ronutz

The Roles · Who defends it

Security operations analyst

Written from published sources

The analyst who watches an environment for the signs of an adversary. The national framework describes the work as analysing data collected from a range of defensive tools to mitigate risks, and the day is built from that: alerts, logs, traffic records and the judgement that turns them into a decision. The role runs in tiers, with triage at the front and investigation and hunting behind it.

What the day looks like

  • Triaging alerts, where the volume means the first skill is deciding what deserves attention.
  • Investigating what survives triage, across whatever telemetry the organisation happens to keep.
  • Containing an incident and preserving what an investigation will later need.
  • Hunting: looking for the activity that generated no alert at all.
  • Tuning the detections, since every false alert spends attention that a real one will need.

What it answers for

  • The alert being handled and the handling being recorded.
  • Evidence preserved in a state that survives scrutiny.
  • Escalation happening at the right moment, which is earlier than it feels.

What it is measured on

  • Time to detect and time to respond.
  • Alert volume handled, and the proportion escalated.
  • Detection coverage against a recognised adversary framework.

Who it receives from

The estate
Telemetry, at whatever fidelity somebody chose to collect it.
Threat intelligence
What adversaries are doing elsewhere, and the indicators that follow.
Engineering and operations
Context: the change that explains the anomaly.

Who it serves

The organisation
The difference between an incident found early and one found by somebody else.
Incident response and management
A characterised event with evidence attached.
Detection engineering
The feedback that turns a noisy rule into a useful one.

Who else has a stake

  • Legal, regulatory and communications functions, whose obligations begin the moment an incident is confirmed.
  • Customers and the public, when the organisation holds their data.
  • The insurers and auditors who will read the record afterwards.

What it takes

  • Sustained attention across a shift, which is the physical fact of the job.
  • Enough breadth to recognise ordinary behaviour in systems the analyst has never operated.
  • Writing that holds up when read later by a lawyer or a regulator.
  • The judgement to escalate on partial information, which is the only kind available early.

What the job turns on

Attention is the finite resource, and it is spent by every alert whether the alert earned it or otherwise. A queue tuned so that arriving alerts deserve a look keeps analysts sharp for the one that matters; a queue that floods trains people to close things quickly, and that training holds on the night it should break. Tuning is therefore the defensive work rather than a chore beside it.

The published sources

Where it leads

Roles that lead here

The work itself

The Practice covers how this work is done — triage, escalation, evidence, handover — across the whole corpus.

Read The Practice