Cyber security analyst job description: eight duties, the rota, and how to review invisible work

Most cyber security analyst adverts are a list of tools. They leave out the two things a candidate most wants to know: what the rota is, and what happens when the analyst finds something at two in the morning.

This article sets out a cyber security analyst job description that covers both: the duties, the titles that mean the same job, how the role maps to the NCSC's ten components, the shift pattern, what follows an incident, and a template. It is general information about the role, not security advice.

Security done well looks like nothing happening, which makes it one of the hardest jobs to review fairly. See how New Dynamics performance reviews bring goals, feedback and development into one fair discussion.

What a cyber security analyst does

Prospects' cyber security analyst profile describes the core of it: you "monitor networks and systems, detect security threats (known as 'events'), and analyse and assess alarms", and report on "threats, intrusion attempts, and false alarms, either resolving or escalating them depending on the severity". You may protect one organisation, or work as a consultant across several.

O*NET's occupation is Information Security Analysts: people who "plan, implement, upgrade, or monitor security measures for the protection of computer networks and information", who "assess system vulnerabilities for security risks and propose and implement risk mitigation strategies", who "may ensure appropriate security controls are in place that will safeguard digital files and vital electronic infrastructure", and who "may respond to computer security breaches and viruses".

The titles that mean roughly the same job, per Prospects: cyber intelligence analyst, information security analyst, information security consultant, security analyst, and security operations centre (SOC) analyst. An advert should say which flavour it is, because a SOC analyst's week and a consultant's week are not alike.

The ten components, and which the analyst owns

The NCSC's 10 Steps to Cyber Security breaks "the task of protecting the organisation into 10 components", and says that adopting the measures "reduces the likelihood of cyber attacks occurring, and minimises the impact to your organisation when incidents do occur". It also notes that cyber security "is central to the health and resilience of any organisation reliant on digital technology to function, and this places it firmly within the responsibility of the Board".

For a job description, the useful move is to say which of the ten the analyst owns, which they contribute to, and which belong elsewhere. Typically:

• Owned or led by the analyst: logging and monitoring, vulnerability management, incident management.
• Contributed to: identity and access management, asset management, data security, architecture and configuration, engagement and training.
• Owned elsewhere: risk management and supply chain security often sit with a security manager, a risk function or procurement, with the analyst supplying the technical view.

Three NCSC lines are worth putting in front of any hiring manager. On logging and monitoring: "collecting logs is essential to understand how your systems are being used and is the foundation of security (or protective) monitoring", with monitoring involving "the active analysis of logging information to look for signs of known attacks or unusual system behaviour". On vulnerability management: "the majority of cyber security incidents are the result of attackers exploiting publicly disclosed vulnerabilities to gain access to systems and networks", and attackers "will, often indiscriminately, seek to exploit vulnerabilities as soon as they have been disclosed". On incident management: "being able to detect and quickly respond to incidents will help to prevent further damage", and "a practised plan will help you make good decisions under the pressure of a real" incident.

Eight duties

1. Monitor. Watch for "attacks, intrusions, and unusual, unauthorised, or illegal activity using analytical tools", and keep the detection working, a monitoring system nobody tunes becomes an alert nobody reads.
2. Investigate. Analyse and assess alarms, separate real events from false alarms, and resolve or escalate according to severity.
3. Manage vulnerabilities. "Research and evaluate emerging threats and vulnerabilities, including common ones, such as 'phishing emails', 'pharming' activity, malware, and ransomware", prioritise them and drive the fixes through the teams that own the systems.
4. Harden and test. "Identify potential weaknesses and implement measures, such as firewalls and encryption", "test and evaluate security products and check suppliers' certification, compliance, and accreditation", design or upgrade security systems, and where the role includes it, "engage in 'ethical hacking', such as simulating security breaches".
5. Control access. "Monitor identity and access management, including monitoring for abuse of permissions by authorised users", and in O*NET's terms "modify computer security files to incorporate new software, correct errors, or change individual access status".
6. Respond. Handle incidents, and "plan for disaster recovery and create contingency plans in the event of any security breaches".
7. Report and advise. "Generate incident reports for technical and non-technical staff, as well as stakeholders", "liaise with stakeholders in relation to cyber security issues and provide future recommendations", "maintain a security risk register and assist with internal and external audits", and document policies, procedures and tests.
8. Raise awareness. "Promote a culture of security among colleagues and other stakeholders", train users, and (an underrated O*NET task) "review violations of computer security procedures and discuss procedures with violators to ensure violations are not repeated".

The rota, and the question adverts avoid

This is the single most common omission, and the reason offers get declined late.

• Is it a 24/7 SOC, extended hours, or business hours with on-call?
• What is the shift pattern, how far ahead is it published, and how do nights work?
• What is the escalation path at 2am, who does the analyst wake, and what are they authorised to do alone? Isolating a host, disabling an account and taking a system offline all need pre-agreed authority, or the analyst will hesitate at exactly the wrong moment.
• What compensates for it: shift allowance, on-call payment, time back, or nothing.

Say all four in the advert. A candidate who accepts knowing them stays; one who finds out in month two does not.

After an incident

The work that distinguishes a good analyst happens after the alert closes.

Prospects puts it in one responsibility: "record all findings, actions taken, and lessons learned following an incident to strengthen future responses". In practice that means a timeline that is honest about when things were noticed, actions that survive contact with the teams who have to make them, and a genuine answer to the question of whether the detection would catch it again.

The NCSC's framing is that applying what you have learned "in the aftermath of an incident will mean you are better prepared for any future incidents". A job description that mentions detection and response but not learning is describing half the job.

Reviewing a job where good work is invisible

Security suffers the prevention paradox: when it works, there is nothing to show. Three practical adjustments:

• Do not measure the number of incidents. It rewards not finding things.
• Measure what the analyst controls: time to detect and to contain, the proportion of critical vulnerabilities remediated within the agreed window, detection coverage added, exercises run, findings closed.
• Review the process on the near-misses. The incident that was caught early is the best evidence the job is being done, and it never appears in a summary of outages.

Skills, certifications and routes in

The entry routes are a degree in computing or cyber security, an apprenticeship, a move from IT support, networking or system administration, or a conversion from another analytical career. Vendor-neutral and vendor-specific certifications are common, and an advert should say which are required, which are preferred and which are funded, that last distinction matters more to candidates than the list itself.

The skills that actually separate people in this job: curiosity about how things work, written clarity for reports that non-technical people act on, patience with repetitive triage, and judgement about proportion, because the ability to say "this one does not matter" is as valuable as spotting the one that does.

Because so much of this involves personal data, the analyst works alongside whoever owns data protection. Our employee data protection guide covers that side for the people data an organisation holds.

A cyber security analyst job description template

Job title: Cyber security analyst [SOC / vulnerability management / consultant]

Reports to: [security manager / head of information security]

Cover: [24/7 shift, extended hours, or business hours with on-call], [rota pattern and notice]

Purpose: Detect, investigate and reduce cyber security risk to the organisation's systems and information, and respond when something gets through.

Responsibilities

• Monitor systems and networks for attacks, intrusions and unusual or unauthorised activity, and maintain detection coverage.
• Triage and investigate alerts, resolving or escalating by severity.
• Research emerging threats and vulnerabilities, prioritise them and drive remediation with system owners.
• Identify weaknesses and implement controls; test and evaluate security products and supplier assurance.
• Monitor identity and access management, including misuse of legitimate permissions.
• Respond to incidents, and contribute to contingency and recovery planning.
• Produce incident reports for technical and non-technical audiences, maintain the risk register and support audits.
• Record findings, actions and lessons learned after every incident.
• Promote security awareness and address repeat procedural violations constructively.

Authority during an incident: [what the analyst may do alone (isolate, disable, take offline) and what needs approval, and from whom.]

Required: [experience]; [certifications required, preferred and funded]; [clearance, if any].

What the advert should say

1. Which flavour of analyst: SOC, vulnerability management, consultancy or a mix.
2. The cover model and rota, with notice periods and what is paid for it.
3. Incident authority: what the person may do alone at 2am.
4. Certifications: required, preferred and funded.

Frequently asked questions

What does a cyber security analyst do?

Monitors networks and systems for threats, analyses and assesses alarms, and resolves or escalates them by severity. Beyond monitoring, the job covers researching emerging threats and vulnerabilities, driving remediation, implementing controls such as firewalls and encryption, monitoring identity and access management, responding to incidents, reporting to technical and non-technical audiences, maintaining a risk register and promoting security awareness.

What is a SOC analyst?

A security operations centre analyst: the monitoring and triage version of the role, usually working shifts as part of a rota that provides cover outside business hours. Prospects lists it among the titles that overlap with cyber security analyst, along with information security analyst, information security consultant, security analyst and cyber intelligence analyst.

What are the main duties of an information security analyst?

Planning, implementing, upgrading and monitoring security measures; assessing system vulnerabilities and proposing mitigations; ensuring appropriate controls safeguard files and infrastructure; and responding to breaches. The occupational task list also includes performing risk assessments, documenting security policies and procedures, regulating access to data files, and training users to promote security awareness.

What should a cyber security analyst job advert include?

The flavour of the role, the cover model and shift pattern with notice and payment, the analyst's authority during an incident, and which certifications are required, preferred and funded. Listing tools without those four tells a candidate very little about the job.

How do you measure a cyber security analyst's performance?

Not by the number of incidents, which rewards not finding things. Measure what the analyst controls: time to detect and contain, the proportion of critical vulnerabilities remediated within the agreed window, detection coverage added, exercises run and findings closed, and review the near-misses, which are the best evidence the job is being done.

Why does vulnerability management matter so much?

Because of how most incidents start. The NCSC states that "the majority of cyber security incidents are the result of attackers exploiting publicly disclosed vulnerabilities to gain access to systems and networks", and that attackers seek to exploit vulnerabilities, often indiscriminately, as soon as they are disclosed.

Your next step: put the rota in the advert

1. Say which of the NCSC's ten components the role owns, contributes to and does not touch.
2. State the cover model, the rota and what is paid for unsocial hours.
3. Write down what the analyst may do alone during an incident, and get it agreed before the first one.
4. Set objectives on detection, containment and remediation rather than on incident counts.

For the personal data side that sits alongside this work, read and download our employee data protection guide. The guide is free to read, and the PDF uses our short download form.

Want objectives, check-ins and reviews in one place, so invisible work is still visible at review time? Book a New Dynamics demo and bring your current objectives. You can also email contact@new-dynamics.com.