CJDE (Certified Junior Detection Engineer) — Review and How to Prepare for It!

Hello everyone! It's me, Chicken0248, again, and in this blog I'll give my review of the Certified Junior Detection Engineer (CJDE) certification, the first ever detection engineering certificate from Centri, the well-known vendor behind BTL1 and BTL2. If you're already familiar with BTL1, think of CJDE as BTL1 but for detection engineers.

Detection engineering is a role that sits above the typical SOC L1 tier, though some L1 analysts already do it day-to-day. It essentially involves tuning existing alerts and rules, or creating new ones, to detect threats more effectively and reduce the overwhelming volume of false positives that leads to alert fatigue. As SOC becomes a global trend, demand for detection engineers is growing: some companies don't use that exact title, but alert tuning and rule creation often appear in the job description regardless. To equip you with the right mindset and skills for this work, Centri developed the CJDE course.

The course expects students to have some field experience (1–3 years recommended), and is priced at 399 GBP, the same as BTL1. Centri recommends taking CJDE as your second certification after BTL1, and the reason makes sense: you need to understand what "normal" looks like before you can write effective detection rules.

Once you purchase the course, you can start it whenever you're ready, but once you do, a 4-month countdown begins. That's your window for accessing course content and labs. The exam voucher is valid for 12 months from when you start the course, and you get 2 attempts. If you fail the first attempt, you must wait 10 days before retaking.

With that, let's jump into the course itself.

The CJDE course consists of 18 modules, all text-based, so there's a lot of reading ahead of you. The "Junior" label is reflected in the number of "essentials" modules included. Even though the recommended experience is 1–3 years, the course still walks through fundamentals like the history of networking, cabling, and the OSI model. I found myself skimming through those, having already covered them in college.

That said, I didn't engage deeply with every module. To keep my momentum going, I focused on the ones that would directly benefit me:

• Introduction to SIEM: covers ELK, Splunk, and Graylog; I took it mainly for the Graylog exposure
• Introduction to Threat Intelligence: understanding different IOC types and Threat Intelligence Platforms (TIPs) pays off directly in rule creation and alert tuning
• YARA & Sigma Essentials: always useful to see how others structure their rules and what methodology they apply
• Zeek Essentials: I'm not a fan of Zeek, but you still need it; this is where my AI agent subscription really came in handy 😄
• Malware Analysis for Detection Engineering: not Ghidra or IDA, but static analysis with strings and PEStudio, dynamic analysis, and ultimately writing a YARA rule to detect the sample in the labs
• Detection Rule Creation and Tuning: covers more than you'd expect, including detection logic in AWS
• Threat Intelligence Integration for Detection: a standout module where you perform adversary simulation and then write detection rules to catch the simulated behaviour
• Behavioral Analytics for Threat Detection: discusses how baselining and ML can surface suspicious behaviour; mostly theoretical with no lab, but worth knowing
• AI for Defenders: hands-on application of the previous module, using Python and pandas for anomaly detection and automated alert prioritization

Looking back, once you push through the essential modules, you get to do genuinely interesting detection engineering work.

With 4 months of access from the moment you start, you'll want to plan your study schedule carefully and build in buffer time for when work or life gets in the way.

For labs, you have a total of 120 hours to use, which is generous. I wasted a fair amount of that time by clicking "Start" and then getting pulled away by work, though thankfully the lab auto-stops after 6 hours of inactivity. Lab access expires at the same time as your course content access.

Each lab has a solution in the corresponding course module, so if you get stuck you can refer to it, take notes, and carry those learnings into the exam.

I hesitated for a long time before sitting the exam: detection engineering isn't my primary strength. What finally pushed me over the line was the CJDE Playground, a special lab that simulates the exam environment, which Centri released in January 2026. That's actually why I took the exam so late: I had purchased it during the early launch at a discount and was waiting specifically for this.

The Playground gave me everything I needed to understand the exam environment. Even so, deep down I still didn't feel fully ready, but the show had to go on.

I planned to take the exam on Thursday, 29 January 2026, using a day off (I had attended an LLM Research Bootcamp on 23–25 January and needed time to recover). But on Tuesday, 27 January, after dinner and a good rest, I took one last look at the Playground and suddenly thought: "Fail is fail, pass is pass. Nothing matters, let's just go for it now and see if I can finish in 4 hours!" (Spoiler: I did.) With that thought in my head, I clicked "Start Exam" like I was possessed.

Once the environment initialised, I read through the full set of instructions carefully. Even with Playground experience, the actual exam environment felt different, and since I paid for this out of my own pocket, I wasn't going to skip a single line.

This exam cannot be cheesed by manually hunting through artifacts in a SIEM. You must write your own Sigma and YARA rules (and in some cases Zeek rules) and push them through a CI/CD pipeline. There are no artifacts handed to you directly, but don't worry, the course walks you through setting up the environment, and you'll get the hang of it within minutes (or an hour at most).

You'll also have Threat Intelligence reports to read, and I cannot stress this enough: read all of them. The majority of your score depends on how well you interpret these reports and translate them into detection rules.

The experience escalated quickly into something that felt just like a threat hunting lab, the main difference being that instead of writing SPL queries, you're writing Sigma and YARA rules. The mental process is largely the same.

I should mention that I used detectionstream.com to practise and get comfortable with YARA and Sigma rule writing. I even studied some of the published rules on the platform, and yes, some of that directly helped during the exam.

After 3 hours and 40 minutes (well past midnight at that point), I pushed my last detection rule and submitted. The result came back: Failed. The passing threshold is 70%, with a gold coin distinction for 90%+. Even though I had mentally prepared for this outcome, it still stung.

I went to sleep and started the next morning as a work day. As part of my morning routine I checked my messages, and found both an email and a message from someone I know at Centri, sent the night before while I was asleep. It turned out I had passed, with only one question wrong. The initial "Failed" result was caused by a rule formatting evaluation issue, a bug in the automated grading. After a manual review by the SBT team, the correct score was confirmed. Hats off to them for proactively reviewing exam submissions without me having to ask.

And with that, I can confidently call myself a certified junior detection engineer.

Before wrapping up, if you're wondering whether there are any practice labs available: BTLO doesn't have CJDE-specific content, but detectionstream.com is an excellent substitute for practising your Sigma and YARA rule writing.

That's it for this blog.

Peace ✌️