Cybersecurity Analyst job description and duties

Updated 16 September 2026 · 2 min read

A cybersecurity analyst helps an organisation detect, understand and respond to threats against its systems and data. The balance of work varies: some analysts spend most of their time monitoring alerts in a security operations centre, while others focus on vulnerability management or advising teams on controls. The duties below cover what most analyst posts include.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

Purpose of the role

The role reduces the chance that an attack succeeds and limits the damage when one does. Analysts give the organisation visibility of what is happening on its networks and systems, find weaknesses before attackers exploit them, and help it respond quickly and correctly when something goes wrong.

Monitoring and investigation duties

Monitor security alerts from SIEM, endpoint and network tools.
Investigate suspicious activity and decide whether it is malicious.
Escalate confirmed or likely incidents according to procedure.
Tune detection rules to reduce false positives.
Review phishing and other suspicious messages reported by staff.
Document each investigation and its outcome.

Vulnerability management duties

Analysts schedule and run vulnerability scans, review the results, and work with system owners to prioritise and fix weaknesses. They track remediation, verify that fixes worked and report on overall exposure. Some roles also include reviewing the security configuration of new systems before they go live.

Incident response support

During incidents, analysts help contain threats, gather evidence, analyse what happened and support recovery. Afterwards they contribute to reports that explain the cause and recommend improvements, so the same attack is less likely to succeed again.

Reporting and advice

Analysts produce regular reports on threats, incidents and vulnerabilities for managers. They advise IT teams on secure configuration, contribute to security policies, and help deliver awareness training for staff.

Working relationships

Analysts work closely with network and systems administrators, application owners, the helpdesk, and senior security staff such as an information security officer. During significant incidents they may coordinate with outside parties, including security vendors, managed security providers and national authorities.

A typical shift

A shift usually starts by reviewing what happened overnight: open alerts, incidents still being handled and anything a colleague has flagged for follow-up. The rest of the day mixes alert triage with longer work such as investigating a suspicious account, checking the progress of vulnerability fixes or improving a detection rule. Analysts also answer questions from colleagues across the organisation, many of which begin with a forwarded email asking whether it is genuine.

Open adverts for this position

No open Cybersecurity Analyst advert matched when the jobs board was last checked. It is refreshed every morning.

Browse every open vacancy

Common questions

Do cybersecurity analysts work shifts?

In security operations centres that monitor around the clock, shift work is common. Analysts in smaller teams usually work office hours with some on-call responsibility.

Is a cybersecurity analyst the same as an ethical hacker?

No. Analysts mainly detect, investigate and defend. Penetration testers, sometimes called ethical hackers, attack systems with permission to find weaknesses. The skills overlap, and some people move between the two roles.