Description

A focused course, tailored for you

The Bank Security Analyst Detection-Engineering Playbook

Turn the queue of alerts, threat-intel emails and audit pings into a documented detection programme that holds up under FFIEC and SOX 404.

You catch real attacks. Then you spend Friday afternoon trying to prove to internal audit that you caught them, using screenshots and saved searches nobody else can read.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

A bank security analyst's day is a mix of three queues nobody outside the SOC sees in the same window. The SIEM alert queue with detections you wrote, refined and now half-trust. The threat-intel inbox with IOCs from FS-ISAC, the OCC alerts list and the federal advisories. The audit-ask folder where internal audit, the FFIEC examiners, the SOX 404 control owners and the third-party risk team all want evidence in different shapes.

The technical work is fine. The detections fire, the SOAR playbooks run, the tickets get closed. The gap is everything around the detections. Sigma-style version control of rules. ATT&CK coverage maps that show the board what is and is not covered. Purple-team test cases that prove a rule still works after a SIEM upgrade. SOX 404 control narratives that explain to an auditor, in language they read, how alert-to-ticket-to-resolution maps to a control activity. FFIEC IT handbook citations for each layer of the monitoring stack. None of that is in the security analyst job description, but all of it lands on the analyst's desk because nobody else has the underlying knowledge.

The course teaches the discipline that closes that gap. Not a SIEM tool tutorial. The engineering practice that turns ad-hoc rule writing into a documented, testable, audit-defensible detection programme.

What you walk away with

Version-controlled SIEM detection content in a Sigma-style repository, with peer review and rollback.
An ATT&CK coverage map that shows which techniques the bank can detect today, which are partial, which are blind.
Purple-team test cases for the top twenty detections, replayable after every SIEM platform change.
SOX 404 control narratives and FFIEC IT handbook citations for the monitoring stack you own.
A documented detection-engineering practice an examiner can read in one sitting and understand.

The 12 modules

Module 1. The detection-engineering operating model for a bank SOC

The shift from ad-hoc rule writing to a documented detection-engineering practice. Roles, RACI, intake from threat intel and from incident retros, peer review, deployment, decommission. How the practice sits beside the SOC's tier-one and tier-two triage queues without disrupting either. The output is a one-page operating model your manager can take to the CISO.

Module 2. Sigma and detection-as-code for Splunk and Sentinel content

Authoring detections in Sigma, converting to SPL or KQL, storing rules in Git, peer-reviewing pull requests, and deploying through a CI pipeline into the production SIEM. The module walks through repository structure, naming conventions, metadata fields and the test harness that runs on every commit. By the end you have a working repo with five real bank-relevant detections and a documented review process.

Module 3. ATT&CK coverage mapping for a US retail-bank threat model

Building an ATT&CK coverage map calibrated to the techniques that actually matter for a retail bank: credential theft against tellers and call-centre staff, BEC against treasury, lateral movement from a compromised vendor laptop, ATM-network abuse, payment-rail manipulation. The module includes a scoring rubric for full, partial and no coverage, and the heat-map output the board CRO wants to see.

Module 4. Threat-intel intake from FS-ISAC, OCC alerts and vendor feeds

Turning the threat-intel inbox into a structured intake. How an FS-ISAC indicator becomes a detection candidate, how it gets prioritised against ATT&CK coverage gaps, and how it ends up either as a Sigma rule, a watchlist, a SOAR enrichment, or an explicit decision not to detect. Worked example uses a real FS-ISAC TLP:AMBER bulletin shape.

Module 5. Purple-team test cases and detection regression testing

Writing test cases that prove a detection works and keep proving it after every SIEM upgrade or data-source change. Atomic Red Team mapping, custom adversary emulation for bank-specific techniques, Caldera and Stratus Red Team for cloud. The deliverable is a regression suite for the top twenty detections that runs nightly and reports drift to the engineering team.

Module 6. SOAR playbooks that enrich detections without hiding them

Designing SOAR playbooks that automate enrichment and containment for the high-confidence detections, while leaving the human-in-the-loop steps explicit for the medium-confidence ones. The module covers playbook documentation, version control alongside detection content, and the audit trail an examiner wants when an automated containment fires on a customer-facing system.

Module 7. FFIEC IT Examination Handbook citations for monitoring controls

Mapping the detection content and the SOC operations against the relevant FFIEC IT Examination Handbook booklets, specifically Information Security and Operations. The module produces a citation table that lists each control objective in the booklet, the detection content and SOC procedure that satisfies it, the evidence file the examiner can review, and the gaps that need remediation.

Module 8. SOX 404 control narratives for the security-monitoring layer

Writing SOX 404 control narratives the external auditor reads in fifteen minutes. The module covers control activity, control owner, frequency, automated versus manual, sample-of-one versus full-population testing, and the evidence-collection routine that does not require a Friday-afternoon screenshot session. Deliverable is six narratives covering the security-monitoring controls that touch financial reporting systems.

Module 9. Insider-threat and privileged-access detections in a banking environment

Detection patterns for insider threat in a bank: privileged-access abuse, after-hours access to customer PII, unusual transfers from a teller workstation, developer access to production data, third-party administrator behaviour. The module addresses the legal and HR boundaries that make insider-threat detection a documentation discipline as much as a technical one.

Module 10. Cloud and SaaS detection content for Microsoft 365, AWS and Snowflake

Detection content for the cloud and SaaS layer a retail bank actually runs: Microsoft 365 for productivity, AWS or Azure for the modern data platform, Snowflake or equivalent for the analytics warehouse, GitHub for code. KQL and SPL patterns for OAuth abuse, IAM role assumption, exfiltration via cloud storage, and CI pipeline tampering, with the data-source onboarding steps for each.

Module 11. Reporting to the CISO, the board CRO and the regulator

The three reporting cadences that consume detection-engineering output. The CISO weekly that needs detection coverage, mean time to detect and top-of-mind threats. The board CRO quarterly that needs the ATT&CK heat map and the operational-risk implication. The OCC examination response that needs evidence citations and remediation timelines. The module supplies the report templates for all three.

Module 12. Career path: from security analyst to detection engineer to security architect

The skill ladder that the detection-engineering practice opens up. What the next two roles look like (detection engineer, then security architect with a detection-engineering specialism), the artefacts and metrics that move you between them, and the conference talks and open-source contributions that compress the timeline. The module is a self-directed roadmap, not a promise.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

When the SIEM upgrade breaks half your detections and nobody knows which ones until they stop firing.

When internal audit asks for the SOX 404 narrative on the monitoring control and the answer is currently a screenshot of a saved search.

When the FS-ISAC bulletin arrives at 09:00 and the question is whether you already detect it, partially detect it, or have to build something.

When the OCC examiner asks how monitoring of customer-facing systems maps to the FFIEC IT handbook and the answer is a verbal walk-through.

What you get with this course

Twelve text-based modules in the Art of Service learning environment, each with downloadable templates and worked examples.
A Sigma-style starter repository for bank-relevant detections, with a CI test harness.
ATT&CK coverage map template and scoring rubric calibrated to a retail-bank threat model.
FFIEC IT Examination Handbook citation table template for the monitoring layer.
SOX 404 control narrative template, six worked examples for security-monitoring controls.
The hand-built implementation playbook, tuned to your stack and audit cadence, delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours of purchase the learning environment account is provisioned.

Twelve modules, each completable in 60 to 90 minutes of focused work, plus exercises.

The hand-built implementation playbook is delivered alongside course access and tuned to your stack.

Suggested cadence: two modules a week over six weeks, with the implementation playbook actioned in parallel.

Before and after

Before

Detections live as saved searches in one or two analysts' heads. The ATT&CK coverage answer is a guess. Every audit cycle the evidence gets rebuilt by hand. FFIEC and SOX questions get answered with screenshots and a verbal walk-through.

After

Detections live in a Git repository with peer review and a test harness. ATT&CK coverage is a heat map the board CRO sees quarterly. FFIEC citations and SOX 404 narratives are documented, evidence files attach themselves, and the next audit cycle is a review, not a rebuild.

What happens if you do not address this

The detection content you wrote becomes tribal knowledge that walks out the door when you take a new role. The next audit cycle eats a month of the team's calendar. The first OCC matter requiring action against the monitoring programme would land on whoever happens to be in the room.

Who it is for

Security analysts and senior security analysts inside US retail and commercial banks, who own SIEM content, run a chunk of the SOC's day-to-day detection work, and increasingly get pulled into audit-evidence and control-narrative conversations they were not hired for. Two to seven years in, comfortable in Splunk or Sentinel, decent with Python or KQL, but no formal detection-engineering training and no clean way to prove to FFIEC examiners how the monitoring layer actually meets the control objective.

Who this is NOT for. CISOs looking for a strategy framework. Greenfield SOC managers building a programme from zero. Vendors selling detection-content marketplaces. Penetration testers and red-teamers who do not own SIEM content. Junior tier-one analysts whose job is ticket triage, not rule authoring.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly 14 to 18 hours of module work, plus 6 to 10 hours actioning the implementation playbook against your own SIEM repository, audit cadence and reporting templates.

Why $199 is the right number

SANS detection-engineering courses are excellent and cost five to seven thousand USD. Vendor-specific Splunk or Sentinel certifications teach the tool, not the bank-context discipline. Free MITRE ATT&CK material covers the framework, not the operating model around it. This course sits between those: bank-specific, practice-focused, with the implementation playbook handing you the artefacts an auditor and an examiner actually want.

FAQ

Is this Splunk-specific or Sentinel-specific?

Detections are taught in Sigma and then converted to SPL and KQL. The repository structure, peer-review pattern and test harness work for either platform. The worked examples include both.

I am a senior analyst, not a detection engineer. Is this still relevant?

Yes. Most US bank SOCs do not yet have a dedicated detection-engineer role. The course is written for the senior analyst who is doing the work informally and wants to formalise it, document it and use it as the basis for the next role.

Do I need management buy-in to apply this?

The first three modules give you the operating-model artefacts that get buy-in. The implementation playbook includes a one-page brief tailored to your reporting line.

What if our SIEM is something else entirely?

The discipline is platform-agnostic. The Sigma layer, the test harness pattern, the ATT&CK coverage map, the FFIEC citations and the SOX narratives all carry across. Mention the platform when the implementation playbook is being built.

Is there a refund policy?

Yes. 30-day money-back, no questions asked.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.