Cybersecurity Analyst
Protect organizations from cyber threats. Monitor networks, respond to incidents, and implement security frameworks.
What a typical day looks like
Cybersecurity is more reactive than people expect. My day starts with checking overnight alerts from our SIEM (Microsoft Sentinel in our case). Most are false positives — automated rules flagging benign events. I triage them, mark them as handled, and look for the 2-3 that are genuine. Mornings are usually spent on these investigations: tracing a suspicious login, figuring out if a user clicked a phishing link, or working out whether a flagged process is malware or just a noisy update. After lunch I switch to proactive work: writing new detection rules, helping engineering harden a service, running a tabletop exercise with the team. Once a month I'm on incident response on-call. When that happens, I'm glued to my phone. The rest of the time, I'm fairly normal hours — security teams burn out fast otherwise.
Hour-by-hour
Skills you need
Required
Nice to have
Build these to stand out
Hands-on projects beat any CV bullet point. Pick one and finish it.
Home Security Lab with Wazuh + Suricata
Set up an open-source SIEM and IDS in your home lab using a Raspberry Pi or old laptop. Generate logs, write detection rules, document attacks (using a deliberately vulnerable VM like Metasploitable). Publish on GitHub.
Shows you can run security tooling end-to-end. Most candidates only have theoretical knowledge.
Capture the Flag Write-ups
Complete 10 CTFs on TryHackMe or HackTheBox. Write a clear, public write-up for each (after the official solution is allowed). Show your reasoning, not just the steps.
Demonstrates hands-on skills and the ability to communicate clearly. Recruiters love write-ups.
Threat Hunting Report
Take a public threat intelligence report (e.g. from Mandiant, CrowdStrike). Build detection rules in Sigma format for the techniques described. Publish on GitHub with explanations.
Senior-level project. Few candidates do this. Stands out hugely.