Security Analyst Job Description Template - 2026 Guide

Post a "Security Analyst" job and you'll get three different kinds of applicants: someone who's spent two years triaging alerts on rotating shifts, someone who's spent two years chasing SOC 2 evidence and vendor security questionnaires, and someone who writes detection rules and barely thinks of themselves as an "analyst" at all. All three are right to use the title. Most job postings describe none of them clearly enough for a candidate to know which job they're applying for.

That mismatch costs both sides. A hiring manager interviews a strong compliance candidate against a SOC-shaped rubric and passes on the right GRC hire, or hires a sharp T1 analyst into what was really a detection-engineering role and calls the candidate pool weak when the job description was the problem. This guide draws the three lines clearly, then covers what makes the role hard to staff and keep: alert fatigue, and the shift work a real SOC requires.

Last updated: September 2026

Key Highlights

• One title, three jobs: "Security Analyst" covers the SOC analyst, the GRC-facing analyst, and the detection engineer, and each needs a different job description
• The SOC runs on tiers, not one flat role: T1 triage, T2 investigation, and T3 threat hunting are distinct jobs at different pay bands, not three names for the same seat
• Alert fatigue is a staffing problem, not just a tooling problem: a queue full of low-value alerts burns out analysts before any single incident does, and it shows up in retention
• Shift work is the tradeoff most postings hide: a 24/7 SOC needs round-the-clock coverage, and that belongs in the posting, not discovered in week two
• Certifications gate hiring unevenly: Security+ works as an entry filter, CISSP signals seniority but gets over-required for junior roles, and GIAC certifications carry real weight for hands-on work
• Not every company should hire its first analyst: below a certain size, an MDR or MSSP provider covers detection more reliably than one in-house hire ever will

Why This Role Matters

Every company online is a target, and the gap between attacks arriving and people equipped to catch them shows up in the data. ISC2's 2025 Cybersecurity Workforce Study (published December 2025) found 95 percent of respondents reported at least one skills need, and 88 percent experienced a significant cybersecurity consequence tied to a skills deficiency in the past 12 months. That's not an abstract shortage. It's specific teams missing specific detections because the seat meant to catch them was empty or filled with someone doing a different job than the title implied.

The cost of getting this wrong keeps climbing. IBM's 2026 Cost of a Data Breach Report (published July 29, 2026) put the global average cost of a breach at $4.99 million, and AI-enabled breaches averaged $6 million. Detection, escalation, and the disruption that follows make up most of that total, exactly the ground a security analyst is hired to cover.

The entry point is shifting too. Verizon's 2026 Data Breach Investigations Report found vulnerability exploitation overtook stolen credentials as the top initial access vector, present in 31 percent of breaches studied (November 2024 through October 2025). Credential attacks haven't disappeared; attackers now combine both into one chain, so today's SOC analyst watches a wider, faster-moving set of entry points than the role covered two years ago.

Security Analyst: Three Jobs, One Title

This split isn't a hiring convenience. The NICE Workforce Framework for Cybersecurity, maintained by CISA, separates the work into categories including Protect and Defend (SOC and detection) and Oversee and Govern (compliance and risk) because the skill sets don't transfer cleanly. This template targets the SOC/detection flavor, the most common entry path; adjust Requirements toward audit skills for GRC, or scripting and automation for detection engineering.

The SOC Tier Model: How Analysts Actually Get Staffed

A SOC analyst posting with no tier named is incomplete: the tier sets the day-to-day work, the pay band, and the autonomy.

Most postings that say "Security Analyst" with no tier attached are really describing T1 or a T1/T2 blend. Naming the tier saves both sides time: candidates self-select accurately, and the interview tests for the right depth instead of guessing.

Primary Job Description Template

Worth a quick read first: our job description best practices guide. The template below defaults to a T1/T2 SOC analyst, the flavor most companies hire first; swap Requirements toward audit experience for GRC, or scripting and SIEM engineering for detection engineering.

About the Role

We're looking for a Security Analyst to join our Security Operations Center and catch threats before they become incidents. You'll monitor the alert queue across our SIEM and endpoint tools, triage and investigate anything real, and escalate confirmed incidents with a clear timeline. This is hands-on work, not policy-writing: expect judgment calls under pressure about what's noise and what's genuine.

You'll work a defined shift in our coverage rotation and partner with detection engineering on the rules you use daily. When an investigation turns up a real coverage gap, flag it back instead of closing the ticket.

The ideal candidate has sat in an alert queue and knows the difference between an alert that deserves five minutes and one that deserves fifty. You document your reasoning so the next shift can pick up where you left off, and false-positive fatigue doesn't wear you down. You'll report to our SOC Manager and work daily alongside detection engineers and incident responders.

Key Responsibilities

• Alert Triage and Investigation: Monitor SIEM, EDR, and network alerts, classify severity, and investigate anything beyond an obvious false positive
• Incident Escalation: Document and escalate confirmed incidents with a clear timeline and containment recommendation
• Log and Signal Correlation: Pull threads across authentication, network, and endpoint telemetry, the same pattern-finding instinct a data analyst applies to messier data, to confirm whether isolated alerts are one connected event
• Detection Feedback Loop: Flag noisy rules back to detection engineering, and flag coverage gaps an existing rule missed
• Shift Handoff Documentation: Leave a specific handoff covering open investigations and anything worth watching
• Tooling and Playbook Use: Run SOAR playbooks for common incident types, and flag gaps for new ones
• Vulnerability Awareness: Coordinate on patching priority when an alert traces back to a known exploited vulnerability
• Compliance Support: Contribute log evidence to audit requests, partnering with whoever owns compliance reporting

Requirements

Must-Have Qualifications:

• Associate's or bachelor's degree in cybersecurity, IT, or a related field, or equivalent experience
• 1-3 years in a SOC, security-focused help desk, or equivalent hands-on experience
• CompTIA Security+ or equivalent foundational certification
• Working knowledge of at least one SIEM platform (Splunk, Microsoft Sentinel, or similar)
• Comfort reading logs across Windows, Linux, and common network devices
• Understanding of the incident response lifecycle: identification, containment, eradication, recovery
• Clear written documentation habits, since your handoff is the next shift's starting point
• Ability to work the shift schedule the role requires, including rotating or overnight coverage

Nice-to-Have Qualifications:

• GIAC certifications relevant to detection work (GCIH, GCIA) or progress toward one
• Scripting ability in Python or PowerShell for repetitive triage tasks
• Prior experience with a SOAR platform or playbook logic
• Exposure to cloud security monitoring alongside cloud engineers
• Familiarity with the MITRE ATT&CK framework

What We Offer

• Competitive Compensation: Base salary aligned with market data for your tier, detailed in the Compensation Guide below
• Shift Differential: Additional pay for overnight or weekend shifts where coverage requires it
• Comprehensive Benefits: Health, dental, and vision coverage, plus 401(k) with company match
• Clear Growth Path: A defined track from T1 to T2 to T3 or into detection engineering
• Certification Support: Budget and study time for Security+, GIAC, or CISSP as you advance

Context Variations

Corporate Environment

Larger organizations usually run a formal SOC with defined tiers and shift rotations, not unlike a site reliability engineer's on-call rotation. Expect more process: change control before a detection rule ships, and coordination with a CISO rather than a generalist IT director. The GRC flavor is more likely to exist as its own headcount here, since audit volume justifies a dedicated seat past a certain size.

Startup Environment

At an early-stage company, "Security Analyst" is often the first security hire, reporting to a CTO or VP of Engineering before dedicated security leadership exists. Expect a blend of SOC work, SOC 2 evidence-gathering, and detection tuning. Be honest about the math first: one analyst can't provide 24/7 coverage alone.

Remote or Hybrid Environment

Remote SOC analysts need the same tooling access and escalation authority as anyone on-site: single sign-on, zero-trust SIEM access, and a tested path to the next tier outside business hours. A T1 analyst on a solo overnight shift from home needs a real way to reach a human when an incident escalates past what they can handle alone. "Follow the sun" staffing across regions beats asking one region to cover every overnight shift indefinitely.

Industry Considerations

Core triage skills transfer across industries, but which flavor gets hired first, and how much regulatory weight sits on top, shifts by sector.

Compensation Guide

How the Federal Data Maps to This Title

The U.S. Bureau of Labor Statistics tracks this work under Information Security Analysts: median annual wage $129,180 (May 2025) across 192,900 jobs, projected to grow 21 percent from 2025 to 2035 with about 14,100 openings per year, according to the BLS Occupational Outlook Handbook, Information Security Analysts (May 2025 wage data). That 21 percent is one of the fastest growth rates BLS publishes for any occupation in this collection.

Read that median carefully. BLS groups all three flavors, and every SOC tier, under one occupation code. A T1 analyst earns meaningfully less, and a senior detection engineer or T3 threat hunter typically earns more. Treat the figure as the center of a wide range, not a quote for one seat.

Certifications gate hiring unevenly, and requiring the wrong one for the wrong tier filters out good candidates for no reason. ISC2 requires a minimum of five years of cumulative, full-time experience across two or more of the eight CISSP domains to hold the full certification, which is why CISSP belongs on a senior posting, not a T1 or T2 one.

Market Compensation by Experience Level

The ranges below are employer-set market estimates built around the verified BLS baseline and standard SOC tier progression, not a quote from any single salary database.

Metro Adjustment Guide

What moves a specific offer: which flavor the role is, SOC tier, shift differential, and how much of the total is base versus shift premiums.

Experience Level Requirements Matrix

Interview Questions

Technical/Functional Questions

1. Alert Triage: "Triage an alert flagging a login from a new country for a traveling user." Look for: a structured process (travel records, device check), not one gut-check step.
2. False Positive Judgment: "How do you decide a routine-looking alert needs a second look?" Look for: specific criteria, and awareness that fatigue makes this call harder over time.
3. Log Correlation: "Three low-severity alerts hit different systems in ten minutes. Connected or not?" Look for: pulling a timeline for a shared indicator, not treating each alert as isolated.
4. Incident Scoping: "How do you scope an incident, and know when you're done scoping?" Look for: a real method for boundaries, not "keep looking until nothing new turns up."
5. SIEM Fluency: "Write a query for failed logins followed by a success, same account, five minutes." Look for: real fluency with syntax and logic, not a vague description.
6. Detection Gap: "An incident happened and no alert caught it. Who do you loop in?" Look for: closing the loop with detection engineering, not just documenting.
7. Vulnerability Prioritization: "A scan surfaces fifty vulnerabilities. What gets patched first?" Look for: weighing exploitability and exposure, not CVSS score alone.
8. Threat Intelligence Application: "How does threat intel actually change your daily triage?" Look for: a concrete example, not a general claim of staying informed.

Behavioral Questions

1. "Tell me about a time you caught something everyone else dismissed as noise." Look for: specific reasoning for looking twice, not a lucky guess.
2. "Describe a shift where alert volume was overwhelming. How did you prioritize?" Look for: a real triage framework under pressure, and honesty about tradeoffs.
3. "Tell me about a time you escalated something that turned out to be nothing." Look for: comfort being wrong sometimes; never over-escalating usually means under-escalating.
4. "Walk me through the worst incident you've worked, start to finish." Look for: a clear narrative naming their role, not "the team" handling everything.
5. "Describe handing off an in-progress investigation at shift end." Look for: specificity, since a bad handoff is where investigations quietly die.
6. "Tell me about a disagreement with a detection engineer over an incident." Look for: advocating their read without just deferring or digging in unreasonably.

Culture Fit Questions

1. "How do you stay sharp during a quiet shift with no real incidents?" Look for: proactive habits like threat hunting, not just watching the queue.
2. "What does a healthy SOC and detection engineering relationship look like?" Look for: a two-way feedback loop, not the SOC just consuming whatever ships.
3. "How do you handle alert fatigue without letting triage quality slip?" Look for: real coping strategies; this surfaces burnout risk before it becomes attrition.
4. "What do people underestimate about SOC shift work before they start?" Look for: an honest, specific answer, not a rehearsed line about flexibility.

Evaluation Tips: Strong candidates describe a specific alert, not "strong analytical skills." Be wary of anyone who can't explain triage without naming a tool, since tools change and judgment doesn't. For GRC candidates, swap the SIEM questions for audit evidence and vendor risk.

Hiring Tips

Quick Sourcing Guide

• LinkedIn: Search "SOC Analyst" or the specific tier to filter out generalist IT candidates who've never worked an alert queue
• GIAC and SANS Communities: Certification directories and alumni networks surface real hands-on candidates
• CTF and Home Lab Signals: Capture-the-flag history or a documented home lab often predicts skill better than a resume line
• Internal Help Desk Promotion: Staff who've flagged phishing and asked good security questions make strong T1 candidates who know your environment
• GRC-Specific Sourcing: For the compliance flavor, look toward audit and risk communities, not just security-titled resumes

Red Flags to Avoid

• Tool-only fluency: Can navigate a SIEM's interface but can't explain the logic behind what they're looking for
• No triage framework: Investigates every alert the same way regardless of severity, a sign of inexperience
• CISSP required for a T1 role: Asks for five years of experience at a salary that doesn't reflect it, filtering out candidates who'd grow into the role
• Can't describe a real handoff: No sense of what belongs in shift documentation, which predicts dropped investigations
• Unrealistic about shift work: Claims total flexibility with no hesitation, either dishonest or a sign they haven't thought it through