Information Security Analyst

Also known as: Security Analyst, SOC Analyst, Cyber Security Analyst, Security Operations Analyst, Threat Analyst.

What does an Information Security Analyst do?

An Information Security Analyst is a specialist who monitors threats, investigates incidents and finds vulnerabilities in company systems before attackers do. Depending on the company the focus can be monitoring and response (SOC), vulnerability management, threat intelligence or compliance with standards such as ISO 27001, SOC 2 or PCI DSS:

• review events in the SIEM and sort real attacks from false positives;
• investigate incidents, help contain them and describe what should change afterwards;
• find vulnerabilities, prioritise them and make sure teams fix them;
• write and tune detection rules;
• check access rights and configurations and prepare materials for audits.

When does a company need an Information Security Analyst?

A company needs an Information Security Analyst when it already has security tools and a flow of events, but nobody to review them every day. Common triggers: a large customer or a regulator requiring an audit, a first serious incident, growth of cloud infrastructure after which the DevOps team can no longer keep an eye on security. In banks, fintech and telecom the role is usually needed earlier than in other industries. The role won't work if the company has neither a security strategy nor a budget for tools yet: then it first needs a CISO or a Head of Security to build them.

Information Security Analyst vs CISO: what's the difference?

An Information Security Analyst differs from a CISO in doing the hands-on protection work, while a CISO owns the security strategy, budget and risks and reports to the leadership. The analyst works within the rules the CISO sets and gives them the data for decisions. A DevSecOps Engineer builds security into development and CI/CD, while the analyst mostly works with what is already running. In smaller companies one analyst often covers all of these areas.

Why is it hard to hire an Information Security Analyst?

An Information Security Analyst is hard to hire because very different profiles hide under one title, and not everyone has experience of real investigations.

• The title is broad: monitoring, vulnerabilities, threat intelligence and compliance need different skills, and a candidate strong in one may not fit another.
• Certifications are easy to get without practice, so a CV rarely shows whether the person has investigated incidents or only knows about them from courses.
• Many roles require shift work or on-call duty, and strong candidates turn them down.
• Experienced analysts from banks and managed security providers hold on to their jobs and rarely apply to job posts.

What to decide before hiring an Information Security Analyst?

• Which focus matters most: monitoring and response, vulnerabilities, threat intelligence or compliance? The answer shapes the whole candidate profile.
• What exists now: a SOC and a SIEM, or is security being built from scratch? The first analyst in a company has to be able to choose and set up tools, not only work in existing ones.
• Is there shift work or on-call duty for incidents? This has to be said at the start, or candidates drop out at the final stages.
• What do you protect: cloud, your own infrastructure, the corporate network or the product? Investigation experience in the cloud and in a corporate network differs noticeably.
• Which standards and regulators do you have to satisfy? This decides whether you need experience preparing for specific audits.

Where to find an Information Security Analyst?

Information Security Analysts most often come from SOC teams at banks, fintech, telecom and large product companies, from managed security providers and from security vendors; some grow out of system administration and network engineering. A strong signal in a profile is incidents they investigated, detection rules they wrote and CTF results. Certifications carry weight when practice stands behind them. NEWHR finds these candidates by the results of their work, not by applications to job posts.

How to assess an Information Security Analyst in an interview?

An Information Security Analyst is assessed with a walkthrough of an incident the candidate investigated and a practical task on a set of logs or alerts. In the task they need to tell a real attack from a false positive and explain what to do next. On the company side the CISO or SOC Manager takes part, along with an Infrastructure Engineer who asks about networks and operating systems.

Strong signals:

• describes an incident step by step: how it was spotted, what they found in the logs, how it was contained, what changed afterwards;
• explains why they would treat an alert as noise and how they would tune the rule to remove it;
• understands how networks and operating systems work, not just the SIEM interface.

Red flags:

• describes the job only as responding to alerts by the runbook;
• can't give an example of an incident they investigated themselves;
• lists certifications and tools instead of talking about decisions.

How long does it take to hire an Information Security Analyst?

We present the first candidates for the Information Security Analyst role within 5–7 days of the brief.

Related roles

• CISO — owns the company's security strategy, budget and risks.
• DevSecOps Engineer — builds security into development and CI/CD.
• Network Security Developer — writes the network security tools the analyst uses.
• DevOps Engineer — owns the infrastructure in which the analyst looks for threats.