Cybersecurity Analyst
The picture is dramatic hacking; the real entry-level job is patient defense — watching dashboards, triaging alerts, figuring out a real threat from a false alarm. Demand is huge, but the junior door is famously hard, and AI is now automating the exact starter tasks people used to learn on.
Related:Software Engineer·Data Analyst·AI Application Builder
Worth a look if you’re patient, detail-obsessed, and like investigating whether something is a real threat or a false alarm. Maybe not if you pictured constant dramatic hacking — most of the job is watching, triaging, and paperwork — or you want an easy way in.
The work
What you’d actually do all day
The picture is offensive hacking and red-teaming, but that’s a separate, harder-to-enter track — the common entry job is defensive: watching security dashboards, reviewing logs, and triaging alerts to tell a real threat from a false alarm, plus a lot of compliance paperwork. In 2026 AI is taking over that first-pass alert triage, so the durable part is the investigation AI can’t finish: hunting what it misses and judging what an attacker is actually trying to do.
- Monitoring & alert triage45%
- Investigation & response20%
- Threat hunting & analysis10%
- Tooling & automation10%
- Reporting, strategy & meetings15%
tier-1 analysts spend most of their time on alert monitoring and triage (the exact rung AI is automating); senior roles shift toward proactive threat hunting, architecture, automation, and strategy.
Rough split, based on how the work is described. Varies by org.
A typical early-career day
- 9:00Watch the dashboards
Scan the stream of security alerts. Most are noise; the job is spotting the one that isn’t.
- 10:30Investigate a suspicious one
Dig into an alert: real threat or false alarm? This is the core judgment call, made over and over.
- 1:00Document & escalate
Write up what you found and route it to the right people. Careful records are a big part of the job.
- 2:30Trace what happened
When something’s real, dig through the logs to reconstruct it — patient, detailed detective work.
- 4:30AI triages tier-1
AI now does the first-pass alert sorting; you hunt what it misses and make the calls it can’t.
A rough entry-level (SOC) day, often on-call. The flashy offensive-security work most people picture is a separate track that itself takes experience to enter.
Would you actually like it?
In practice, here’s when people realize this is their thing, and when they realize it isn’t.
In practice, people realize it’s their thing when…
- they’re patient and detail-obsessed — they’ll notice the one weird thing in a wall of logs
- figuring out whether an alert is a real threat or a false alarm feels like a puzzle
- they stay calm under pressure and like having a clear, careful process
- they’re curious about how attackers think and how to stay a step ahead
…and it probably isn’t their thing when
- they pictured dramatic hacking — most of the job is monitoring, triaging, and compliance paperwork
- they want an easy way in — the junior door is famously hard (it wants experience plus certs)
- the entry rung is doubly squeezed: it’s credential-gated AND the tier-1 work is exactly what AI now automates
Start here
Investigative Mini-Report
Pick a real question with a hidden answer, dig through documents and interviews, and separate the signal from the noise to figure out what’s actually true. One honest note: this isn’t a security project — but the core muscle, investigating from messy evidence and not getting fooled, is the same one a good analyst runs on every day.
The numbers
The real money and market
A cybersecurity analyst earns roughly $62–75K starting and up to ~$165K senior. You’ll see an official median around $125K — that runs high because it lumps in senior security engineers and architects, the roles analysts grow into, not the entry job itself.
BLS Information Security Analysts (SOC 15-1212, median $124,910, May 2024; +29% 2024–34); PayScale analyst-title experience bands (2026).
Where it’s going
Cybersecurity is one of the fastest-growing fields anywhere — the BLS projects about 29% growth, and there are hundreds of thousands of unfilled US openings. But AI is reshaping it from the bottom: it’s automating tier-1 alert triage — the classic entry job — so some teams are shrinking those roles. The value is moving up to AI-augmented investigation, threat hunting, and securing AI systems themselves.
Right now
Here’s the paradox: demand is enormous and the talent gap is famous, yet the junior door is brutally hard — entry jobs expect experience and certs you can’t easily get without a job, and AI is now automating the exact tier-1 work that used to be the training ground. The field is booming, but breaking in rewards demonstrated, hands-on skill and a clear specialty over a generic résumé.
Sources: BLS OOH Information Security Analysts (SOC 15-1212, May 2024); ISC2 2024/25 Workforce Study (global gap); SANS/GIAC 2026 (AI cutting tier-1 roles); CyberSeek US openings. Dated June 2026.
The only way to know is to try it.
Pick a project and see how it feels.