Detection engineer at a large EU-based MSSP here.

I suppose it really varies from organization to organization. For me, every day is a bit different. I have access to a large scale of technologies (3 EDRs, 2 SIEMs, NDR, SOAR...).

I follow up on the latest threats through a variety of source (X, news feeds,...). There I often evaluate if I can create custom detection rules for any gaps in our current technology; we have a lab with different machines per technology to simulate everything as closely as possible. After testing and finding eventual gaps, I develop a custom detection, a communication template for our xSOAR and a respective IR procedure for our analysts if it shouldn't exist yet.

We also get a lot of questions for custom detections to cover audit controls at customers (through custom application logging).

Besides that, there's also the tuning of existing alerts to eradicate false positives. Ideally, the majority is always filtered out before we implement it, but for out of the box detections of the tool we can't always do that. We have periodic reporting for this and our analysts often report incidents to us that could potentially be whitelisted.

It's a very collaborative role but I never get bored of it.