An information, cybersecurity, or security analyst has various definitions. The core of the role and function is analyzing alerts, notifications, and related data as a front-line defender to identify indicators of compromise. They monitor for compromise and possible breaches and initiate incident response. This is the traditional cybersecurity operations center or fusion center view. This can potentially make up the bulk of the roles and functions.

Cybersecurity analysts are not always tied to roles and functions within the cybersecurity operations center. They often leverage their critical thinking and logical reasoning skills to vulnerability, risk, operations, and control self-assessments to analyze programs and conduct gap and maturity analyses. Business, privacy, and data protection impact analysis is another area for cybersecurity analyst work efforts.

A security analyst can also monitor physical security events. In this case, the role and function will fall under physical security and potentially be part of an entirely different team. This is why using terms interchangeably can be problematic, especially if they are tied to loss prevention and are part of a security guard role.

Cybersecurity specialties, such as hunt team analysts, threat intelligence analysts, and forensic analysts, fall under cybersecurity analyst roles and functions.

Cybersecurity analyst types are divided into government, corporate, commercial, and product to differentiate core differences between those that consult and integrate with cybersecurity engineers that develop cybersecurity tools and technologies.

One of the critical elements of standardization around competencies and tasks is developing consistent job descriptions and titles. Currently, the variation and variety of job descriptions and titles in the cybersecurity analyst space are immense and inconsistent or not standardized. In addition, there are many odd variations, a lack of understanding of the roles and functions, a misunderstanding of necessary or needed skill sets, or a general misunderstanding of the differences between administrators, analysts, and engineers. Subsequently, this leads to confusion about what the role should be doing or encompass from a skill set perspective.

The skills, competencies, and tasks are presented in a manner that hiring managers can pull from to develop a consistent set of job descriptions. The premise presented here will help reduce job descriptions and title variations while producing more targeted and appropriate roles and functions within a cybersecurity program. As a result, companies across industry sectors can standardize their job descriptions, position titles, and position levels. Likewise, hiring managers can develop a skillset and competency view across their teams to define empirically where they have actual skillset shortages or deficiencies.

Cybersecurity analyst roles encompass a diverse range of certifications. Some might be relevant to blue teaming, open source intelligence, or even data science. This is an attempt to document certifications that are more relevant and related to cybersecurity analysts than the typically noted ones within job descriptions. People may have acquired other certifications throughout their careers, some of which are related to being a cybersecurity analyst.

Getting certifications is a personal choice. It is generally up to the individual to decide whether they want to put the time, effort, and money into achieving them. Some hiring managers want to see them, while others do not. Additionally, please note that the mileage may vary depending on the quality of learning outcomes associated with certifications.