Hiring A Security Analyst For A SOC Where AI Triages The Alerts

What Does Your Security Analyst Do Once AI Triages The Alerts?

Tuesday, 3 a.m. An agent closes 400 alerts, writes a tidy paragraph about a service account in Azure, and marks it benign. It was right 396 times. The analyst you need is the one who opens the four, notices the account authenticated from a new region eleven minutes before the token refresh, and reopens the case. That judgment is now the job.

One security vendor's account of the shift points the same way: repetitive alert triage is down, time spent verifying AI-led investigations is up, and what matters is evaluating what an AI-generated investigation missed rather than console-clicking memory or raw queue speed ³. That is a single source and worth reading as one, but the behaviors it implies are narrow enough to test in a room.

Start with scoping. Ask a candidate how they would investigate that Azure service account, and listen to what comes back before any query does: which identity provider you run, what the log retention is, whether the alert fired on sign-in or on resource access. Someone who opens by naming tools has skipped the step where the case gets defined, and defining it is what surfaces the eleven minutes.

Then listen for how they handle the agent's tidy paragraph. A strong analyst reads a generated summary as a hypothesis carrying citations to check: which log line says this account is a service account, which field says the region is new, what would have to be true for the benign verdict on all 400 to hold. Specificity about the underlying telemetry is the signal. Skepticism as a posture is easy to perform and tells you nothing.

The writing matters as much, because most escalations end in a sentence a business owner reads at 9 a.m. Ask for a real incident summary with the company details stripped. It separates candidates faster than any puzzle, and it is what the 3 a.m. reopen eventually has to become.

Last, ask what they would refuse to hand over. Containment decisions, scope calls, and anything that touches a customer stay with a person. A candidate who cheerfully lets an agent isolate hosts unsupervised is telling you something about how they will behave on your worst day.

Which Backgrounds Produce An Analyst Who Can Audit An AI Investigation?

The obvious pipelines still work: help desk into SOC, military and government cyber roles, a two-year degree plus a home lab. What has changed is that the strongest signal now comes from anyone who has had to check a system's confident output against reality for a living, which widens the funnel well past security-titled resumes.

Sysadmins and cloud and identity engineers convert best. They already know what normal looks like in Entra, Okta, or AWS IAM, and a person who has debugged a broken conditional access policy at 2 a.m. reads an authentication timeline faster than someone who has only read about one. Detection engineering, threat hunting, and security automation are the paths analysts move into now, and they reward people who treat the SOC as a system to build rather than a queue to work ³.

The unexpected ones are worth naming. Fraud analysts and anti-money-laundering investigators spend their days on high-volume alerts from a scoring engine that is confidently wrong a predictable fraction of the time; that is the exact muscle. Clinical lab techs and air traffic controllers bring alarm discipline. Journalists and paralegals bring source verification, and they write. Quality engineers bring reproduction steps, which is most of what a good escalation is.

What to discount: a certification list with no artifact behind it, and years-in-seat as a proxy for seniority. Investigative judgment is now the thing that separates levels, not time served ³. A candidate with two years who can dismantle a bad AI conclusion is worth more to you than one with six who cleared a queue that an agent now clears.

If the role you are scoping is really about building the detection and automation stack rather than working cases, hire against the AI security engineer profile instead. Mixing the two in one job description is how the search stalls for a quarter.

How This Analyst Got Good: The AI Practice Behind The Skill

The candidates who are good at this did not get good by reading about prompt techniques. They got good by using an assistant on real cases and getting burned on specifics, then building habits that survive the burn. Ask about the practice directly and the answers are concrete in a way that is hard to fake.

The common pattern: they run the assistant first on cases where they already know the answer. A closed incident from last quarter, replayed through the copilot, shows exactly where the model invents a plausible link between two unrelated log events. Analysts who have done this can name the failure mode they keep seeing, and the naming is the tell.

They write their own detections and let the assistant argue with them. Drafting a Sigma or KQL rule, then asking the model for false-positive scenarios, is a cheap loop that produces real skill. Most of the good ones can show you a rule they tuned three times and explain what each version got wrong in production.

They keep a source outside the conversation. Threat intel summarized by a model gets checked against the vendor advisory. An asset the model calls a domain controller gets checked against the CMDB. When you ask what they do when the assistant sounds certain, the answer you want is a specific place they go to look, not the word "verify."

Ask what an assistant has been wrong about this month. Anyone with real practice has an example, usually a small one with an oddly precise detail attached, and the detail is the part to press on. A general answer about hallucinations is what arrives when there is no example behind it.

Where To Find Security Analysts Who Already Work This Way

Not on the job boards, mostly, because the analysts you want are employed, well paid, and not looking. They are visible anyway. Security has an unusual amount of public practice in it, from detection rules published under real names to conference talks that are free to watch, and the venues are stable enough to name here.

Community and craft venues. The Detection Engineering and Threat Hunting communities on Discord and Slack, the SANS Blue Team and DFIR summits and their free talk archives, BSides events in most large metros, and the DFIR Report's public write-ups. Anyone who publishes detection logic under their own name has already shown you their reasoning. So has anyone who maintains rules in the public Sigma repository or writes up a lab on their own site.

Adjacent roles inside your own company. IT operations, cloud platform, and identity teams contain people who are one internal transfer away from being a strong analyst, and they already know your environment, which is the expensive half of ramping anyone. A referral loop with those managers beats a fourth agency.

Feeder employers. Managed detection and response providers and large MSSPs (Arctic Wolf, Expel, Red Canary, Sophos, Rapid7 and similar) run analysts across many customer environments at volume, which is unusually broad exposure per year served. Regional banks, hospital systems, and universities hire and train juniors that larger SOCs later poach. Analysts who came out of government and defense SOCs bring process discipline that private teams often lack.

One caution on sourcing tooling. If your recruiters are filtering resumes by certification keyword, the pool you see is the pool that optimized for keywords. The teams doing this well are handing candidates a case in the first round instead, which is the same shift described for AI-fluent talent acquisition work generally.

What Does An AI-Augmented Security Analyst Cost, And Where Do They Sit?

There is no published salary series for the AI-augmented title specifically, so price against the established occupation and adjust. As of mid-2026, levels.fyi reports a median total compensation of $122,720 for cybersecurity analysts in the United States, with the 25th percentile near $91,500, the 75th near $175,000, and the 90th near $224,000 ⁴. The federal series is close on the base title: BLS reports a median wage of $124,910 for information security analysts ¹.

Read the spread rather than the midpoint. The gap between the 25th and the 90th percentile is roughly two and a half times, and it tracks cloud and identity depth, detection engineering ability, and shift structure more than years of experience. If you want someone who can audit AI investigations and write detections, you are shopping above the median, closer to the 75th percentile band, and a posting anchored to the median will simply not get answered.

The demand picture supports paying it. BLS projects information security analyst employment to grow 29 percent from 2024 to 2034 ¹, and its own analysis of AI effects treats this as an occupation AI raises rather than suppresses ². Hiring managers should still expect the entry rung to be the contested part: the tier-1 work juniors used to learn on is the work the agents took first.

Shift and location norms have moved with the tooling. Fully remote analyst work is now normal at MDR providers and at most cloud-first companies, because the telemetry is in a browser either way. Follow-the-sun coverage has replaced a lot of overnight staffing, and the graveyard shift premium is disappearing along with the alerts that justified it. On-premise expectations persist in three places: classified and cleared environments, operational technology and manufacturing floors, and organizations whose regulators or insurers still ask about physical access controls. Say which one you are in the first line of the posting. Candidates screen on it before they read anything else.

Close A Security Analyst By Naming The Work, Not The Tooling

The offers that get accepted describe cases, not stacks. A listing of vendor names tells a good analyst nothing about whether the job is interesting, and everyone's listing has the same names on it. Describe two incidents the team handled last quarter and what the analyst decided in each: the service account from an unfamiliar region, and what changed after somebody reopened that case at 3 a.m. That paragraph does more closing work than the compensation line.

What this candidate cares about, in rough order: whether they get to touch detection engineering and not just verdicts; whether the escalation path is real or whether every hard call goes to one senior; how much of the week is queue work versus project work; and whether the team has time to write things down. Alert volume per analyst is a question they will ask, and a vague answer reads as a bad one.

What kills the offer: a take-home that runs six hours, five rounds for a mid-level role, an on-call rotation described only after the offer, and any hint that AI adoption is a headcount reduction plan in progress. Analysts talk to each other about this last one, and a rumor that your SOC is automating toward a smaller team will cost you candidates you never hear from.

The other quiet killer is a manager who cannot say what the analyst is accountable for once the agent writes the first draft. Have the answer ready before the final round. If governance and audit obligations are part of the role, be explicit about that too, because it is a different job than case work; the AI security governance officer profile covers where that line usually falls.

And move fast. A strong analyst who is passively looking has two other conversations open, and the process that takes three weeks to schedule a second round is the process that loses.

See a sample report >