I spent the two years building software to decode and analyse 802.11 traffic for 802Secure. The product is cloud-based wireless (e.g., 802.11, Bluetooth, ZigBee) security that detects wireless threats and vulnerabilities . It was deployed for multiple years at DefCon, and at DefCon 2018 I worked on it in SecOps.
I wrote an 802.11 parser & scanner. The scanner looks for things like KRACK attacks, evil twins, malformed packets, de-auth attacks and WiFi Pineapples. I wrote most of my tests, using tools like Aircrack-ng as needed. I had to dig down into threats to figure out how to mimic (for testing) and detect them. I also had to dive into the IEEE 802.11 spec (802.11-2016 is 3.5K pages of standard-ese).