Ryan Fetterman, a seasoned security researcher at Talos, recently shared insights from his 15-year career, transitioning from federal Security Operations Centers (SOCs) to his current role. His experiences offer valuable perspectives on the persistent challenges in detection engineering, the evolving nature of adversary tactics, and the practicalities of building a career in cybersecurity, as detailed in a recent interview with Talos Intelligence. This discussion provides context for security professionals grappling with advanced persistent threats (APTs) and the necessity for dynamic defense mechanisms.
The Evolution of Detection Engineering
Fetterman’s journey began in federal agencies in the DC area, where he gained initial exposure to security operations, including extensive work with Splunk for log data analysis, visualization, and analytics. This early experience in querying vast datasets and building detections proved to be a natural fit, shaping his specialization in host-based analytics. He emphasizes that finding one’s niche in security should not be rushed but rather emerges through practical experience.
He recounted a pivotal moment early in his career: his first advanced persistent threat (APT) incident, which he refers to by its Command and Control (C2) name, “Pandora Song.” This incident occurred while he was developing some of the earliest host-based analytics in a federal SOC. The experience underscored the creative and often frustrating ways attackers evolve their tactics to circumvent traditional defenses. This hands-on encounter with an active threat highlighted the critical need for advanced detection methods, marking a significant step in the development of sophisticated host-based analytics for APT detection.
Attacker Evasion and Adaptive Strategies
Fetterman’s career has been significantly shaped by the constant cat-and-mouse game between defenders and attackers. He highlights that adversaries continuously refine their methods, forcing detection engineers to innovate and adapt. This dynamic environment requires security teams to move beyond static signatures and develop more intelligent, behavior-based detection logic. The ability to anticipate and respond to novel attacker TTPs is paramount for maintaining effective defenses.
Practical Security Research Career Path
Fetterman’s career trajectory, from consulting to specialized research with the Splunk SURGe team and eventually Talos (following Cisco’s acquisition of Splunk), illustrates a successful practical security research career. He advocates for hands-on, project-based learning as a foundational element for career growth, noting that certifications and formal education are valuable but must be complemented by real-world application. His philosophy centers on the idea that specialization emerges organically from practical exposure and genuine interest, rather than being a forced early decision.
Actionable Recommendations for Security Professionals
For organizations and individual security professionals, Fetterman’s insights offer several key takeaways:
- Prioritize Adaptive Detection: Recognize that static defenses are insufficient against evolving APTs. Invest in tools and methodologies that support dynamic, behavior-based detection engineering, constantly refining analytics based on new threat intelligence.
- Invest in Host-Based Monitoring: As demonstrated by the “Pandora Song” incident, host-based sensors and analytics are fundamental for identifying intricate attack progressions. Ensure comprehensive logging and analytical capabilities at the endpoint level.
- Foster Analyst Development: Support continuous learning and practical experience for security analysts. Encourage project-based learning and provide opportunities for hands-on engagement with threat data to address detection engineering challenges effectively.
- Prevent Burnout: Fetterman also touched on the importance of work-life balance, advising security professionals to find time away from the keyboard. This is essential for long-term career sustainability and maintaining high performance in a demanding field.
By embracing an adaptive mindset in detection engineering and committing to continuous professional development, security teams can enhance their resilience against sophisticated adversaries.
Related: The Agentic SOC: From AI Theater to Real Defense, Talos Intelligence at Black Hat: Diverse Journeys in Threat Research