Example · Security Analyst
Automation is taking over the alert queue, while the incident record still needs you.
20 of your 40 hours still need you
- 10 stay yours
- 10 faster with AI
- 20 tools could take
A typical week at the middle pace. Your plan uses your own tasks.
Is SOC analyst a dying job?
By our task-by-task count, 20 of a typical 40-hour week as a security analyst still need a person. Tools could already take about 20 hours. The part of security operations that got you hired is the part tooling is taking. The part that holds has not been formally handed to you yet.
Read more
Alert triage and the phishing mailbox are the core of a first job in a security operations center (SOC), and managed detection and response (MDR) providers, outside firms that watch alerts, already auto-close low and medium alerts overnight, with daytime pilots following. If you have ever re-checked an AI triage tool's closures, you know the pattern. The tool is right on almost all of them and wrong on the few that mattered. Catching those few could be your next job.
The durable work holds for concrete reasons. When a company has an incident, rules put clocks on it: for a public company, a four-business-day clock on the SEC disclosure decision; all fifty states have breach-notification clocks; a HIPAA business associate has sixty days to notify its healthcare customers. Somebody has to build the timeline those clocks run on, contain the thing, and answer for what was and was not looked at. None of that accountability is yours yet. It belongs to your CISO (chief information security officer). The plan is to become the named person the CISO relies on for it, before an AI triage pilot decides the analysts were the queue.
The hard truth
The stress in security work keeps rising.
Security work wears people down. Most practitioners say the job is harder on them than five years ago, and stress is the top reason people leave.
Sources (2)
- 66% of cybersecurity professionals say their role is more stressful than it was five years ago. ISACA, State of Cybersecurity 2025, 2025-09
- 47% say high stress is the top reason for attrition on cyber teams. ISACA, State of Cybersecurity 2025, 2025-09
What stays yours
Knowing which alerts are noise, and why
The exclusions you write encode years of "that's the scanner, that's the VPN, that's the CFO's travel." A model reading the rule sees the exclusion. It does not know the rep changed teams in March. This is the raw material of detection engineering, and it lives in your head.
Re-checking an AI triage tool's closures and finding the ones that mattered
As triage gets cheap, the question becomes "who can tell when it's wrong." Nobody has made that a job yet, and the detection engineering move makes it one.
The containment call: telling a VP her laptop is being isolated, right now
Isolating a senior person's laptop is a decision someone has to own, on the phone, to a person who outranks them. Agents can execute the isolation, but they cannot be the one who answers "who authorized that." If the answer is "me," that is what makes the call dreadful. The plan changes the answer to "the policy your CISO signed."
Building the incident timeline
For a public company, SEC Form 8-K Item 1.05 requires disclosure within four business days of a materiality determination. Your timeline is what the determination is made from. The cost of it being wrong is a securities filing that is wrong.
Negotiating patch windows with system owners
Whether the ERP team can take a reboot Thursday is not in any scan. Turning "critical, KEV-listed" (on the government's list of actively exploited flaws) into "patched by Friday" takes a relationship.
What's next for a SOC analyst?
Plan A is your best move inside the work you do now. Most sessions in the 13-week plan build toward it.
- A
Become the named incident coordinator
Why it fits
Why you. If incident response is where you want to go, you may have worked real incidents already. Catching what triage missed is what a coordinator has to find, and if you came from help desk you know who to call at 2 a.m.
The gap. Typically, you have never run an incident end to end or a tabletop exercise, a practice incident run on paper. Legal does not know your name, and there is no containment authority matrix, a chart of who approves each step, so every isolation is a personal ask.
The trade-off. The accountability stays borrowed until your name is in the plan, and even then the CISO can replace you with the vendor's IR retainer. On-call gets heavier, and you are volunteering to stand next to the thing that goes wrong. The matrix makes that manageable.
Other moves that fit
These are also good bets in this field. Read them if Plan A doesn't suit you.
Own the model's error rate: detection engineering and triage quality checks
Why it fits
Why you. You know which alerts are noise and you wrote the exclusions. Usually nobody has a false-negative number for the MDR's triage, and the CISO needs one before a pilot becomes a contract.
The gap. Your rules are probably not in version control, and you have no test harness. Sampling happens ad hoc on a Friday afternoon, and you have not yet written a detection from a hypothesis.
The trade-off. You would be building the system that shrinks entry-level triage seats, including any open one behind you. It is desk work. Its evidence feeds the incident coordinator move, which is why it is second.
The same seat at a larger security team, priced
Why it fits
Why you. 514,359 postings in a year is a market (CyberSeek, June 2025). A mid-sized company has one coordinator seat; a very large company has a DFIR (digital forensics and incident response) team.
The gap. You have no portable evidence yet. "I re-checked the MDR's closures" is too vague, while "false-negative rate on 1,200 sampled closures, with the two rule changes that fixed it" makes a strong application.
The trade-off. You lose your system-owner relationships and a CISO who knows you. At a bigger shop you start in the queue, and the queue is what is going away.
What's a plan B for security analysts?
Plan B is a job AI is creating that these skills already fit. One session a week in the plan trains you for it, so it is ready if your job shrinks or you want a change.
BPlan B, picked for this role
Domain AI red teamer
Thinking like an attacker during triage carries straight into probing models for jailbreaks and data leaks, especially with a published finding.
Other options
AI incident and safety lead
You already keep the incident record and timeline, and AI incident roles want that discipline plus some program management years.
AI governance analyst
Mapping alerts to controls and frameworks prepares you to assess AI risk against the NIST AI RMF and similar standards.
In your own plan you can switch to any of the 47 roles.
The first two weeks
The first 2 of 13 weeks. Three sessions a week: one of 30 minutes, one of 60 minutes, and one of 60 to 90 minutes. Many people do two on weeknights and one on the weekend. Every session ends in something written or a number. You also do one 40-minute Plan B session a week. If a real incident is live, the incident is the plan, and you volunteer to take notes for it. By week 13 you'll have a measured false-negative rate for your AI triage tool, a containment authority matrix, and a one-page memo to your CISO with two clear asks.
- Week 1: Measure your week
What you do
- AKeep a time log for one week and compare it with the task list in this report.
- APull the last 90 days of alert closures by your MDR (outside monitoring firm) or AI triage tool, plus your own escalations, from the SIEM, your log search tool.
- ARead SEC press release 2023-139 and HHS's breach notification page. Write one page on the reporting deadlines that apply to your company.
- BTake the first half of Anthropic's AI Fluency: Framework & Foundations, a free online course. Keep your alert queue in mind as you go.
- Week 2: Start sampling AI closures
What you do
- ASet up a weekly sample of 40 auto-closed alerts, spread across severity levels. Use five columns: alert, vendor verdict, your verdict, why, and rule to change.
- AReview your first 40 closures and count the ones the tool got wrong.
- ARead the roles section of NIST SP 800-61 Rev. 3, the federal incident response guide. List the roles your incident response plan is missing.
- BFinish AI Fluency and pass its final assessment.
Three courses from the plan
Checked 2026-09-22.
- SEC press release 2023-139 and the final rule (8-K Item 1.05, Reg S-K Item 106)U.S. SEC · Free
Yes, Week 1, if your company is public. Your general counsel has read it, and the SOC should too.
- HIPAA Breach Notification Rule pageHHS · Free
Yes, Week 1, if you serve healthcare customers, for the business-associate clock.
- State breach-notification law tableNCSL · Free
Skim it, and know that your state is one of fifty.
Risks beyond AI: moderateBudget and outsourcing risk
Security budgets are cut in downturns and restored after breaches. The MDR outsourcing wave predates any of this by a decade, and a public company's security spend tracks its stock as much as its threat model. The category is growing, but the entry-level step is shrinking.
Where this could be wrong
- The misses you caught may not generalize. If the Week 2–11 sample finds the triage's false-negative rate near zero, the detection engineering move loses its number and the incident coordinator move stands on the tabletop and the matrix alone. That is good for the company but weaker for this plan.
- The duty you carry for the CISO may be handed further than we assume. A CISO who names the MDR provider's incident response (IR) retainer as coordinator has satisfied every clock without you. Week 5 exists to find out whether she would.
- Item 1.05, the SEC's cyber incident disclosure rule, may not survive. The rule is three years old and industry groups have asked for it to be narrowed or rescinded. If the federal clock goes, the state and HIPAA clocks remain; the plan changes emphasis but keeps its direction.
- We assumed a public company. If yours is not, ignore the SEC clock; the state clocks (and HIPAA, if you serve healthcare) still run.
Also matched: security analyst, soc analyst, cybersecurity analyst. Research checked 2026-09-22. Page updated .