What does a cybersecurity analyst do? A cybersecurity analyst watches an organisation’s systems for malicious activity, investigates alerts in order of severity, escalates serious threats and records what happened. Most analysts work inside a Security Operations Center (SOC) team.
The role is one of the more approachable tech jobs for newcomers, and the clearest way to understand it is to follow a single alert from first signal to final report, then see where the analyst’s job ends and an engineer’s begins.
How an analyst’s shift follows the incident lifecycle
A cybersecurity analyst’s work moves through detection, triage, escalation and reporting. According to the training provider TryHackMe, most analysts work as part of a SOC team, so these stages are shared work rather than a solo effort.
Detect: monitoring systems and alert queues
The shift starts with monitoring. Core duties include monitoring infrastructure and digital assets for malicious activity, and the degree-programme provider Post University describes analysts monitoring networks to detect suspicious activity and respond accordingly. In practice, much of that signal arrives in a SIEM (security information and event management) platform, which collects events from many systems and raises alerts for a human to review. Splunk Enterprise, one SIEM product, is named in 12% of information security analyst job postings, according to ITCareerFinder.
Triage: deciding what matters first
Not every alert deserves the same effort. TryHackMe lists responding to alerts and investigating incidents depending on their severity as a core duty. Triage is therefore a ranking exercise: confirm whether the alert is real, judge how serious it is, and spend time accordingly. This is the first stage of incident response, and it is where a new analyst builds judgement fastest.
Escalate: passing the right cases upward
Escalation depends on the analyst’s tier. At Level 1, TryHackMe says, analysts are responsible for identifying and investigating threats before escalating them. At Level 2, analysts investigate those escalated threats further, prioritise and form a response. A Level 1 analyst who escalates with clear notes saves the next person from repeating the investigation, which makes escalation quality a practical skill rather than a formality.
Report: leaving a usable record
The shift closes with documentation. Post University lists keeping accurate records and filing comprehensive reports on safety and security matters among the duties. Those records are what later let colleagues spot repeated patterns, and they are the material engineers draw on when deciding what to change.
Prevention work between incidents
Analysts also reduce the number of incidents, not only respond to them. TryHackMe describes identifying potential weaknesses and implementing measures such as firewalls, access gates and encryption, plus making sure systems are hardened according to best practices.
A firewall is the most familiar of these controls, and it is also a common job-posting keyword (covered below under skills). Vulnerability assessment is the discovery side of the same work: finding the weak points that hardening and patching then close. Weeks with few alerts often shift towards this kind of review, which suits people who prefer steady, methodical checking.
Security analyst vs security engineer: where the handoff happens
An analyst focuses on watching, investigating and reporting, while an engineer is on the technical-depth side of the field. Career-guide provider Tutorsbot lists technical depth tracks such as cybersecurity engineer, penetration tester and malware analyst as routes an analyst can move into.
A practical reading of the handoff follows the lifecycle above. The analyst’s output is a confirmed finding, a severity judgement and a written record. Where that finding points to a structural weakness, such as a firewall rule or a system configuration that keeps producing alerts, the fix is design and build work, which is what engineers are for. Analysts do implement some controls, as the prevention duties show, so the line is a matter of emphasis and varies by employer.
Choose the analyst route if you like investigation and decision-making under a queue of alerts. Lean towards engineering if you would rather build and improve the systems themselves. Similar boundary questions come up in other technical roles, as in devops engineer vs site reliability engineer.
Skills cybersecurity analysts need
Analyst skills split into tool knowledge, network understanding and working habits. Postings give a concrete picture: ITCareerFinder reports firewall software in 18% of information security analyst postings and Splunk Enterprise in 12%. That makes firewall concepts and at least one SIEM worth practising before applying.
- Network and firewall knowledge. Understanding how traffic should flow makes unusual traffic easier to recognise.
- SIEM and alert handling. Reading, filtering and ranking alerts is the daily mechanics of the job.
- Programming. Post University suggests Java and C++ as useful languages to learn.
- Persistence. TryHackMe describes the right mindset as determined: you have to dig deep to uncover threats, including through routine checks.
- Clear writing. Escalation notes and reports are only useful if the next reader can act on them.
Education and certifications
Requirements differ between employers. Post University notes that some employers prefer a degree while others prefer experience, and TryHackMe argues a degree is not strictly required for SOC analyst entry. Check the postings you are targeting before deciding on a degree path.
Certifications help, but they are not a substitute for ability. TryHackMe’s view is that they help, yet employers want to see mastery of the technical side. Three credentials are named in the Post University guide:
- CompTIA Cybersecurity Analyst (CSA+). The credential whose title matches the role most directly, and the sensible one to look at first for analyst jobs.
- Certified Ethical Hacker (CEH). Created and administered by EC-Council, it suits people leaning towards offensive testing.
- CISSP. Post University describes it as showing expertise in defining the IT architecture and in designing, building and maintaining a secure business environment, which points to more senior or engineering-flavoured work than a first analyst post.
Entry-level cybersecurity jobs and routes in
The cybersecurity analyst role is itself an entry point. TryHackMe calls it one of the best early careers in cyber security and notes it is also known as SOC analyst, with Level 1 as the starting tier.
Many people arrive through adjacent work. Tutorsbot says many practitioners enter through IT support, network administration or software development roles. Post University adds that experience can come from support roles in the industry, whether through paid employment or through internships, practicums or apprenticeships.
If you currently work in IT support, the move is usually about adding security tooling and incident handling to skills you already have. If you are earlier than that, an internship or apprenticeship builds the same evidence. Those weighing quite different directions, such as management tracks, can compare them in product manager vs project manager vs program manager.
Pay for information security analysts
Information security analysts earn a median of $129,180 per year, with a wide spread between early-career and senior pay. The figures below come from US labor statistics as reported by secondary sources.
| Measure | Value | Planning use |
|---|---|---|
| Median annual pay | $129,180 per year | A central benchmark when judging an offer. |
| Middle 50% range | $97,810 to $163,500 per year | A realistic band for most analyst roles, from newer to experienced. |
| Top 10% | Over $199,850 per year | A ceiling reached by few, not a typical target. |
These figures are reported by ITCareerFinder, and the median is corroborated by Tutorsbot, which cites the BLS OEWS May 2025 data.
Entry-level pay is likely to sit towards the lower part of the middle range, so treat the median as a mid-career reference point rather than a starting expectation.
Frequently asked questions
What does a cybersecurity analyst do each day?
The day centres on monitoring for malicious activity, working through alerts by severity, escalating cases that need deeper investigation and writing up what was found. Quieter periods often go to hardening and weakness checks.
How is a security analyst different from a security engineer?
An analyst detects, investigates and reports on threats. An engineer sits on the technical-depth side, building and improving the systems and controls that analysts monitor.
Do I need a degree to become a cybersecurity analyst?
Not always. Employers vary, with some preferring a degree and others preferring experience, and training providers report people starting SOC careers without one.
Which certification should a beginner look at first?
CompTIA’s Cybersecurity Analyst (CSA+) is the credential named for the analyst role. CEH and CISSP point towards offensive testing and senior architecture work respectively, and none replaces demonstrable hands-on skill.
What entry-level cybersecurity jobs exist?
The Level 1 SOC analyst post is the standard starting role. Many people reach it from IT support, network administration or software development, or through internships and apprenticeships.
