You have spent eighteen months triaging alerts, closing tickets inside SLA, and explaining to your manager why the SIEM flagged another false positive from the same misconfigured proxy. You are good at this. You are also underpaid for it, and you know the real money and the real interesting work sits one rung up: detection engineering.
The good news is that the path from SOC analyst to detection engineer is well worn, even if nobody hands you a map. The better news for contract consultants: clients pay a real premium for people who can write detections, not just react to them.
Here is the concrete route, the skills that actually move the needle, and which certifications are worth your time versus your money.
The Arc: SOC Analyst to Detection Engineer
This is not a straight ladder with fixed titles. It is a shift in what you produce.
- Tier 1 SOC analyst (year 0-1): Triage alerts, follow runbooks, escalate. You learn the SIEM as a consumer.
- Tier 2/3 SOC analyst (year 1-2): You start writing your own queries, tuning rules to cut false positives, and doing shallow incident investigation.
- Detection engineer (year 2-4): You build and maintain detection logic, own log source coverage, and get measured on detection quality, not ticket volume.
- Senior detection / purple team engineer (year 4+): You validate detections against real adversary emulation and feed findings back into the detection backlog.
Contract clients hire at every stage of this arc, but the rate difference between step two and step three is the biggest jump you will see in this whole career.
The Core Skill Stack
Certifications get you an interview. This skill stack gets you the offer and the renewal.
- SIEM fluency, not familiarity. You should be able to write a correlation rule from scratch in Splunk SPL, Sentinel KQL, or Elastic Query DSL — not just run a saved search someone else built.
- Log source enrichment. Know how to add context to a raw event: asset criticality, user role, threat intel tags. Enriched logs are what separate a useful alert from noise.
- MITRE ATT&CK mapping. Every detection you write should map to a specific technique ID. Clients now expect this as standard documentation, not a nice-to-have.
- Writing detections as code. Sigma rules, YARA, or vendor-native detection-as-code stored in Git with version history and peer review.
- Purple team exposure. Sitting in on red team exercises, even as an observer, teaches you how attackers actually move — and where your detections fail silently.
Certifications That Matter (and the Ones That Don't)
Do not spend your own money chasing every acronym. Here is what actually moves a contract résumé at this stage.
| Certification | Career stage | Verdict |
|---|---|---|
| CompTIA Security+ | Pre-SOC / Tier 1 | Fine as a foundation. Do not linger here past your first job. |
| CompTIA CySA+ | Tier 1-2 SOC | Decent signal for early SOC roles. Low ceiling beyond that. |
| Microsoft SC-200 | Tier 2 SOC / Detection | Strong if the client runs Sentinel or Defender. Directly testable skills. |
| Splunk Core Certified Power User / Advanced Power User | Detection engineer | Worth it if the shop runs Splunk. Vendor-specific but respected. |
| GIAC GCDA (Certified Detection Analyst) | Detection engineer | The strongest single credential for this exact transition. Expensive, but it maps directly to the job. |
| Security Blue Team BTL1 | Tier 2 SOC / Detection | Affordable, hands-on, well regarded by hiring managers who actually check labs. |
| MITRE ATT&CK Defender (MAD) | Detection engineer | Niche but relevant — shows you can operationalize ATT&CK, not just cite it. |
| CISSP | Senior / management track | Useful later for leadership roles. Largely irrelevant to hands-on detection work today. |
| OSCP | Purple team crossover | Valuable if you want the offense side of purple team, not required for pure detection roles. |
Building Proof, Not Just a Résumé Line
Contract clients hiring detection engineers want evidence, and a cert alone does not provide it. Build a small public portfolio: a handful of Sigma rules on GitHub with clear ATT&CK technique mappings, a writeup of a detection you built and how you validated it, and notes from any purple team exercise you have observed or supported.
If your current employer will not let you touch production detection logic, ask to shadow the detection engineering team informally, or volunteer for the next tabletop exercise. Every hour of visible exposure is leverage in your next contract negotiation.
What This Path Is Worth
Rate ranges vary by region, clearance requirements, and client industry, but the pattern we consistently see in placements holds:
- Tier 1-2 SOC analyst contracts: roughly $35-$55/hour
- Detection engineer contracts: roughly $65-$95/hour
- Senior detection / purple team contracts: roughly $90-$130/hour, higher with clearance or fintech/healthcare compliance work
The jump from tier 2 SOC to detection engineer is where most of that increase lives. It is also where most analysts stall, because it requires building detections, not just consuming them.
If you are mapping this path against real contract openings, the team at Josh Pros LLC talks with security engineers at every stage of this arc every week. Email contact@joshpros.com or visit https://joshpros.com if you want a second opinion on where you stand.
#DetectionEngineer #SOCAnalyst #SecurityEngineering #MITREATTACK #SIEM #CyberSecurityCareers #PurpleTeam #ContractIT #SecurityCertifications #BlueTeam
Talk to a real recruiter, not a bot.
We'll tell you the rate, the client, and the terms before you interview. And if we're not the right fit, we'll say so.