Quit SOC! The Detection Engineer Job Advertised at $330,000
If you work in a SOC, this one is for you. A detection engineer job at Fluidstack was advertised at up to $330,000 a year, and one line in the ad stopped me: you'd run incident response end to end "without a large SOC to fall back on."
I'm not going to tell you AI has taken your job. You're probably sitting on a full alert queue right now, so you know it hasn't. Not yet. Your job is fine today. The problem is the way up. For years the SOC analyst career path was a ladder: two years on Tier 1, move up to Tier 2, keep climbing. That ladder only works if the bottom rungs are still there, and they're breaking.
In this guide, we'll look at the job ads that show what's replacing those rungs, why one detection engineer can be paid what a floor of analysts used to cost, the proof employers want that almost nobody applying can show, and how to start building it this week from the job you already have.
TL;DR if you've only got 30 seconds
Your SOC job is fine today. The Tier 1 work you'd normally learn on is what AI and automation are taking first, so the bottom of the ladder is breaking.
The new way up is detection engineering: building the detections the automation runs. Real ads advertised $155,000 to $180,000 for a role within reach, and up to $330,000 at staff level.
The proof employers want: a detection in version control, tested against historical data before it goes live, with a false positive number you can say out loud.
Start this week: read the free book, get an AI coding agent, build one tested detection, and put it in Git.
A $330,000 Job With No SOC Behind It
Fluidstack runs AI compute infrastructure, the data centres that big AI models train and run on, at what its own ad calls "gigawatt-scale." It advertised a Staff Detection Engineer role to build the detection engineering function "from the ground up." There's no big SOC being cut here. The ad describes one senior engineer owning detection and response, work that in a lot of companies sits on top of a floor of analysts.
Why would a company work that way? Because attackers are starting to move at machine speed, and you can't hire people fast enough to keep up with that. So companies are building software to handle the response instead of staffing a room full of analysts to do it. That's not a judgement on analysts. It's economics: when the alerts double, software can keep up, and hiring twice the people can't.
⚠️ Read this first: the $330,000 is the top of an advertised range, not a typical salary, and it's a staff-level role asking for 8+ years. When we captured the ad in July 2026 its range topped out at $330,000. Fluidstack has since republished the same posting (20 October 2026) at $224,000 to $344,000. It's the top of the ladder, not the rung you get on at.
So if that's the top of the new ladder, what happened to the bottom of the old one?
Why the SOC Analyst Career Path Is Breaking
Think about what a Tier 1 analyst actually does all day. Watch the dashboards. Triage each alert: is it real or noise? Follow the playbook, the written step-by-step procedure for that alert type. Write up the ticket. Escalate the ones that need a more senior eye.
When we broke the Tier 1 SOC analyst role into its tasks for JobZone Risk, our free tool that scores jobs on how exposed they are to AI, monitoring came to about 30% of the day, triage 25%, playbooks 20% and tickets 15%. In JobZone's assessment, that 90% is work AI agents can now do end to end. Only escalation, the last 10%, still needs a person as the main actor. JobZone scores every role from 0 (most exposed to AI) to 100 (safest), and Tier 1 SOC analyst scores 5.4, deep in the red.
Employers are saying the same thing. In a McKinsey survey of 104 large-enterprise security buyers in North America and Europe, published March 2026, 35% said they expect AI agents to replace their Tier 1 SOC analysts within three years. And on Torq's website, Carvana's CISO, Dina Mathers, is quoted saying "Torq Agentic AI now handles 100% of Carvana's Tier-1 security alerts." That's a vendor showcasing its own customer, so take the exact number however you like. The direction is the point.
Here's why that hurts even if your own job is safe for now. The senior roles are still there. But the way you used to reach them was years of Tier 1 work, and that's exactly the work being automated. You were promised a ladder, and the rungs you were meant to climb are the ones being removed. So what replaces them? One company wrote the answer straight into its job ad.
What Lumin Digital's Detection Engineer Ad Says Out Loud
Lumin Digital builds digital banking for credit unions and banks. In July 2026 it advertised a remote US Detection Engineer role at $155,000 to $180,000, and the first paragraph of the ad reads like a note written directly to SOC analysts. I read a lot of these postings, and most of them hint at the change. This one just said it.
📄 In the ad: the full sentence reads: "This is not a traditional SOC analyst seat. AI-driven triage and SOAR platforms now handle the bulk of routine alert processing, and the analysts who thrive in the modern SOC are the ones who build the detections those platforms execute, author the automation playbooks that accelerate response, and hunt proactively for threats that evade automated pipelines." (Lumin Digital, archived copy, captured 26 July 2026; the ad has since closed.)
💡 In plain English: SOAR stands for security orchestration, automation and response. It's the software that runs your playbooks for you: it takes an alert, gathers the context, and does the routine steps automatically. If the automation is now doing the routine alert work, the people who stay valuable are the ones who decide what the automation does.
Read that ad again and you can see the new job in three parts:
Build the detections. Write the rules the triage platform runs, rather than reacting to whatever it raises.
Write the automation. Author the playbooks that speed up the response, so routine alerts close without you.
Hunt for what the automation misses. Go looking for the attacks that slip past the automated pipeline.
The people who do those three things are the ones who stay valuable. That's one company saying it outright. The next one never said it at all. It just built the team that way.
Fluidstack: Detection as Code at Scale
Back to Fluidstack. Its ad asks for 8+ years, so this is the top of the ladder, not where you get on. But look at how it describes the work, because it's the same shift at a bigger scale:
📄 In the ad: "Stand up detection-as-code pipelines so every detection is versioned, tested, and deployed like software rather than hand-edited in a console." And: "Drive automation of triage and enrichment in Python (or similar) so alert volume scales without proportional headcount." (Fluidstack, Staff Detection Engineer, checked 22 October 2026.)
💡 In plain English: detection as code means treating each detection rule like a piece of software. It lives in a version control system such as Git, it has tests, and it's deployed automatically. The opposite is someone logging in to the SIEM console and editing a live rule by hand, with no record of who changed what.
One honest note, because it matters. Fluidstack's ad doesn't ask for any AI skills. Its argument is about how the team is built: automation handles the alert volume, so the team doesn't have to grow every time the alerts do. In the ad's own words, alert volume scales "without proportional headcount." So it's the same story from two angles. Lumin says it outright. Fluidstack just built it.
Which raises the obvious question: if the automation does the watching, what does the detection engineer actually do all day? The easiest way to see it is side by side.
The Old Way vs the AI-Driven Way to Build a Detection
Let's take one detection, say a rule that spots a password spraying attack against your VPN, where an attacker tries one common password against lots of accounts.
The old way runs in one direction. Someone writes the rule straight into the console. There are no tests and no version control. If it's noisy, you find out when the queue fills up. And when the queue grows, the only fix this way of working offers is more people.
To be fair, you don't need AI to do detection as code. Plenty of teams already keep their rules in Git and test them, and Fluidstack's ad asks for exactly that with no AI requirement at all. What AI changes is how fast one person can work that way.
The AI-driven way is the same job done differently. In the video I show it as a short sped-up demo. Here's what happens, step by step:
You describe the detection. In plain words: what the attack looks like and which logs show it.
The system writes it. An AI coding agent drafts the rule, in a standard format such as Sigma, a shared language for detection rules.
Tests get generated alongside it. Examples that must trigger the rule and examples that must not.
It runs against historical data first. Before it ever sees a live alert, the rule is replayed against old logs, so you see how it would have behaved.
The false positives are counted, not guessed. How many times it fired, over a set period of logs, on activity you've checked was harmless. Too many? Refine it and run it again. The tests from step 3 also prove it still catches the attack.
Then it's committed. Saved to version control, with a record of what changed and why.
Same output the old way promised, but faster and provable. That's what I mean by AI-driven security engineering: you direct the AI, and the engineering discipline keeps it honest. If you want the whole method behind it, it's in Agentic Engineering: How to Work 10-40x Faster With AI.
But if the AI writes the rule and the system runs the tests, it's fair to ask what's left for you.
What AI Can't Do: Strategy and Ownership
Let's be straight about what you're up against. The AI doesn't need you to notice a bad login or a strange outbound connection. Spotting a pattern like that is exactly what it's built for, or it's what you build into the system yourself. At that execution layer, it will be faster than you. The watching isn't yours anymore.
Here's what it can't do:
Decide what's worth building. Which detections should exist in the first place, and what has to be architected around them.
Know the strategy. Which gaps in your coverage actually matter, given what's real for your company and how much risk it will accept.
Own the call. When something gets flagged wrongly, or an attack gets missed, someone has to be accountable. A model can't be.
So you're not the analyst anymore. You're the one who decides what the AI watches for, and the one who answers for it when it misses. Think of a building site: the AI is the labourer, and you're the architect. And architects are paid on a different scale, which brings us to the money.
Detection Engineer Salary: From $155,000 to $330,000
Lumin's detection engineer role, at $155,000 to $180,000, is one you can realistically reach: a step up from where you sit, but within reach. It asked for detections you've built, automations you've written, and threats you've hunted that the pipeline missed.
Climb from there and you land somewhere like the Fluidstack role. Same proof, just more of it: a whole function built or scaled by you. In between sit roles like Dropzone AI's Detection Engineering Lead, advertised at $200,000 to $250,000. Dropzone's product takes repetitive day-to-day SOC work off human analysts, and that ad asked its lead to "Prototype, validate, and continuously improve an AI agent that programmatically generates detection content" (archived copy, captured 27 July 2026; the ad has since closed). Same ladder, real rungs this time.
Those are three ads. To see how they compare with the rest of our archive, I looked at the listings behind AI-Driven Cyber Security Jobs, where every listing is read in full and saved with the employer's exact wording. Its detection and SOC area holds 173 AI-driven listings. Of those, 56 stated a salary range in US dollars. Half of those ranges topped out above about $230,000, and 9 topped out at $300,000 or more.
⚠️ Read this first: these are advertised ranges, not what people take home. They lean senior, because senior roles are more likely to publish a salary. And it's an archive of ads we've captured, not a list of open vacancies, so many have closed. Use them to see where the ladder goes, not to price your next offer.
For the wider picture on pay, see Cybersecurity Salary Statistics and Highest Paying Cybersecurity Jobs. But a salary range only helps if you can get hired into it, and that comes down to one kind of proof.
The 3-Part Bar Employers Want You to Clear
These postings point at the same kind of proof, worded differently: detection as code, a pipeline, a function you built. And to be clear, having written a few rules, or pushed a Snort signature live once, isn't it. Here's the bar I'd recommend you hold your own work to. It has three parts:
It lives in version control. There's a history of what changed and when, instead of a live edit on a box nobody can trace.
It's tested against real historical data first. Before it ever sees a live alert, you know how it would have performed.
The test gives you a number. A false positive count over a set period, say false alerts across 30 days of logs, alongside proof it still catches the attack. Something you can say out loud in an interview. Not "I think it works." A number.
For more and more of these roles, AI is part of how you build that pipeline. It's in the requirements themselves. Lumin's ad said "Demonstrated experience using AI-assisted development tools (e.g., Claude Code, Codex CLI, or similar) in a professional engineering or security workflow is required." That's Claude Code, named in a security job ad.
Now, anyone can let an AI vibe code a detection, which means accepting whatever it hands back without checking it. That's the shortcut. The AI-driven engineer does the opposite. They take the discipline that's been standard in software engineering for decades (version control, testing, review) and build it into how the AI writes. Then they judge the output and own the number it produces. That's the actual job, and it's the one thing almost nobody applying for these roles can show. So how do you start building it?
How to Start Building the Proof This Week
You don't need permission from anyone to start this. Three steps:
Read the free book on AI-driven engineering. It explains the whole way of working and how to get started: Become the Cyber Security Expert the AI Era Demands.
Get an AI coding agent and play with it. Something like Claude Code or OpenCode. Use it on small tasks until directing it feels natural.
Build one tested detection. Point the agent at a free public log dataset (there are plenty). Direct it the way I described above: one detection, its tests, a run against those logs. Count how often it fires when it shouldn't. That's your false positive number. Put it in Git, and put it in front of your boss.
And people do make this jump. Jacob, one of our students, came to us with a generalist tech background. We built him a roadmap to match his experience, he had mentorship and our Inner Circle community, and he did real work he could put in front of hiring managers, including agentic solutions he could show them. He recently landed an Enterprise Security Architect role at $213,000 a year. Not a junior seat. His move was into security architecture rather than detection engineering, but the lesson is the same: showable engineering work is what gets you hired.
Where This Leaves You
Everything in this guide is a skill: directing the detection, testing it against real data, and owning the number it produces. And you already have the expensive half. Your years in the queue taught you what's real and what's noise, and that's exactly what these detection roles are built on. What's missing is the engineering layer around it.
That's what we teach in the AI-Driven Security Engineering Masters Program, with mentorship from me and my senior team, so you can move into these roles. You finish with a working AI-driven detection system you can open in an interview. Certifications get you the interview. A build and real capability get you the job.
If you're not there yet, start with the free book, then see who's hiring in the detection and SOC listings. And if you're wondering how far the same shift reaches beyond the SOC, read Will AI Replace Cybersecurity Jobs?
Frequently Asked Questions
What is a detection engineer?
A detection engineer writes and maintains the rules that decide which security events become alerts. Instead of working through the alert queue, they build what fills it: detection rules kept in version control, tested against historical log data, and measured by how often they fire when they shouldn't.
How much does a detection engineer make?
Advertised ranges vary a lot by level. Lumin Digital advertised $155,000 to $180,000 for a remote US detection engineer, and Fluidstack advertised up to $330,000 for a staff-level role in July 2026. In our archive of AI-driven detection and SOC job ads, half of the US ranges topped out above about $230,000. These are advertised bands, skewed to senior roles, not typical take-home pay.
Will AI replace Tier 1 SOC analysts?
Not all at once, and not today for most teams. But the direction is clear: in a McKinsey survey, 35% of enterprise security buyers said they expect AI agents to replace their Tier 1 SOC analysts within three years, and Carvana's CISO said Torq's AI handles 100% of its Tier 1 alerts. The bigger problem is the path up, because the Tier 1 work people used to learn on is the work being automated.
How do I move from SOC analyst to detection engineer?
Build proof you can show. Write a detection, keep it in Git, test it against historical log data before it goes live, and record how often it fires when it shouldn't. Use an AI coding agent to help you build it, but check its work and own the result. Your years in the alert queue are the expensive half; this adds the engineering half.
Do detection engineer jobs require AI skills?
Some now do. Lumin Digital's detection engineer ad said experience with AI-assisted development tools such as Claude Code or Codex CLI is required. Others, like the Fluidstack staff role, ask for detection as code and automation without any AI requirement. Either way, the engineering discipline is the common thread.
About the Author
Nathan House, Founder & CEO of StationX
Nathan House has 30 years of hands-on cybersecurity experience and is Cambridge-educated, holding CISSP, CISA, CISM, OSCP, CEH, and SABSA. He founded StationX in 1999 — one of the UK’s first cybersecurity companies — and has secured £71 billion in UK mobile banking transactions and the London 2012 Olympics, advising clients including Microsoft, Cisco, BP, Vodafone, and VISA. He authored the world’s most popular cybersecurity course — a #1 Udemy bestseller taken by over 500,000 students — and was named Cyber Security Educator of the Year 2020, AI Security Educator of the Year, and a UK Top 25 Security Influencer 2025. A DEF CON speaker and featured expert on CNN, Fox News, NBC, and the BBC, Nathan leads StationX’s training of more than half a million students worldwide.
