Photo: U.S. Marine Corps photo by Cpl. Bridgette Rodriguez (Public domain)
Job description
Day to day work includes running vulnerability assessments and penetration tests to find weak points before an attacker does, maintaining security tools and access controls, and training staff on safe practices like spotting phishing attempts. When an actual breach or intrusion happens, analysts shift into investigation and response mode, often on call for exactly this kind of urgent situation, then document what happened for leadership and compliance reporting. The role usually requires a Bachelor's degree in computer science or information security, and industry certifications like CISSP carry real weight in hiring.
Pros
- High upside earning potential, up to $165k, with strong pay even at entry level
- Wide variety of work, from monitoring to penetration testing to staff training
- Industry certifications like CISSP offer a clear path to career advancement
Cons
- Above-average hours, expect more than a standard 40-hour work week
- On-call availability is common, with pace shifting from routine to urgent without warning
- Constant vigilance required, since a missed intrusion can lead to a major breach
A typical day
The SIEM dashboard greets the analyst with overnight alerts triaged by severity: most are noise — a misconfigured server tripping login rules — but the third one down shows a user account authenticating from two continents in an hour, and that one becomes the morning. The investigation runs on logs: tracing the session, checking what the account touched, pulling the endpoint's process history, and making the call — compromised credentials, contained by a password reset and token revocation before lateral movement started. The afternoon holds proactive work: a vulnerability scan of a new application before launch, patching priorities argued with IT (everything can't be first), and a phishing simulation whose click-rate report goes to management. Attackers only need to win once; the analyst's job is making every day boring.
Tasks at the job
- Monitor networks and systems for signs of security breaches or intrusions.
- Investigate and respond to security incidents as they are detected.
- Conduct vulnerability assessments and penetration tests on company systems.
- Implement and maintain security tools, protocols, and access controls.
- Train staff on security awareness and safe practices.
- Document incidents and prepare reports for leadership and compliance.
Workplace & working conditions
Work happens indoors at a desk, often in a security operations center with multiple monitors tracking network activity.
The pace can shift from routine monitoring to urgent in moments, with real time pressure during active incidents. The work follows structured procedures but requires constant vigilance, and on-call hours are common.
Education necessary or common
Bachelor's degree in computer science, information security, or a related field; industry certifications (e.g. CISSP) matter a lot
Common college majors
Licenses & certifications
- CompTIA Security+
- CySA+ (Cybersecurity Analyst)
- CISSP (later, with experience)
- GIAC certifications (GSEC, GCIH)
Career path
Related fields
Courses to take
- AP Computer Science Principles — networking and internet fundamentals
- AP Computer Science A — scripting is a daily analyst tool
- AP Statistics — anomaly detection is statistical thinking
- Math through Precalculus — logical rigor
- English — incident reports go to executives; clarity matters
Clubs, activities & competitions
- CyberPatriot — the flagship high school cyber defense competition
- picoCTF and other capture-the-flag events
- Coding club
- Build a home lab: virtual machines, deliberately vulnerable targets (legally, on your own systems)
First steps you can take now
- Register for picoCTF and work through the beginner challenges
- Join or start a CyberPatriot team this season
- Take the free Security+ prep material and learn the vocabulary
- Set up a virtual machine lab and practice hardening a system
