert fires. Now you have to figure out what actually happened. Is it real or a false positive? What's the scope? Which systems and identities are involved? How do you contain it? What needs fixing so it doesn't happen again? This is where your detections get tested. 3️⃣ You are your own customer DART is a hybrid role. You build the tooling, then you use that same tooling when you respond. Alert missing context? You feel it. Slow query mid-investigation? You feel it. Noisy detection? You feel it. That feedback loop makes the work better over time. 4️⃣ On-call is part of the job A lot of teams run a rotation. Every month or so you take a shift. On-call, your job is strictly operational. You triage and respond. Engineering work waits. The rest of the time you build detections, improve tooling, and fix what on-call taught you. On-call shows you what to build next. 5️⃣ Hunting and intel feed the loop They aren't in the name, but they support everything DART does. Intel tells you what attackers are doing. Hunting tells you if they're already in your environment. Both turn into new detections. Ask yourself: What would this attack look like in our data? Would we detect it today? Could we respond quickly? What did the last incident teach us? Detect, respond, learn, build. Then do it again.