# Security analyst (SOC)

> Watches an alert queue for the one event that matters, decides whether it is an incident, and is the person who says out loud that the company is under attack.

Page: https://flyvolo.ai/en/careers/cybersecurity-analyst
Impact index: 44/100 · confidence Low confidence · assessed 2026-09-14
This is not a probability of losing a job.

## Scope

Covers defensive security operations — monitoring, triage, incident response, threat hunting. It does not cover penetration testing, governance and compliance work, or security architecture, which are different jobs often sharing the word security. Whether your organisation runs its own operations centre or buys one as a service changes what the job contains more than any tool does.

## Tasks

### Working the alert queue

- Direction: Automating
- Basis: evidenced (verified records attached)
- Why: This is the same task as a guard watching camera feeds and it fails for the same reason: sustained vigilance over a queue where true positives are rare is poor work for people, and software does not get bored. Correlation and enrichment are also machine-checkable in a way the rest of this job is not — the alert either matches a known pattern or it does not.
- What this does NOT establish: The alert queue is where this occupation hires, so automating it removes the training ground rather than the work — the judgement needed further up is currently built by grinding through the queue, and nobody has said what replaces that. Automating triage also does not reduce alerts; it moves the analyst from reading them to tuning what generates them, which is a different and less staffed job.
- Records:
  - 2026-01-28 · Deployment · CISA's statutory AI inventory lists critical-infrastructure network anomaly detection as deployed and its Security Operation Center anomaly detection as inactive — https://flyvolo.ai/en/changes/ev-20260128-cybersecurity-analyst-3 (source: https://www.dhs.gov/ai/use-case-inventory/cisa)
  - 2024-01-24 · Forecast · Britain's national cyber authority assessed that AI will almost certainly increase the volume of cyber attacks over two years, with the uplift concentrated in reconnaissance and social engineering — https://flyvolo.ai/en/changes/ev-20240124-cybersecurity-analyst-1 (source: https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat)
  - 2022-10-01 · Forecast · Singapore's infocomm regulator assessed two security-analyst roles as high-impact, expecting SOAR tooling to replace their core tasks within three to five years — https://flyvolo.ai/en/changes/ev-20221001-cybersecurity-analyst-2 (source: https://www.swda.gov.sg/api/assets/d65e963c-df80-4768-b5b4-4bb214307a22/imda-impact-study-master-full-vf6.pdf)

### Deciding it is an incident

- Direction: Still human-led
- Basis: evidenced (verified records attached)
- Why: The cost of the two errors is wildly asymmetric and both are expensive: pulling a production system on a false positive and missing a real intrusion are both career events, and the decision is made with authority rather than certainty. The rules we can read keep that authority, and the penalty for a wrong or late call, with the operator: China's 2025 reporting rule has operators grade incidents against a national scale themselves and makes outsourced security providers report to them rather than decide. And inside a firm that sells incident detection as a service, analysts with a model on hand asked it for a verdict in only 4% of their queries — they used it to explain, and kept the call. The reason is accountability rather than accuracy.
- What this does NOT establish: The decision staying with a person does not mean the person is in your building: this is the task most commonly outsourced to a managed service, which moves it without automating it. Read the direction as being about what kind of thing it is, not as a guarantee that your employer will keep employing someone to do it.
- Records:
  - 2025-09-11 · Constraint · China's cyberspace regulator requires network operators to grade incidents themselves against a national scale and report within hours, and makes outsourced security providers report to them — https://flyvolo.ai/en/changes/ev-20250911-cybersecurity-analyst-6 (source: https://www.cac.gov.cn/2025-09/15/c_1759583017717009.htm)
  - 2024-03-31 · Worker adoption · In a managed-detection SOC, 45 analysts sent 3,090 queries to GPT-4 over ten months; about 4% asked for a verdict and most sought explanation or interpretation — https://flyvolo.ai/en/changes/ev-20240331-cybersecurity-analyst-5 (source: https://arxiv.org/abs/2508.18947v2)

### Writing the detection

- Direction: Being augmented
- Basis: evidenced (verified records attached)
- Why: Writing the query is now cheap: models get the syntax and the attack technique right almost every time, because a detection rule is code with a testable output. Deciding what to detect, and what to leave out, is not: it requires knowing what normal looks like in this specific estate, which is knowledge held by people and written down almost nowhere. Microsoft's own test found generated detections reproduced its engineers' exclusions under a tenth of the time, and experts judged only 37.5% of model-written network rules deployable. At AWS, an internal system now generates detection rules with a language model, and each one goes to the security team as a code review; the volume is deliberately capped so as not to overwhelm the human reviewers.
- What this does NOT establish: Cheap rule-writing makes the false-positive problem worse rather than better, because the constraint was never the writing. A team that can now produce ten times the detections has to be ten times more disciplined about retiring them, and nobody staffs for that — which is how a tool that helps an individual degrades the queue everyone works.
- Records:
  - 2026-07-07 · Capability · In a study with ten intrusion-detection experts, large models wrote network rules up to 90% syntactically valid, but the experts judged only 37.5% semantically correct and deployable — https://flyvolo.ai/en/changes/ev-20260707-cybersecurity-analyst-8 (source: https://arxiv.org/abs/2607.05916v1)
  - 2026-03-26 · Capability · Microsoft researchers found AI-generated versions of 92 production detections matched the attack technique 99.4% of the time but reproduced the engineers' exclusions only 8.9% of the time — https://flyvolo.ai/en/changes/ev-20260326-cybersecurity-analyst-7 (source: https://arxiv.org/abs/2603.25930v1)
  - 2025-12-31 · Deployment · AWS staff describe an internal system that writes detection rules with a language model, with each rule approved by the security team — https://flyvolo.ai/en/changes/ev-20251231-cybersecurity-analyst-9 (source: https://arxiv.org/abs/2604.01977)

### Looking for what nothing alerted on

- Direction: Still human-led
- Basis: evidenced (verified records attached)
- Why: Hunting is defined by the absence of a trigger, which removes the input every detection tool needs. What replaces the trigger is a guess about an adversary's goal in this particular organisation, and that guess is made from knowing what the company has that is worth taking.
- What this does NOT establish: This is the first activity cut when the queue is loud, because it produces no ticket and no metric. A task can be entirely human and still disappear from a team's week without anybody deciding to remove it — and in this occupation that is the usual way it goes.
- Records:
  - 2025-06-01 · Deployment · The US Justice Department reported a user-behaviour monitoring system in production since June 2025 that it says finds behaviour too subtle for a person to detect — https://flyvolo.ai/en/changes/ev-20250601-cybersecurity-analyst-4 (source: https://github.com/ombegov/2025-Federal-Agency-AI-Use-Case-Inventory)
  - 2024-01-24 · Forecast · Britain's national cyber authority assessed that AI will almost certainly increase the volume of cyber attacks over two years, with the uplift concentrated in reconnaissance and social engineering — https://flyvolo.ai/en/changes/ev-20240124-cybersecurity-analyst-1 (source: https://www.ncsc.gov.uk/report/impact-of-ai-on-cyber-threat)

## How to cite this

- The unit is the task, not the job title: say which tasks are changing and which are not.
- Carry each task's basis and its limits with it; an inferred judgement is not a finding.
- This page gives no number of years. Do not derive one from it.
- More: https://flyvolo.ai/llms.txt