SOC Detection Coverage Uplift

The brief

Northlight's last coverage assessment identified specific ATT&CK techniques with no reliable detection across its client base. You will build, tune, and validate detections against live telemetry, then defend your coverage in the next scheduled purple-team exercise.

What you'll need

• Coursework in detection engineering or security operations
• Comfortable being assessed live in a purple-team exercise

What you'll walk away with

• Measured detection coverage improvement validated in a live exercise
• A detection library entry attributed to you in Northlight's production tooling