Security Analyst job description

Cybersecurity — Security Analyst
Monitors alerts and works incident playbooks under supervision.

RESPONSIBILITIES
- Pick up an unfamiliar area fast enough to be useful in it.
- Triage routine alerts using the playbook and record your reasoning on the ticket, with a senior analyst checking each closure.
- Build a simple search or dashboard panel from an existing example, and onboard a log source by following the runbook with a reviewer checking it.
- Assign severity from the agreed scale to scan findings using the triage guide, and pass doubtful ones to a senior analyst.
- Stay responsible after you hand work over.
- Choose checks that suit the task in front of you, catch your own mistakes before anyone else sees them, and confirm the result works once people start using it.

REQUIREMENTS
- No earlier level needed: this is the first level of the ladder

REQUIRED SKILLS
Threat Operations
- Security Alert Triage — You can triage routine alerts using the playbook and record your reasoning on the ticket, with a senior analyst checking each closure.
- Threat Detection Engineering — You can implement a detection rule from a provided specification and confirm it fires against a known sample.
- SIEM Monitoring and Tuning — You can build a simple search or dashboard panel from an existing example, and onboard a log source by following the runbook with a reviewer checking it.
- Incident Response Coordination — You can follow an incident response runbook for a routine incident under close supervision, and keep the incident log up to date as you go.
- Digital Forensics and Evidence Handling — You can capture a memory image or log export following a written procedure, without altering the evidence in the process.
- Threat Intelligence Analysis — You can read a threat intelligence report and summarize what it says about a specific indicator or actor.

Exposure Management
- Vulnerability Scanning and Triage — You can assign severity from the agreed scale to scan findings using the triage guide, and pass doubtful ones to a senior analyst.
- Vulnerability Remediation Coordination — You can log a vulnerability finding with the owning team and follow up until you get a status update.
- Penetration Testing and Exploitation — You can follow a test plan to run known tools against an agreed target and record what each one reports.
- Cloud Security Posture Management — You can read a posture management dashboard and describe what a specific finding means for the resource it flags.
- Asset Inventory and Attack Surface Management — You can list the externally reachable services for a system you support when asked, using tools someone else set up.
- Secure Configuration and Hardening — You can compare the settings of a system with a published hardening checklist and list each setting that differs.

Resilience
- Cyber Resilience and Recovery — You can follow a recovery runbook to restore a system from backup under supervision, and record each step and the time it took.

Identity and Access
- Identity and Access Governance — You can process a routine access request or remove access for someone who has left, against the written procedure.
- Privileged Access Management — You can raise and close a privileged access request under supervision, following the checkout process for admin accounts and returning the credential when the task is done.
- Identity Federation and Single Sign-On — You can configure a straightforward single sign-on connection from a documented pattern and test that a user can sign in, with an engineer reviewing the settings before they go live.

Secure Architecture
- Security Architecture Design — You can produce the security section of a design for a small system by following an existing pattern, and explain each control you included when an architect reviews it.
- Threat Modeling — You can draw the data flow for a system you support and name the obvious attack paths in a threat modeling session led by a facilitator.
- Application Security Testing — You can run a configured scan against a test environment, triage the output against the known false positives and write findings up for a reviewer to check before they reach the team.
- Secure Code Review — You can read a small change and spot the well-known weaknesses, such as unvalidated input or a hardcoded secret, with an experienced reviewer confirming what you found.
- Security Requirements and Design Review — You can check a proposed design against a requirements checklist and write up what is missing, with a senior reviewer deciding what actually blocks approval.

Governance and Risk
- Security Risk Assessment — You can gather the information a risk assessment needs and draft the entries, with an assessor setting the ratings and deciding what goes to the risk owner.
- Security Policy Management — You can apply agreed edits to policy documents and log each change, with an owner reviewing what you produce before it is published.
- Supply Chain and Third-Party Security Risk — You can send out a supplier security questionnaire, chase the response and summarize the answers, with a reviewer deciding what the gaps actually mean.
- Security Awareness Program Management — You can help deliver awareness activity, issuing the training, tracking completion and collating phishing simulation results for someone else to interpret.
- Security Metrics and Reporting — You can pull the data for a regular security report, produce the figures to an agreed template and flag anything in the numbers that looks wrong.
- Security Control Testing and Assurance — You can collect the evidence for a control test from a checklist and log what each piece shows, with an assessor judging the result.

Delivery
- Project Management — You can keep your own tasks and deadlines in a current to-do list, and tell your manager as soon as work you own will be late.
- Planning & Estimation — You can estimate how long a task will take once the approach is clear, and you say promptly when the estimate turns out to be wrong.
- Ownership & Accountability — You can stay responsible after you hand work over: you check it did what it was meant to, fix your own mistakes, and give updates before anyone asks.
- Quality Focus — You can choose checks that suit the task in front of you, catch your own mistakes before anyone else sees them, and confirm the result works once people start using it.

Craft
- Problem Solving — You can work out what is wrong in work you did not create, and you fix the underlying cause instead of working around the symptom.
- Domain Expertise — You can apply the basics of your field to the work you are given, and ask an expert when a task goes beyond what you have learned.
- Continuous Learning — You can pick up an unfamiliar area fast enough to be useful in it, and you turn what you learned into something others can reuse.

Communication
- Communication — You can explain your work so your team can act on it, and play a request back in your own words before you act on it.
- Collaboration — You can work well with people in other roles, share context and credit, and take criticism of your work without defending territory.
- Writing & Documentation — You can document your own work well enough for a colleague to follow it unaided, such as a how-to guide or a handover, and keep it current as things change.
- Stakeholder Management — You can keep your manager and immediate team informed of your progress, and you raise an issue before someone else discovers it.

Leadership
- Leadership — You can act on direction well, seek feedback on how you work, and be open about what you need help with.
- Mentoring — You can share what you have just learned with your peers and help a newer colleague find their way around.
- Strategic Thinking — You can explain why the work you were given matters and who it is for.