Stop 01 · Cybersecurity FoundationsTopics · 6/9

A Day in the Life of a Security Analyst

In short

Most alerts an analyst sees turn out to be harmless. The job is sorting the boring from the real quickly and calmly, then writing down what you found so the next person can follow.

In practice, most days are a mix of alert triage, investigation, documentation, and collaboration — less 'dramatic hacking', more disciplined, methodical analysis.

The blob as a traffic constable waves cars through and stops one suspicious van.

Think of it like this

The traffic constable at a busy junction

Hundreds of vehicles pass every hour. The constable waves most through, glances twice at a few, and stops the one van with a broken number plate. Analysts do the same with alerts: most are fine, a few need a closer look.

Watch it happen

Working through the alert queue

enqueue(Failed logins x40)

Failed logins x40

Front of the queue is coloured

1/69:05 a.m. An alert lands: 40 failed logins on one account in five minutes.

The big ideas

What you need to know

Triage is the core skill

Decide fast: harmless, needs more digging, or real incident. Most alerts fall in the first bucket.

Investigate with evidence

Check logs, user history and threat intel before you decide. Never close an alert on a guess.

Write everything down

Every ticket needs what you saw, what you checked and why you decided. Future you will thank you.

Calm beats clever

Shifts can be long and repetitive. A steady, methodical analyst catches more than a flashy one.

Save yourself the pain

Common mistakes

Oops

Closing alerts as false positives without checking.

Do this instead

Look at the evidence each time. The one you skip because 'it's always nothing' is the one that matters.

Oops

Writing tickets like 'checked, fine'.

Do this instead

Say what you checked: 'User confirmed on call, IP is office VPN, MFA passed.' Anyone can follow that.

Your mission

Triage a pretend queue

~20 min

Quick check

You see a login from Singapore on an employee's account. What is the best first step?

Go deeper

1Shadow or interview a working security analyst about their actual weekly calendar.
2Notice how much time goes to triage and documentation versus active investigation.
3Decide if the real day-to-day (not the Hollywood image) genuinely appeals to you.