What a cybersecurity analyst really does
You watch for threats, decide which alerts are real, and talk people out of the habits that let attackers in.
FieldTech and design
Preparation (O*NET Job Zone)Considerable preparation needed
What the work involves
What fills a typical week for cybersecurity analysts, built from O*NET occupation data.
- Work through the overnight alert queue and decide which alerts are noise and which need action.
- Read threat and virus reports and decide when protections, signatures or patches need updating.
- Add, change and remove user access as people join, move or leave, and clean up access that should not exist.
- Run risk assessments and tests on systems and security controls, then write up what you found.
- Meet with staff who broke a security rule, explain why it matters, and make sure it does not happen again.
- Keep security policies, incident procedures and test records documented and current.
- Coordinate fixes with IT staff and outside vendors who own the systems you protect.
What the days are like
What people in the job know
- Long weeks are normal, not a crisis exception. Duration of typical work week: 62% more than 40 hours (O*NET Work Context)
- Pushback from coworkers who see security as the thing slowing them down is a regular part of the job; for about a third of analysts it comes at least weekly. Frequency of conflict situations: 18% every day, 13% once a week or more, 23% once a month or more (O*NET Work Context)
- Mistakes are costly, so you double check before you block, delete or grant anything. Consequence of error: 33% extremely serious, 18% very serious; Importance of being exact or accurate: 40% extremely important (O*NET Work Context)
- Pressure comes in waves around incidents rather than every single day. Time pressure: 14% every day, 35% once a week or more, 49% once a month or more (O*NET Work Context)
- You are rarely alone with your screen; most of the day involves people. Contact with others: 46% constant contact, 40% most of the time; Telephone conversations: 65% every day (O*NET Work Context)
How people get into it
Job Zone 4. Most people hold a bachelor's degree (53% of employers in O*NET's survey require one, 23% a post baccalaureate certificate, 13% an associate's degree) and several years of related experience, often starting in IT support, network administration or a security operations center before moving into an analyst role. Industry certifications are common but not listed by O*NET as required.
The Firstday trial, easy to hard
Three simulated tasks at Harborline Credit Union, a fictional company, with AI coworkers who message you, react to your work and coach with questions. Nobody scores you.
What the trial can't show: The trial uses a simulated alert console, spreadsheet exports and email, not live security tools such as a real SIEM, firewall or endpoint agent. It cannot show the slow weeks of tuning and patch coordination, on call nights, or how it feels when a real breach affects real customers. Technical depth is scaled down so a beginner can finish in time.
Reading about it is one thing.
Find out how the work feels to you before you spend on a degree, course or job change. Your first trial is free.
Other careers you can try
Job details on this page are built from O*NET OnLine, 15-1212.00. This page includes information from the O*NET 31.0 Database by the U.S. Department of Labor, Employment and Training Administration (USDOL/ETA). Used under the CC BY 4.0 license. O*NET® is a trademark of USDOL/ETA.