Os Papéis · Quem defende

Security operations analyst

Escrito a partir de fontes publicadas

The analyst who watches an environment for the signs of an adversary. The national framework describes the work as analysing data collected from a range of defensive tools to mitigate risks, and the day is built from that: alerts, logs, traffic records and the judgement that turns them into a decision. The role runs in tiers, with triage at the front and investigation and hunting behind it.

De quem recebe

The estate

Telemetry, at whatever fidelity somebody chose to collect it.

Threat intelligence

What adversaries are doing elsewhere, and the indicators that follow.

Engineering and operations

Context: the change that explains the anomaly.

A quem serve

The organisation

The difference between an incident found early and one found by somebody else.

Incident response and management

A characterised event with evidence attached.

Detection engineering

The feedback that turns a noisy rule into a useful one.

Do que o trabalho depende

Attention is the finite resource, and it is spent by every alert whether the alert earned it or otherwise. A queue tuned so that arriving alerts deserve a look keeps analysts sharp for the one that matters; a queue that floods trains people to close things quickly, and that training holds on the night it should break. Tuning is therefore the defensive work rather than a chore beside it.