My Route Brief
IT Support to Detection Engineer
IT Support to Detection Engineer in 2 stages, roughly 3 to 5 years from where you are now. IT Support to Detection Engineer is reachable but uncommon. The endpoint depends on org context, timing and trust, not just skill progression.
Free, no account, and held in this browser only. Route planning stays free permanently.
A share link carries the route and the planning constraints only. Your private note and your evidence progress stay in this browser and are not included.
Route summary
An intermediate role to consider before Detection Engineer: SOC Analyst or Defender/Sentinel Engineer. Authored detections and a maintained content lifecycle can support the move.
This brief applies shared Atlas guidance to your route and planning bands. It has not reviewed your CV or independently assessed your experience. A Career Verdict is a separate written report based on the inputs you submit.
The likely stall
Sigma or query fluency without testing and maintenance. Show shipped or clearly labelled lab detections, tuning decisions and observed false positives.
Two different things are being measured here. The hardest move to make is IT Support to SOC Analyst, because it is the least well-trodden: Pay often flattens for a year while you rebuild credibility in the new lane. The longest wait is elsewhere, at SOC Analyst, around 2 to 3 years, which is time in the seat rather than difficulty getting it.
Rough ranges
This is the estimate for the route still ahead of you, counted from IT Support. It is not total career experience: a destination marked as a late-career finish also counts the years you have already done. Time on each stage is a TechWaymark estimate for the stage itself, not a study plan.
No priced exams sit on this route. Training, lab time and course subscriptions are not estimated here, so treat this as an absence of exam fees rather than as a free route.
Pay progression
- IT Support
- SOC Analyst
- Detection Engineer
Salary and time figures are TechWaymark practitioner estimates, not survey data. Base salary, permanent, UK, outside London.
Planning constraints
These refine the planning. They do not change the market, and they do not make any outcome more likely on their own.
What could speed it up
- An internal move into Detection Engineer. Internal transfers skip the part of the market that screens on titles.
- Work that belongs to you by name. Panels shorten the loop when there is a system they can ask you to explain.
What could make it unrealistic
- Nothing in the constraints you set contradicts this route. That is not the same as the route being easy: the stall above still applies.
Evidence checklist
0 of 8 with evidence recorded. These are your own assessments, not verification by TechWaymark. Keep an example you can explain for each item.
Stage 1. IT Support to SOC Analyst
Employment stage. Arriving here means holding a SOC Analyst job.
One alert or incident you worked end to end, written up in a page
Explain what fired, what you checked, what alternatives you considered and how you reached a conclusion.
A log source you can describe in detail, including what it misses
Describing coverage and blind spots makes your understanding of the log source inspectable.
A control you changed, and the ticket or change record behind it
A change record can show your role and approval process. Label lab work explicitly and remove confidential details.
Something from your IT Support work that a SOC Analyst panel would count
Most SOC analysts come through support, alert triage rewards ticketing instincts.
Stage 2. SOC Analyst to Detection Engineer
Employment stage. Arriving here means holding a Detection Engineer job.
A detection rule you authored, with the behaviour and telemetry it covers
Show the query or rule, the required log fields and the activity it is intended to identify. Label lab work clearly and remove confidential data.
A repeatable test or replay showing when your detection fires and when it should not
Positive and negative test cases make coverage and blind spots discussable; writing a query alone does not show it works.
A tuning decision and version history, including the false positives or coverage tradeoff
Record why the rule changed, how you checked the effect, and how another analyst would investigate its alerts. Use observed results rather than invented metrics.
Something from your SOC Analyst work that a Detection Engineer panel would count
Detection engineering is the natural senior path out of SOC.
Private note
Stored in this browser only. It is never sent to TechWaymark and it is never included in a share link.
No private note recorded.
Assumptions
- Plotted under the most realistic optimisation. A different optimisation gives a different route for the same pair.
- Salary and time figures are TechWaymark practitioner estimates, not survey data.
- Time on a stage is how long the seat usually takes to earn, not how long the study takes.
- These refine the planning. They do not change the market, and they do not make any outcome more likely on their own.
- No region set, so the figures are UK national and outside London.
- 2 of 2 transitions on this route carry a written TechWaymark judgement. The rest are inferred from the map.
TechWaymark estimates UK mid-career base salary and typical time on a step for every role on the Atlas. The figures are judgement calibrated against job adverts and practitioner experience, not a salary survey, and they carry no employer, region or sector breakdown. They are precise enough to rank routes and to flag a hop that is a large step; they are not precise enough to plan a negotiation around.
Weighing up a certification
The Certification Decision Tool answers whether an exam is relevant to this route now, later, or not at all. Free, and it cites the record behind every claim.
If the gap is on paper rather than in the work
The brief names what a panel would ask to see. Two TechWaymark products read what you have written down instead.
- CV Evidence Review. A paid review of what your document proves, with a free synthetic sample to inspect first.
- Career Verdict. Paid, judges the move itself rather than the route drawing.
Make this your plan
A route you can come back to.
The free Route Brief remains available to plan, print and save on this device. My Waymark adds an account-based saved route, dated progress history, evidence notes, practical exercises and interview practice. Separately purchased written reports are not included. Subscriptions are not open yet; explore the example before launch.
Plotting and briefing stay free. Back to the Atlas.