Threat investigation attracts a specific kind of person:
- You'd rather prove something than assume it
- You're comfortable saying "I don't know yet, give me the logs"
- Timelines that don't line up genuinely bother you
- You read the postmortem even when it wasn't your incident
- You can change your mind when the evidence does, without taking it personally
That last one is the hardest. The first theory feels good. The evidence doesn't care.
If this describes you, investigation is probably the best job in security. If it doesn't, that's fine too. The field needs builders and defenders as much as it needs people who argue with timestamps.