Summary: Deciding between niche Identity Security and general Detection Engineering is a classic career crossroads; I break down why Identity is the “new perimeter” and how mastering ITDR early on acts as a force multiplier for your entire engineering career.

Identity vs. General Detection: Pigeonhole or Power Move?

I remember a particularly bad Tuesday back in 2019 at a previous gig. We had all the fancy endpoint detection tools—CrowdStrike, SentinelOne, the works. Our SOC dashboard was solid green. Meanwhile, an attacker had simply bought a lateral movement script and a set of credentials for svc-backup-02 off the dark web. They didn’t “hack” in; they logged in. We spent 12 hours chasing ghosts because we were watching processes, not identities. We were staring at the front door while the thief was walking around the living room wearing a “Landlord” nametag. That’s when I realized: Identity isn’t just a lane; it’s the whole damn highway.

The “Why”: The Perimeter Has Collapsed

The anxiety driving this question is valid. You are worried that if you specialize in ITDR (Identity Threat Detection and Response) now, you’ll be stuck as the “Active Directory Janitor” while everyone else gets to play with cool cloud toys.

But here is the reality check: The days of the firewall perimeter are dead. In a cloud-native world—whether we are talking prod-api-cluster in AWS or a hybrid Exchange setup—Identity is the control plane. Almost every modern major breach involves credential abuse. If you understand how a token is minted, stolen, and replayed, you understand the kill chain better than the generalist who just watches syslog for port scans.

Option 1: The Quick Fix (The “Specialist Sprint”)

If you want to get hired fast and reach a Senior title quickly, ITDR is currently the path of least resistance. The market is flooded with generalist SOC analysts who can read a Splunk alert but don’t know the difference between NTLM and Kerberos.

The “Quick Fix” is to lean hard into the specific tools that are dominating the market right now: Microsoft Entra ID (formerly Azure AD) and Okta. By becoming the person who can spot a Golden Ticket attack or a Token Replay, you become indispensable immediately.

Pro Tip: Don’t just learn the UI. Learn the query languages. If you can write KQL (Kusto Query Language) to find anomalies, you are already ahead of 90% of the pack.

Here is a quick example of what “specialized” detection looks like versus general detection. This KQL snippet looks for a “impossible travel” scenario which is bread-and-butter ITDR:

SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType == 0
| project UserPrincipalName, Location, IPAddress, TimeGenerated
| sort by UserPrincipalName, TimeGenerated asc
| serialize 
| extend prev_Location = prev(Location), prev_Time = prev(TimeGenerated)
| where Location != prev_Location and isnotempty(prev_Location)
| extend TimeDiff = datetime_diff('minute', TimeGenerated, prev_Time)
// If they moved countries in under 10 minutes, that's a problem
| where TimeDiff < 10 

Option 2: The Permanent Fix (The "Protocol Master")

The fear of specialization is that the tool will disappear. The solution? Don't learn the tool; learn the protocol. This is the "Permanent Fix" for your career longevity.

Identity is built on standards: OIDC, SAML, Kerberos, LDAP. These aren't going anywhere. If you specialize in ITDR but focus your learning on how authentication works under the hood, you are effectively a generalist with a superpower. When I interview a candidate, I don't care if they know the CrowdStrike button layout. I care if they know why passing the hash works on win-server-2019.

If you master the protocols, you can pivot to Cloud Security, AppSec, or Architecture later with ease because everything requires auth.

Option 3: The 'Nuclear' Option (The "Identity Architect")

If you dive into ITDR and realize you hate chasing alerts, you pull the Nuclear Option: You pivot from Detection to Engineering/Architecture.

Most organizations have terrible IAM (Identity and Access Management) hygiene. They have service accounts like svc-jenkins with Domain Admin privileges because "it broke when we restricted it." A background in ITDR makes you the perfect candidate to fix the architecture so detection isn't even necessary.

You stop being the person carrying the pager at 3 AM and start being the person designing the systems. You move from "How do I detect this attack?" to "How do I build this environment so this attack is impossible?"

My advice? Start with ITDR. It’s the "new perimeter," and even if you broaden out later, that deep knowledge of who has the keys to the castle will make you a better engineer than the generalists.

Darian Vance

Lead Cloud Architect & DevOps Strategist

With over 12 years in system architecture and automation, Darian specializes in simplifying complex cloud infrastructures. An advocate for open-source solutions, he founded TechResolve to provide engineers with actionable, battle-tested troubleshooting guides and robust software alternatives.

🤖 Frequently Asked Questions