Steel–concrete composite systems are an efficient alternative to mid- and high-rise building structures because of their high strength-to-weight ratio when compared to traditional concrete or steel constructive systems. Nevertheless, composite structural systems are susceptible to damage due to, for example, deficient construction processes, errors in design and detailing, steel corrosion, and the drying shrinkage of concrete. As a consequence, the overall strength of the structure may be significantly decreased. In view of the relevance of this subject, the present paper addresses the damage detection problem in a steel–concrete composite structure with an impact-hammer-based modal testing procedure. The mathematical formulation adopted in this work allows for the identification of regions where stiffness varies with respect to an initial virgin state without the need for theoretical models of the undamaged structure (such as finite element models). Since mode shape curvatures change due to the loss of stiffness at the presence of cracks, a change in curvature was adopted as a criterion to quantify stiffness reduction. A stiffness variability index based on two-dimensional mode shape curvatures is generated for several points on the structure, resulting in a damage distribution pattern. Our numerical predictions were compared with experimentally measured data in a full-scale steel–concrete composite beam subjected to bending and were successfully validated. The present damage detection strategy provides further insight into the failure mechanisms of steel–concrete composite structures, and promotes the future development of safer and more reliable infrastructures.