What does a cyber security analyst do? Tasks, tools and pay

A cyber security analyst watches an organisation's systems for signs of attack, decides which alerts are real, and either fixes the problem or hands it to the right person. That's the core of it. Around that sit reporting, access reviews, threat research and a fair bit of paperwork for audits.

If you're picturing a hoodie and a green screen, adjust your expectations. Most of the job is careful, repetitive checking. It's interesting work, but it rewards patience more than genius.

What does a cyber security analyst actually do all day?

The Prospects job profile lists the main duties, and they match what UK job ads ask for. In plain terms, you'll spend your time on a handful of recurring jobs.

Triage. Monitoring tools fire alerts all day. Most are noise. Your job is to look at each one, work out whether it's a false positive, and close it or escalate it based on severity.

Investigation. When something looks real, you dig. Which user? Which machine? What happened in the minutes before? You pull logs, check timelines and build a picture.

Reporting. Every incident needs writing up: what happened, what you did, what should change. Good analysts write clearly. Weak ones write long.

Access and risk. You'll review who has access to what, flag accounts with too many permissions, and keep the security risk register up to date for audits.

Research. You keep an eye on new phishing campaigns, malware families and ransomware groups so you know what to look for.

In bigger organisations some analysts also test security products, help with disaster recovery plans or do simulated attacks. At entry level, though, expect triage, investigation and reporting to fill most of your week.

Which tools will you use?

This is where job ads get specific. On IT Jobs Watch, across 149 permanent UK SOC analyst ads in the six months to 9 November 2026, SIEM came up in 30.2% of them, Splunk in 19.5%, QRadar in 11.4% and PowerShell in 15.4%. CompTIA Security+ was mentioned in 15.4% too.

A SIEM (security information and event management) tool is the centre of the job. It pulls logs from firewalls, servers, laptops and cloud services into one place and raises alerts. Splunk, IBM QRadar and Microsoft Sentinel are the names you'll see most.

Around the SIEM you'll use EDR (endpoint detection and response) tools such as Microsoft Defender for Endpoint or CrowdStrike, a ticketing system to log incidents, and threat intelligence sites to check suspicious IPs, domains and file hashes.

My advice if you're new: pick one SIEM and get properly comfortable with it. Splunk offers free training and a free trial. Being able to write a basic search and explain what it found is worth more in an interview than a list of ten tools you've only read about.

Do you need to know programming for cyber security?

No, not to get your first job. Most analyst work is reading, filtering and judging, not writing software.

That said, a bit of scripting goes a long way. PowerShell is useful on Windows estates, Python is useful almost everywhere, and both let you automate the dull checks you'd otherwise do by hand. PowerShell turning up in roughly one in seven SOC analyst ads tells you it's a plus, not a gate.

Here's how I'd prioritise it. Learn how networks work first (IP addresses, ports, DNS, common protocols). Then learn to read Windows event logs and Linux logs. Then pick up enough Python or PowerShell to parse a log file and count things. That order matches how the work actually lands on your desk.

If you're drawn to penetration testing or security engineering later, coding matters more. For analyst roles, it's a bonus.

What hours do cyber security analysts work?

Prospects puts typical hours at 35 to 40 a week, Monday to Friday, but that's only half the story. Security operations centres run around the clock, so many junior roles involve shifts, nights, weekends or an on-call rota.

Ask about this before you accept an offer. A 24/7 shift pattern can be fine (and often pays an allowance), but it doesn't suit everyone. Hybrid and fully remote analyst roles do exist, especially in managed security service providers.

How much does a cyber security analyst earn in the UK?

Pay varies a lot by sector and location, so treat these as ranges rather than promises.

The IT Jobs Watch figure covers SOC analyst ads at every level, and its 10th percentile sat at £40,000. Genuine trainee roles often start lower than any of these numbers, so don't assume your first offer will match the median.

At the senior end, Prospects notes that leadership roles can pay in excess of £100,000. That's years away for most people, but the ceiling is real.

How do you become a cyber security analyst?

There's no single route. Prospects lists STEM degrees, Level 3 and 4 apprenticeships, Level 6 degree apprenticeships and NCSC-certified courses as common entry points. Plenty of analysts started in IT support and moved across.

The hard part isn't the qualifications. It's experience. The government's cyber skills report found that only 16% of core cyber job postings in 2025 were open to people with under a year's experience. Most ads (64%) wanted two to six years.

So if you're starting out, focus on things you can show. A home lab where you've set up a SIEM and investigated your own test alerts. Write-ups of practice incidents. A certification such as Security+ to prove the theory. Then target junior SOC analyst, security operations analyst and IT support roles with a security slant.

Our SOC analyst guide goes through the shift-based role in more detail, and the cyber security analyst page covers progression routes.

Is it the right job for you?

You'll probably enjoy it if you like puzzles, don't mind repetition, and can stay calm when something looks bad. You'll struggle if you need constant novelty or hate writing things down.

One honest warning: the first year can feel like a lot of false alarms. That's normal. The analysts who progress are the ones who use that time to learn the environment inside out, so when a real incident lands, they spot it fast.

How Experiencely can help

The gap most new analysts hit is experience, and that's what our cyber security programme is built around. You get training plus five CompTIA certifications (A+, Network+, Security+, CySA+ and PenTest+) with exam vouchers included, alongside a live security project. You're placed within 48 hours and work about an hour a day for three months, fully remote. The programme costs £2,495. If you're not hired within 60 days of finishing, you get your money back, with conditions. It gives you real work to talk about when an interviewer asks what you've done.

Frequently asked questions

Sources

Figures are taken from the sources below. Salary ranges are indicative and individual offers vary. Last checked 9 November 2026.

1. Prospects: Cyber security analyst job profile
2. IT Jobs Watch: SOC Analyst jobs, UK
3. DSIT: Cyber security skills in the UK labour market 2026