Voice of the Analyst Study

Cybersecurity defenses are only as effective as the security operations centers (SOCs) and analysts who staff them. While many studies focus on SOC structure and tooling, this “Voice of the Analyst Study” focuses on the human side of the operation to build understanding and empower teams. By gathering perspectives from vetted analysts globally, this report uncovers what draws people to the SOC and why many are now seeking to leave.

The results show a meaningful disconnect between expectations and reality, with 45% of respondents stating the reality of SOC life has not met their original motivations. Job satisfaction is a 3-to-1 split between satisfied and unsatisfied staff, yet nearly 1 in 3 analysts are currently hunting for a new role. This report rewards the reader by identifying the specific activities—like real-time monitoring—that drive dissatisfaction and “burnout powder” through repetitive tedium.

An analyst’s range of activities appears more important for catching intruders than their years of experience. “Generalists” who wear many hats are twice as likely to have claimed a recent intruder detection than “focused” staff tasked primarily with alert triage. This study concludes by offering data-driven recommendations on how to shift SOC workloads toward high-enjoyment, high-value tasks like threat hunting and forensics.

Key Findings

• Unmet Expectations for 45%: Nearly half of security operation center staff report that the reality of their job does not match their initial expectations.
• Generalist Success Rate: Generalists who perform a diverse range of activities are twice as likely to claim a recent intruder detection compared to staff with focused responsibilities.
• 1-in-3 Analysts Job Hunting: 32% of respondents are actively seeking other job opportunities, driven by a desire for better career progression and less tedium.
• Monitoring vs. Detections: Real-time event monitoring is the most time-consuming task but remains the activity least correlated with catching intruders.
• Forensics Lead Detections: Forensic analysis shows the strongest correlation with recent detections, with 88.5% of those specializing in it reporting a recent catch.
• Dissatisfaction Growth: Job dissatisfaction is 25% higher among experienced “expert” analysts compared to those in entry-level SOC roles.