{"id":3699,"date":"2026-10-29T10:26:11","date_gmt":"2026-10-29T07:26:11","guid":{"rendered":"https:\/\/niteducation.com\/resources\/?p=3699"},"modified":"2026-10-29T10:26:58","modified_gmt":"2026-10-29T07:26:58","slug":"what-does-a-cybersecurity-analyst-do-every-day","status":"publish","type":"post","link":"https:\/\/niteducation.com\/resources\/what-does-a-cybersecurity-analyst-do-every-day\/","title":{"rendered":"What Does a Cybersecurity Analyst Do Every Day? Real Tasks Explained"},"content":{"rendered":"\n<!--\nNewton Institute of Technology \u2014 Article 207\nMaster Stylesheet v6.3 Premium production build \u2014 28 October 2026\nWordPress supplies the page's only semantic H1; the article hero uses .nit-hero__title.\nLoad the locked nit-articles-master-v6.3.css once at site level.\nNo article-specific CSS, inline styles, scripts, Base64 images or new component classes are used in this body.\nCanonical production URL: https:\/\/niteducation.com\/resources\/what-does-a-cybersecurity-analyst-do-every-day\/\nPrimary search intent: show a beginner what cybersecurity analyst work actually looks like during the working day, especially how an analyst moves from an event or alert to evidence, a decision, response, documentation and improvement.\nCannibalization boundary: Cybersecurity Career in Kenya owns career families, market demand, salary and employer expectations; Entry-Level Cybersecurity owns first-role selection; Analyst vs Ethical Hacker owns role comparison; Cybersecurity Course owns curriculum and admissions. Article 207 owns day-to-day analyst work, investigative reasoning and the alert-to-closure lifecycle.\n-->\n\n<article aria-labelledby=\"nit-article-title\" class=\"nit-article nit-article--cyber nit-article--pathway-guide nit-article--c-plus-degree\" itemscope=\"\" itemtype=\"https:\/\/schema.org\/Article\">\n<meta content=\"2026-10-28\" itemprop=\"datePublished\"\/>\n<meta content=\"2026-10-28\" itemprop=\"dateModified\"\/>\n<meta content=\"en-KE\" itemprop=\"inLanguage\"\/>\n<meta content=\"Newton Institute of Technology Editorial Team\" itemprop=\"author\"\/>\n<div aria-labelledby=\"nit-article-title\" class=\"nit-pg-hero\">\n<div>\n<p class=\"nit-pg-kicker\">Analyst Workday <span>Article 207 \u00b7 practical workflow<\/span><\/p>\n<p class=\"nit-hero__title\" id=\"nit-article-title\" itemprop=\"headline\">What Does a Cybersecurity Analyst<br\/>Actually Do Every Day?<\/p>\n<p class=\"nit-pg-hero__line\">event <i>\u2192<\/i> alert <i>\u2192<\/i> evidence <i>\u2192<\/i> decision <i>\u2192<\/i> action<\/p>\n<p class=\"nit-pg-hero__summary\" itemprop=\"description\">Follow the real work behind security alerts: how analysts prioritise, investigate, decide, respond, document and improve protection\u2014using practical beginner-friendly examples.<\/p>\n<div class=\"nit-pg-hero__actions\">\n<a class=\"nit-pg-button nit-pg-button--gold\" href=\"#alert-to-closure\">Follow an investigation<\/a>\n<a class=\"nit-pg-button nit-pg-button--outline\" href=\"#examples\">See practical examples<\/a>\n<\/div>\n<\/div>\n<div aria-label=\"Cybersecurity analyst investigation workflow\" class=\"nit-deg-hero__art\">\n<p>The alert is only the beginning.<\/p>\n<div aria-hidden=\"true\" class=\"nit-deg-orbit\">\n<strong><small><small>SEC<\/small><\/small><\/strong>\n<span class=\"nit-deg-orbit__chip nit-deg-orbit__chip--tech\">ALERT<\/span>\n<span class=\"nit-deg-orbit__chip nit-deg-orbit__chip--health\">LOGS<\/span>\n<span class=\"nit-deg-orbit__chip nit-deg-orbit__chip--business\">TRIAGE<\/span>\n<span class=\"nit-deg-orbit__chip nit-deg-orbit__chip--stem\">ACT<\/span>\n<\/div>\n<div class=\"nit-deg-hero__note\">\n<span>Analyst mindset<\/span>\n<strong>Evidence before conclusion<\/strong>\n<small>Find out what happened, what it affects and what should happen next.<\/small>\n<\/div>\n<\/div>\n<div aria-label=\"Article summary\" class=\"nit-pg-hero__meta\">\n<p><span>Primary intent<\/span>Daily analyst work<\/p>\n<p><span>Core workflow<\/span>Alert \u2192 closure<\/p>\n<p><span>Practical cases<\/span>Login \u00b7 phishing \u00b7 vulnerability<\/p>\n<p><span>Last reviewed<\/span>28 October 2026<\/p>\n<\/div>\n<\/div>\n<div class=\"nit-article__body\" itemprop=\"articleBody\">\n<section aria-labelledby=\"quick-answer-title\" class=\"nit-quick-answer\" id=\"quick-answer\">\n<div class=\"nit-quick-answer__head\">\n<span aria-hidden=\"true\" class=\"nit-quick-answer__mark\">A<\/span>\n<div>\n<p class=\"nit-quick-answer__label\">Quick answer<\/p>\n<p class=\"nit-quick-answer__kicker\" id=\"quick-answer-title\">What does a cybersecurity analyst actually do every day?<\/p>\n<\/div>\n<\/div>\n<div class=\"nit-quick-answer__body\">\n<p class=\"nit-quick-answer__text\"><strong>A cybersecurity analyst spends much of the day turning security information into sensible action.<\/strong> Depending on the role, that can mean reviewing alerts, prioritising suspicious activity, investigating logins or emails, checking vulnerabilities, coordinating a response, documenting findings and improving controls. NIST also separates cybersecurity work roles from job titles, so two people called \u201cCybersecurity Analyst\u201d may have different daily responsibilities. <a href=\"#source-1\">[1]<\/a> <a href=\"#source-2\">[2]<\/a><\/p>\n<ul aria-label=\"Core analyst work\" class=\"nit-quick-answer__signals\">\n<li>Monitor<\/li>\n<li>Prioritise<\/li>\n<li>Investigate<\/li>\n<li>Respond<\/li>\n<li>Document<\/li>\n<\/ul>\n<\/div>\n<\/section>\n<nav aria-labelledby=\"contents-title\" class=\"nit-toc\">\n<h2 id=\"contents-title\">In this practical workday guide<\/h2>\n<ol>\n<li><a href=\"#event-alert-incident\">Event, alert and incident<\/a><\/li>\n<li><a href=\"#different-days\">Why analyst workdays differ<\/a><\/li>\n<li><a href=\"#workday\">A realistic workday<\/a><\/li>\n<li><a href=\"#alert-to-closure\">The alert-to-closure workflow<\/a><\/li>\n<li><a href=\"#triage\">How analysts prioritise alerts<\/a><\/li>\n<li><a href=\"#examples\">Three practical investigations<\/a><\/li>\n<li><a href=\"#incident-day\">What changes during a real incident<\/a><\/li>\n<li><a href=\"#tools\">Tools and evidence<\/a><\/li>\n<li><a href=\"#kenya\">What the work looks like in Kenya<\/a><\/li>\n<li><a href=\"#student-method\">A six-question method for learners<\/a><\/li>\n<li><a href=\"#faq\">Frequently asked questions<\/a><\/li>\n<li><a href=\"#register\">Cybersecurity training at NIT<\/a><\/li>\n<\/ol>\n<\/nav>\n<section class=\"nit-section-panel\" id=\"event-alert-incident\">\n<h2>Before the workday: event, alert and incident are not the same thing<\/h2>\n<p>Beginners often use these words as if they mean the same thing. The distinction explains why analysts spend so much time investigating instead of reacting immediately.<\/p>\n<div class=\"nit-module-grid\"><article class=\"nit-module-card\"><div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">01<\/span><h3>Event: Something observable happened<\/h3><\/div><p>A user signed in, a file was downloaded, a firewall blocked a connection or a password changed. NIST defines an event broadly as an observable occurrence involving computing assets. <a href=\"#source-3\">[3]<\/a><\/p><p class=\"nit-module-card__outcome\">Observable activity<\/p><\/article><article class=\"nit-module-card\"><div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">02<\/span><h3>Alert: A security tool says \u201clook here\u201d<\/h3><\/div><p>A rule or detection system identifies behaviour that may deserve attention. An alert is a starting signal; the analyst still needs context and evidence.<\/p><p class=\"nit-module-card__outcome\">Needs attention<\/p><\/article><article class=\"nit-module-card\"><div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">03<\/span><h3>Incident: The evidence justifies response<\/h3><\/div><p>A cybersecurity incident is more serious than an ordinary event: it involves actual or imminent harm to systems or information, or a violation of security requirements. <a href=\"#source-4\">[4]<\/a><\/p><p class=\"nit-module-card__outcome\">Requires response<\/p><\/article><\/div>\n<div class=\"nit-callout nit-callout--info\">\n<p class=\"nit-callout__title\">The beginner rule to remember<\/p>\n<p><strong>Event \u2260 alert \u2260 confirmed incident.<\/strong> Much of analyst work happens between those stages: gathering enough evidence to decide what an alert really means.<\/p>\n<\/div>\n<\/section>\n<section id=\"different-days\">\n<h2>There is no single \u201ccybersecurity analyst day\u201d<\/h2>\n<p>A job title is only a label. NIST&#8217;s NICE Framework uses work roles, tasks, knowledge and skills to describe cybersecurity work more precisely, and the current NICE Framework Components were updated to v2.2.0 in April 2026. <a href=\"#source-1\">[1]<\/a> <a href=\"#source-2\">[2]<\/a><\/p>\n<div class=\"nit-module-grid\">\n<article class=\"nit-module-card\">\n<div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">01<\/span><h3>Security operations-heavy<\/h3><\/div>\n<p>Alerts, SIEM, endpoint detections, logs, phishing, triage, incident escalation and shift handovers can dominate the day.<\/p>\n<p class=\"nit-module-card__outcome\">Main rhythm: monitor \u2192 investigate \u2192 escalate.<\/p>\n<\/article>\n<article class=\"nit-module-card\">\n<div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">02<\/span><h3>General internal-security analyst<\/h3><\/div>\n<p>The day may mix monitoring with vulnerabilities, access reviews, security projects, user questions, meetings and reporting.<\/p>\n<p class=\"nit-module-card__outcome\">Main rhythm: protect \u2192 review \u2192 coordinate.<\/p>\n<\/article>\n<article class=\"nit-module-card\">\n<div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">03<\/span><h3>Vulnerability or assurance-heavy<\/h3><\/div>\n<p>Scanning, validating weaknesses, risk assessment, remediation tracking, configuration reviews and documentation may take more time than live alert monitoring.<\/p>\n<p class=\"nit-module-card__outcome\">Main rhythm: find \u2192 assess \u2192 remediate \u2192 verify.<\/p>\n<\/article>\n<\/div>\n<div class=\"nit-callout nit-callout--success\">\n<p class=\"nit-callout__title\">How to read the rest of this guide<\/p>\n<p>The timeline below represents a <strong>monitoring-heavy analyst day<\/strong>. It teaches the investigation workflow without pretending every analyst follows the same clock.<\/p>\n<\/div>\n<\/section>\n<section class=\"nit-section-panel\" id=\"workday\">\n<h2>A realistic cybersecurity analyst workday at a glance<\/h2>\n<p>On a normal day, several activities overlap. The analyst may move between alert review, preventive security work, communication and documentation.<\/p>\n<div class=\"nit-table-wrap\">\n<table class=\"nit-table\">\n<thead><tr><th scope=\"col\">Approx. time<\/th><th scope=\"col\">Typical activity<\/th><th scope=\"col\">Main question<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>8:00 a.m.<\/td><td>Read handover and open cases<\/td><td>What happened before I arrived?<\/td><\/tr>\n<tr><td>8:30 a.m.<\/td><td>Review and prioritise alerts<\/td><td>What deserves attention first?<\/td><\/tr>\n<tr><td>9:00 a.m.<\/td><td>Investigate suspicious activity<\/td><td>What actually happened?<\/td><\/tr>\n<tr><td>10:30 a.m.<\/td><td>Investigate a reported email<\/td><td>Is anyone at risk?<\/td><\/tr>\n<tr><td>11:30 a.m.<\/td><td>Follow up vulnerabilities<\/td><td>Which weakness matters most?<\/td><\/tr>\n<tr><td>1:30 p.m.<\/td><td>Check security controls and logging<\/td><td>Are protections and visibility working?<\/td><\/tr>\n<tr><td>2:30 p.m.<\/td><td>Coordinate with IT or users<\/td><td>Who needs to act?<\/td><\/tr>\n<tr><td>3:30 p.m.<\/td><td>Improve detections or research threats<\/td><td>Can we detect this better next time?<\/td><\/tr>\n<tr><td>4:30 p.m.<\/td><td>Update cases and handover notes<\/td><td>What must be recorded or continued?<\/td><\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p class=\"nit-table-note\">A serious incident can replace this timetable immediately. Kenyan SOC roles also show that some operational teams work shifts to maintain continuous coverage. <a href=\"#source-8\">[8]<\/a> On a small screen, swipe the table sideways to see every column.<\/p>\n<\/section>\n<section id=\"alert-to-closure\">\n<h2>The core daily workflow: from security alert to closure<\/h2>\n<p>This is the part many job descriptions compress into words such as <em>monitor<\/em>, <em>investigate<\/em> and <em>respond<\/em>. In practice, the analyst has to move through a chain of decisions.<\/p>\n<ol aria-label=\"Security alert investigation workflow\" class=\"nit-process\"><li><strong>Read and scope the alert.<\/strong><br\/>Understand what triggered the detection, which account or system is involved, when it happened and what the alert actually claims.<\/li><li><strong>Gather context.<\/strong><br\/>Check relevant authentication records, endpoint activity, network logs, email information, asset details and previous alerts.<\/li><li><strong>Build a timeline and test explanations.<\/strong><br\/>Put important events in order, then compare normal activity, configuration issues, authorised administration and malicious possibilities.<\/li><li><strong>Classify and decide.<\/strong><br\/>Determine whether the evidence supports benign activity, a false positive, unresolved suspicion or a probable\/confirmed incident.<\/li><li><strong>Act, document and hand over.<\/strong><br\/>Follow the approved response process, record what was checked and decided, and make unfinished work clear to the next authorised person.<\/li><\/ol>\n<div class=\"nit-callout nit-callout--info\">\n<p class=\"nit-callout__title\">Why the timeline matters<\/p>\n<p>Imagine these events: <strong>08:56 failed login \u2192 08:58 failed login \u2192 09:07 successful login \u2192 09:11 security setting changed \u2192 09:14 unusual file access.<\/strong> One event may be ambiguous. The sequence can tell a very different story.<\/p>\n<\/div>\n<\/section>\n<section class=\"nit-section-panel\" id=\"triage\">\n<h2>How does an analyst decide which alert to investigate first?<\/h2>\n<p>The severity colour on a dashboard is useful, but it is not the whole decision. Analysts combine several pieces of context.<\/p>\n<div class=\"nit-reason-grid\">\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">01<\/span><div><h3>Did it succeed?<\/h3><p>A blocked attempt is different from successful access after repeated failures.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">02<\/span><div><h3>What is affected?<\/h3><p>A privileged identity or critical finance server can carry more impact than a low-value test machine.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">03<\/span><div><h3>How reliable is the detection?<\/h3><p>Some rules are highly specific; others intentionally cast a wider net and produce more harmless alerts.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">04<\/span><div><h3>Is there supporting evidence?<\/h3><p>An unusual login plus permission changes and unexpected downloads is more concerning than the login alone.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">05<\/span><div><h3>How large could the problem be?<\/h3><p>One affected device is different from similar behaviour appearing across many systems.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">06<\/span><div><h3>What happens if we are wrong?<\/h3><p>Analysts consider the cost of dismissing a real threat as well as the cost of disrupting legitimate activity.<\/p><\/div><\/article>\n<\/div>\n<div class=\"nit-table-wrap\">\n<table class=\"nit-table\">\n<thead><tr><th scope=\"col\">Alert<\/th><th scope=\"col\">Context<\/th><th scope=\"col\">Why priority can change<\/th><\/tr><\/thead>\n<tbody>\n<tr><td><strong>Critical<\/strong><\/td><td>Isolated test machine; action blocked before execution<\/td><td>High label, but limited exposure and no successful action<\/td><\/tr>\n<tr><td><strong>Medium<\/strong><\/td><td>Privileged account; successful login followed by unexpected permission changes<\/td><td>Lower label, but stronger business impact and supporting evidence<\/td><\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<p class=\"nit-table-note\">The point is not that \u201cmedium always beats critical.\u201d The point is that analysts interpret severity in context. On a small screen, swipe the table sideways to see every column.<\/p>\n<\/section>\n<section id=\"examples\">\n<h2>Three practical examples of what an analyst actually does<\/h2>\n<p>These examples focus on the reasoning between the alert and the final decision.<\/p>\n<section class=\"nit-section-panel\">\n<p class=\"nit-pg-eyebrow\">Practical example 1<\/p>\n<h2>Investigating a suspicious login<\/h2>\n<p>An employee normally works from Kenya. At 9:07 a.m., the security platform reports a successful sign-in associated with an unfamiliar source.<\/p>\n<ol aria-label=\"Suspicious login investigation\" class=\"nit-process\"><li><strong>Read the alert and recent authentication history.<\/strong><br\/>Identify the account, time, source, device, authentication method and events immediately before the successful login.<\/li><li><strong>Compare the device and normal behaviour.<\/strong><br\/>Has this device appeared before? Was an approved VPN involved? Is travel or another legitimate explanation possible?<\/li><li><strong>Check what happened after login.<\/strong><br\/>Look for unusual access, security-setting changes, forwarding rules, permission changes or abnormal downloads.<\/li><li><strong>Test legitimate explanations against the evidence.<\/strong><br\/>Use organisational context without treating IP-based location as proof of a person\u2019s physical location.<\/li><li><strong>Decide and act.<\/strong><br\/>Close with a documented reason, continue investigating, or escalate as a likely account compromise.<\/li><\/ol>\n<div class=\"nit-curriculum-grid\"><article class=\"nit-curriculum-card\"><span class=\"nit-curriculum-card__period\">Outcome A<\/span><h3>Benign \/ expected<\/h3><p>The employee confirms the activity and the remaining evidence fits. Record why the case was closed.<\/p><\/article><article class=\"nit-curriculum-card\"><span class=\"nit-curriculum-card__period\">Outcome B<\/span><h3>False positive<\/h3><p>The detection fired, but the underlying behaviour was legitimate. Record the cause so recurring noise can be reduced where appropriate.<\/p><\/article><article class=\"nit-curriculum-card\"><span class=\"nit-curriculum-card__period\">Outcome C<\/span><h3>Still uncertain<\/h3><p>Some evidence is unusual but not enough for a defensible conclusion. Continue or escalate rather than guessing.<\/p><\/article><article class=\"nit-curriculum-card\"><span class=\"nit-curriculum-card__period\">Outcome D<\/span><h3>Likely compromise<\/h3><p>Several signals support unauthorised access. Follow the organisation\u2019s incident-response process.<\/p><\/article><\/div>\n<div class=\"nit-callout nit-callout--success\"><p class=\"nit-callout__title\">The analyst skill<\/p><p>The useful skill is not recognising the phrase <strong>\u201cunusual login.\u201d<\/strong> It is knowing what evidence to check next and how strongly that evidence supports the conclusion.<\/p><\/div>\n<\/section>\n<section class=\"nit-section-panel\">\n<p class=\"nit-pg-eyebrow\">Practical example 2<\/p>\n<h2>Investigating a suspicious payment email<\/h2>\n<p>An accounts employee receives an urgent message claiming that a supplier has changed banking details. The displayed sender name looks familiar, but the employee reports the message before paying.<\/p>\n<ol aria-label=\"Suspicious email investigation\" class=\"nit-process\"><li><strong>Establish what was received.<\/strong><br\/>Who received the email, when, what did it request, and did it contain a link or attachment?<\/li><li><strong>Inspect authorised email evidence.<\/strong><br\/>Check the actual sending information and other available security details instead of trusting the displayed sender name.<\/li><li><strong>Check interaction and scope.<\/strong><br\/>Did anyone click, open a file, enter credentials, send information or approve a payment\u2014and how many people received the message?<\/li><li><strong>Classify the message.<\/strong><br\/>Decide whether the evidence supports legitimate mail, spam, phishing or an unresolved case.<\/li><li><strong>Expand and respond if necessary.<\/strong><br\/>If credentials or money were exposed, move the investigation into the affected account or business process and follow the approved response procedure.<\/li><\/ol>\n<div class=\"nit-callout nit-callout--warning\"><p class=\"nit-callout__title\">Why this case grows<\/p><p>A case can cross systems. The original question may be <strong>\u201cIs this email malicious?\u201d<\/strong> but after a user enters credentials the question becomes <strong>\u201cHas this account been compromised?\u201d<\/strong><\/p><\/div>\n<\/section>\n<section class=\"nit-section-panel\">\n<p class=\"nit-pg-eyebrow\">Practical example 3<\/p>\n<h2>Following up a vulnerability on an important server<\/h2>\n<p>O*NET lists assessing vulnerabilities and proposing or implementing risk-mitigation strategies among Information Security Analyst work. <a href=\"#source-6\">[6]<\/a> A scanner can identify a possible weakness, but the analyst still needs context.<\/p>\n<ol aria-label=\"Vulnerability remediation workflow\" class=\"nit-process\"><li><strong>Identify the asset and business importance.<\/strong><br\/>What does the server do, how important is it and who owns it?<\/li><li><strong>Understand the weakness and evidence.<\/strong><br\/>What was detected, what could exploitation allow and how reliable is the scanner finding?<\/li><li><strong>Check exposure and priority.<\/strong><br\/>Is the vulnerable service public, internal or tightly restricted, and what would the impact be?<\/li><li><strong>Coordinate the approved correction.<\/strong><br\/>Use a vendor update, configuration change or temporary mitigation with the responsible system or application team.<\/li><li><strong>Verify and close the loop.<\/strong><br\/>Confirm that the weakness has actually been corrected or properly mitigated instead of trusting a ticket status alone.<\/li><\/ol>\n<\/section>\n<\/section>\n<section class=\"nit-section-panel\" id=\"controls\">\n<h2>Analysts also check whether the security tools themselves are working<\/h2>\n<p>Imagine a critical server normally sends security information into the monitoring platform. Today it sends nothing. No alerts appear. That is not automatically good news.<\/p>\n<ul class=\"nit-choice-list\">\n<li><strong>Logging coverage.<\/strong> Are important systems still sending useful logs?<\/li>\n<li><strong>Endpoint visibility.<\/strong> Is endpoint protection running and checking in?<\/li>\n<li><strong>Detection health.<\/strong> Are rules and thresholds still functioning as expected?<\/li>\n<li><strong>Configuration changes.<\/strong> Did a legitimate system change accidentally remove visibility?<\/li>\n<li><strong>Remediation follow-up.<\/strong> Were previously identified weaknesses actually corrected?<\/li>\n<\/ul>\n<div class=\"nit-callout nit-callout--info\"><p class=\"nit-callout__title\">No alerts does not always mean no problem<\/p><p>If the monitoring system has stopped receiving evidence, silence can mean <strong>loss of visibility<\/strong>. Current Kenyan SOC responsibilities explicitly include validating log sources and improving monitoring accuracy. <a href=\"#source-8\">[8]<\/a><\/p><\/div>\n<\/section>\n<section id=\"difficult\">\n<h2>What makes a real security investigation difficult?<\/h2>\n<p>Training exercises usually give the learner enough information to reach an answer. Real environments can be much messier.<\/p>\n<div class=\"nit-reason-grid\">\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">01<\/span><div><h3>Missing evidence<\/h3><p>The system may not have logged the exact event the analyst wanted to see.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">02<\/span><div><h3>Too much evidence<\/h3><p>A busy platform can generate thousands of irrelevant events around the few that matter.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">03<\/span><div><h3>Time differences<\/h3><p>Systems may record timestamps in different zones or formats, complicating the timeline.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">04<\/span><div><h3>Shared infrastructure<\/h3><p>VPNs, proxies, mobile networks and shared services can make location or source information less obvious.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">05<\/span><div><h3>Legitimate activity looks suspicious<\/h3><p>Administrators and automated systems can perform powerful actions that resemble attacker behaviour.<\/p><\/div><\/article>\n<article class=\"nit-reason-card\"><span class=\"nit-reason-card__number\">06<\/span><div><h3>Uncertainty remains<\/h3><p>A professional analyst sometimes has to document that the available evidence does not prove exactly what happened.<\/p><\/div><\/article>\n<\/div>\n<\/section>\n<section class=\"nit-section-panel\" id=\"escalation\">\n<h2>When does an analyst escalate a case?<\/h2>\n<p>The exact escalation rule belongs to the employer&#8217;s procedures, but several signals can raise the need for urgent or specialist help.<\/p>\n<div class=\"nit-table-wrap\">\n<table class=\"nit-table\">\n<thead><tr><th scope=\"col\">Signal<\/th><th scope=\"col\">Why it matters<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>Privileged or administrator account<\/td><td>Potential access and impact are greater.<\/td><\/tr>\n<tr><td>Critical business system<\/td><td>Operational consequences can be serious.<\/td><\/tr>\n<tr><td>Confirmed credential theft<\/td><td>Unauthorised access becomes plausible.<\/td><\/tr>\n<tr><td>Multiple affected devices<\/td><td>The problem may be spreading.<\/td><\/tr>\n<tr><td>Unexpected access to sensitive information<\/td><td>Confidentiality impact may exist.<\/td><\/tr>\n<tr><td>Activity outside the analyst&#8217;s authority or expertise<\/td><td>A specialist or higher-level responder is needed.<\/td><\/tr>\n<tr><td>Serious consequence but incomplete evidence<\/td><td>Escalation is safer than dismissing the case without support.<\/td><\/tr>\n<\/tbody>\n<\/table>\n<\/div><p class=\"nit-table-note\">On a small screen, swipe the table sideways to see every column.<\/p>\n<div class=\"nit-callout nit-callout--success\"><p class=\"nit-callout__title\">Escalation is part of the job<\/p><p>Knowing when another person or team should take over is professional judgement\u2014not failure.<\/p><\/div>\n<\/section>\n<section id=\"people\">\n<h2>Cybersecurity analysts work with people, not just dashboards<\/h2>\n<p>O*NET&#8217;s updated 2026 Information Security Analysts profile includes communication, coordination, analysis and decision-making alongside technical security work. <a href=\"#source-6\">[6]<\/a><\/p>\n<div class=\"nit-curriculum-grid\">\n<article class=\"nit-curriculum-card\"><span class=\"nit-curriculum-card__period\">Collaboration 01<\/span><h3>IT support<\/h3><p>\u201cIs this device still assigned to this employee, and was any approved change made?\u201d<\/p><p class=\"\">Context for users and endpoints.<\/p><\/article>\n<article class=\"nit-curriculum-card\"><span class=\"nit-curriculum-card__period\">Collaboration 02<\/span><h3>Identity team<\/h3><p>\u201cCan this account be secured, and can we review recent authentication changes?\u201d<\/p><p class=\"\">Accounts, authentication and permissions.<\/p><\/article>\n<article class=\"nit-curriculum-card\"><span class=\"nit-curriculum-card__period\">Collaboration 03<\/span><h3>Systems \/ network team<\/h3><p>\u201cCan this vulnerable service be corrected, or does this traffic have an approved explanation?\u201d<\/p><p class=\"\">Remediation and technical context.<\/p><\/article>\n<article class=\"nit-curriculum-card\"><span class=\"nit-curriculum-card__period\">Collaboration 04<\/span><h3>Managers and risk teams<\/h3><p>\u201cWhat happened, how certain are we, what is the impact and what action is needed?\u201d<\/p><p class=\"\">Decision-ready explanation.<\/p><\/article>\n<\/div>\n<\/section>\n<section class=\"nit-section-panel\" id=\"improve\">\n<h2>Good analysts improve tomorrow&#8217;s detection instead of only closing today&#8217;s alert<\/h2>\n<p>Suppose an approved backup repeatedly triggers the same false-positive alert. Closing it manually every morning is not a good long-term solution. The team may need to tune the detection so normal activity is recognised without hiding genuine risk.<\/p>\n<p>The opposite can also happen: an investigation may reveal behaviour that existing controls did not detect clearly enough.<\/p>\n<ul class=\"nit-choice-list\">\n<li><strong>Change a rule.<\/strong> Improve detection logic or thresholds.<\/li>\n<li><strong>Add a log source.<\/strong> Bring missing evidence into the monitoring system.<\/li>\n<li><strong>Improve a playbook.<\/strong> Make the next investigation faster and more consistent.<\/li>\n<li><strong>Change a control.<\/strong> Reduce the chance of the same weakness recurring.<\/li>\n<li><strong>Document the lesson.<\/strong> Make useful knowledge available to the next analyst.<\/li>\n<\/ul>\n<p>Current Kenyan SOC responsibilities explicitly include rule tuning, log-source validation, false-positive reduction and process improvement. <a href=\"#source-8\">[8]<\/a><\/p>\n<\/section>\n<section id=\"outputs\">\n<h2>What does the analyst produce at the end of an investigation?<\/h2>\n<p>The outcome is not merely \u201csafe\u201d or \u201cunsafe.\u201d The investigation should leave something another authorised person can use.<\/p>\n<div class=\"nit-table-wrap\">\n<table class=\"nit-table\">\n<thead><tr><th scope=\"col\">Output<\/th><th scope=\"col\">Purpose<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>Investigation ticket<\/td><td>Records what was checked, what was found and what was decided.<\/td><\/tr>\n<tr><td>Timeline<\/td><td>Shows the order of relevant events.<\/td><\/tr>\n<tr><td>Escalation note<\/td><td>Gives another analyst enough context to continue.<\/td><\/tr>\n<tr><td>Remediation request<\/td><td>Tells the responsible team what needs correction.<\/td><\/tr>\n<tr><td>Incident update<\/td><td>Explains current status during a serious case.<\/td><\/tr>\n<tr><td>Handover note<\/td><td>Prevents unfinished work from disappearing between shifts.<\/td><\/tr>\n<tr><td>Detection improvement<\/td><td>Reduces future noise or improves visibility.<\/td><\/tr>\n<tr><td>Final report<\/td><td>Records findings, response and lessons.<\/td><\/tr>\n<\/tbody>\n<\/table>\n<\/div><p class=\"nit-table-note\">On a small screen, swipe the table sideways to see every column.<\/p>\n<\/section>\n<section class=\"nit-section-panel\" id=\"incident-day\">\n<h2>What changes when an ordinary day becomes a real incident?<\/h2>\n<p>At 2:17 p.m., an endpoint-security system reports suspicious activity. The analyst investigates. Similar activity then appears on several other machines. The normal timetable stops.<\/p>\n<ol aria-label=\"Incident response progression\" class=\"nit-process\"><li><strong>Detect and validate.<\/strong><br\/>Confirm whether the signal represents a genuine security problem rather than treating the first alert as proof.<\/li><li><strong>Determine scope and escalate.<\/strong><br\/>Identify affected accounts, devices, applications or data and bring in the appropriate responders and decision-makers.<\/li><li><strong>Contain.<\/strong><br\/>Follow approved procedures to limit further impact while preserving useful evidence.<\/li><li><strong>Correct and recover.<\/strong><br\/>Remove the cause or weakness with the responsible technical teams, then restore normal operation safely.<\/li><li><strong>Verify and learn.<\/strong><br\/>Check that the problem is no longer active, document the incident and improve controls or procedures.<\/li><\/ol>\n<p>NIST SP 800-61 Rev. 3, published in April 2025, integrates incident-response recommendations with wider cybersecurity risk management rather than treating response as an isolated activity. <a href=\"#source-5\">[5]<\/a><\/p>\n<div class=\"nit-table-wrap\">\n<table class=\"nit-table\">\n<thead><tr><th scope=\"col\">Normal analyst day<\/th><th scope=\"col\">Serious incident day<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>Review several alerts<\/td><td>Focus moves to the incident<\/td><\/tr>\n<tr><td>Follow up vulnerabilities<\/td><td>Determine affected scope<\/td><\/tr>\n<tr><td>Check security controls<\/td><td>Gather and preserve useful evidence<\/td><\/tr>\n<tr><td>Attend routine meetings<\/td><td>Coordinate urgent actions<\/td><\/tr>\n<tr><td>Improve detections<\/td><td>Support containment and recovery<\/td><\/tr>\n<tr><td>Update ordinary tickets<\/td><td>Maintain an incident timeline<\/td><\/tr>\n<tr><td>Prepare handover<\/td><td>Keep authorised stakeholders informed<\/td><\/tr>\n<\/tbody>\n<\/table>\n<\/div><p class=\"nit-table-note\">On a small screen, swipe the table sideways to see every column.<\/p>\n<\/section>\n<section id=\"tools\">\n<h2>What tools does a cybersecurity analyst use?<\/h2>\n<p>Do not begin by memorising brand names. Start with the question each tool helps the analyst answer.<\/p>\n<div class=\"nit-table-wrap\">\n<table class=\"nit-table\">\n<thead><tr><th scope=\"col\">Tool category<\/th><th scope=\"col\">Question it helps answer<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>SIEM<\/td><td>What security activity is occurring across different systems?<\/td><\/tr>\n<tr><td>EDR \/ endpoint detection<\/td><td>What is happening on this computer or server?<\/td><\/tr>\n<tr><td>Identity and authentication logs<\/td><td>Who authenticated, when and how?<\/td><\/tr>\n<tr><td>Network monitoring<\/td><td>Which systems communicated, and was it expected?<\/td><\/tr>\n<tr><td>Vulnerability scanner<\/td><td>Which known weaknesses need attention?<\/td><\/tr>\n<tr><td>Email-security tools<\/td><td>What happened to this message and who received it?<\/td><\/tr>\n<tr><td>Threat-information sources<\/td><td>Is this indicator already associated with suspicious activity?<\/td><\/tr>\n<tr><td>Ticket \/ case system<\/td><td>What was investigated, decided and handed over?<\/td><\/tr>\n<\/tbody>\n<\/table>\n<\/div><p class=\"nit-table-note\">On a small screen, swipe the table sideways to see every column.<\/p>\n<div class=\"nit-callout nit-callout--info\"><p class=\"nit-callout__title\">AI and automation in 2026<\/p><p>Modern security platforms can correlate alerts, enrich investigations and automate parts of response. Current Microsoft Sentinel documentation describes AI-assisted detection, investigation and response capabilities. <a href=\"#source-9\">[9]<\/a> Automation can reduce repetitive work, but the analyst still has to judge whether the evidence, context and proposed action make sense.<\/p><\/div>\n<\/section>\n<section class=\"nit-section-panel\" id=\"kenya\">\n<h2>What does cybersecurity analyst work look like in Kenya?<\/h2>\n<p>Kenya&#8217;s 2026 Ministry cybersecurity opportunity lists include analyst and SOC-related roles requiring combinations of SIEM, incident response, vulnerability management, network security, threat detection and security operations. <a href=\"#source-7\">[7]<\/a><\/p>\n<div class=\"nit-module-grid\">\n<article class=\"nit-module-card\"><div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">01<\/span><h3>Monitor: Security events and alerts<\/h3><\/div><p>Kenyan operational roles include continuous monitoring, SIEM analysis, threat validation and incident triage. <a href=\"#source-8\">[8]<\/a><\/p><p class=\"nit-module-card__outcome\">Watch the evidence<\/p><\/article>\n<article class=\"nit-module-card\"><div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">02<\/span><h3>Respond: Incidents and vulnerabilities<\/h3><\/div><p>Responsibilities can include escalation, containment coordination, remediation tracking and vulnerability follow-up. <a href=\"#source-8\">[8]<\/a><\/p><p class=\"nit-module-card__outcome\">Coordinate the response<\/p><\/article>\n<article class=\"nit-module-card\"><div class=\"nit-module-card__head\"><span class=\"nit-module-card__number\">03<\/span><h3>Improve: Detections and processes<\/h3><\/div><p>Rule tuning, log validation, threat research, reporting and process improvement also appear in current local SOC work. <a href=\"#source-8\">[8]<\/a><\/p><p class=\"nit-module-card__outcome\">Strengthen the system<\/p><\/article>\n<\/div>\n<div class=\"nit-callout nit-callout--warning\"><p class=\"nit-callout__title\">Do not turn SOC examples into a universal job description<\/p><p>A Kenyan SOC vacancy demonstrates real operational work, but not every Cybersecurity Analyst works in a bank or a 24-hour SOC. NIT&#8217;s broader <a href=\"https:\/\/niteducation.com\/resources\/cybersecurity-career-in-kenya\/\">Cybersecurity Career in Kenya guide<\/a> covers the wider role families and employer expectations. <a href=\"#source-10\">[10]<\/a><\/p><\/div>\n<\/section>\n<section id=\"soc-vs-analyst\">\n<h2>Cybersecurity Analyst vs SOC Analyst: why the daily work can differ<\/h2>\n<div class=\"nit-table-wrap\">\n<table class=\"nit-table\">\n<thead><tr><th scope=\"col\">SOC-heavy role<\/th><th scope=\"col\">Broader Cybersecurity Analyst role<\/th><\/tr><\/thead>\n<tbody>\n<tr><td>Continuous monitoring<\/td><td>May monitor, but may also spend substantial time on projects and assessments<\/td><\/tr>\n<tr><td>Alert triage<\/td><td>May combine alerts with vulnerability or control reviews<\/td><\/tr>\n<tr><td>Incident escalation<\/td><td>May combine response with risk, access or security improvement work<\/td><\/tr>\n<tr><td>Shift handovers may be common<\/td><td>Ordinary office schedules may be more common in some organisations<\/td><\/tr>\n<\/tbody>\n<\/table>\n<\/div><p class=\"nit-table-note\">On a small screen, swipe the table sideways to see every column.<\/p>\n<p>Again, the responsibilities section of a vacancy tells you more than the title alone. NIST&#8217;s work-role approach exists partly because job titles do not map neatly to one universal set of tasks. <a href=\"#source-2\">[2]<\/a><\/p>\n<\/section>\n<section class=\"nit-section-panel\" id=\"work-hours\">\n<h2>Do cybersecurity analysts work at night?<\/h2>\n<p>Some do; many do not. Security operations that require 24-hour monitoring can use shifts, while other analysts work normal office hours and may only be called outside those hours during a serious incident.<\/p>\n<p>A current Kenyan banking SOC role explicitly requires 24\/7 coverage, including extended shifts, nights, weekends and public holidays. <a href=\"#source-8\">[8]<\/a> That schedule should not be generalised to every cybersecurity analyst position.<\/p>\n<\/section>\n<section id=\"student-method\">\n<h2>A six-question investigation method a student can practise<\/h2>\n<p>When you are given a security exercise, do not start by asking which tool to run. Start with the investigation questions.<\/p>\n<ol aria-label=\"Student security investigation method\" class=\"nit-process\"><li><strong>What happened?<\/strong><br\/>Describe the observation without exaggerating it.<\/li><li><strong>Where and when did it happen?<\/strong><br\/>Identify the account, computer, application or network involved and build the timeline.<\/li><li><strong>What other evidence is connected?<\/strong><br\/>Do not judge one alert in isolation.<\/li><li><strong>What conclusion does the evidence support?<\/strong><br\/>Normal, false positive, suspicious, incident or still unknown?<\/li><li><strong>What should happen next?<\/strong><br\/>Close, monitor, investigate further, remediate or escalate?<\/li><\/ol>\n<div class=\"nit-callout nit-callout--success\"><p class=\"nit-callout__title\">The habit to build<\/p><p><strong>Evidence before conclusion.<\/strong> A careful analyst is more valuable than someone who reaches a dramatic answer quickly without enough support.<\/p><\/div>\n<\/section>\n<section class=\"nit-section-panel\" id=\"no-attack\">\n<h2>What does an analyst do when there is no attack?<\/h2>\n<ul class=\"nit-choice-list\">\n<li><strong>Review ordinary alerts.<\/strong> Most security work is not a major incident.<\/li>\n<li><strong>Follow up vulnerabilities.<\/strong> Preventive remediation continues.<\/li>\n<li><strong>Check access and security controls.<\/strong> Protection has to remain correctly configured.<\/li>\n<li><strong>Verify logging and monitoring.<\/strong> The team needs evidence before it can detect problems.<\/li>\n<li><strong>Improve detections.<\/strong> Reduce false positives and strengthen useful alerts.<\/li>\n<li><strong>Research relevant threats.<\/strong> Ask whether a new threat affects systems the organisation actually uses.<\/li>\n<li><strong>Document and coordinate.<\/strong> Security projects and remediation do not stop because the alert queue is quiet.<\/li>\n<\/ul>\n<\/section>\n<section id=\"faq\">\n<h2>Frequently asked questions<\/h2>\n<div class=\"nit-faq\">\n<details class=\"nit-faq__item\"><summary>What does a cybersecurity analyst actually do every day?<\/summary><div class=\"nit-faq__answer\"><p>The daily work commonly includes monitoring security information, prioritising suspicious activity, investigating alerts, reviewing vulnerabilities, coordinating responses, documenting findings and improving security controls. The exact balance varies by employer and role.<\/p><\/div><\/details>\n<details class=\"nit-faq__item\"><summary>Is a security alert already an incident?<\/summary><div class=\"nit-faq__answer\"><p>No. An alert tells the analyst that something deserves attention. Investigation may determine that the activity is harmless, a false positive, still uncertain or a real security incident. <a href=\"#source-3\">[3]<\/a> <a href=\"#source-4\">[4]<\/a><\/p><\/div><\/details>\n<details class=\"nit-faq__item\"><summary>What does a cybersecurity analyst do when nothing serious is happening?<\/summary><div class=\"nit-faq__answer\"><p>Analysts can work on vulnerabilities, access reviews, logging, documentation, detection improvements, threat research, security projects and remediation follow-up.<\/p><\/div><\/details>\n<details class=\"nit-faq__item\"><summary>Does every cybersecurity analyst work in a SOC?<\/summary><div class=\"nit-faq__answer\"><p>No. SOC work is heavily focused on monitoring, triage and incident response, while broader analyst roles can also include vulnerabilities, controls, risk, assessments and projects. NIST explicitly separates work roles from job titles. <a href=\"#source-2\">[2]<\/a><\/p><\/div><\/details>\n<details class=\"nit-faq__item\"><summary>Do cybersecurity analysts spend all day hacking?<\/summary><div class=\"nit-faq__answer\"><p>No. Many analysts spend far more time reading logs, investigating alerts, checking vulnerabilities, coordinating remediation and writing reports. Authorised security testing is only one part of the wider field.<\/p><\/div><\/details>\n<details class=\"nit-faq__item\"><summary>Do cybersecurity analysts work at night?<\/summary><div class=\"nit-faq__answer\"><p>Some do, particularly in 24-hour security operations. Other analysts work ordinary daytime schedules. A current Kenyan banking SOC role, for example, requires around-the-clock shift coverage. <a href=\"#source-8\">[8]<\/a><\/p><\/div><\/details>\n<details class=\"nit-faq__item\"><summary>Does a cybersecurity analyst need to code every day?<\/summary><div class=\"nit-faq__answer\"><p>Not necessarily. Some roles use scripts or query languages regularly, while others use little programming. Analyst work more broadly depends on understanding systems, networks, identity, logs, evidence and security procedures.<\/p><\/div><\/details>\n<\/div>\n<\/section>\n<section aria-labelledby=\"references-title\" class=\"nit-sources\" id=\"references\">\n<h2 id=\"references-title\">Sources and references<\/h2>\n<ol>\n<li id=\"source-1\"><strong>National Institute of Standards and Technology (NIST).<\/strong> <cite>NICE Releases NICE Framework Components v2.2.0.<\/cite> Published 28 April 2026. Used to verify the current NICE Framework Components version and its standard approach to describing cybersecurity work and capabilities. Accessed 28 October 2026. <a href=\"https:\/\/www.nist.gov\/news-events\/news\/2026\/04\/nice-releases-nice-framework-components-v220\" rel=\"noopener\" target=\"_blank\">nist.gov<\/a>.<\/li>\n<li id=\"source-2\"><strong>National Institute of Standards and Technology (NIST).<\/strong> <cite>Occupations, Jobs, and Work.<\/cite> NICE Framework Resource Center. Used for the distinction between jobs\/job titles and cybersecurity work roles. Accessed 28 October 2026. <a href=\"https:\/\/www.nist.gov\/itl\/applied-cybersecurity\/nice\/nice-framework-resource-center\/resources\/occupations-jobs-and-work\" rel=\"noopener\" target=\"_blank\">nist.gov<\/a>.<\/li>\n<li id=\"source-3\"><strong>NIST Computer Security Resource Center.<\/strong> <cite>Event \u2014 Glossary.<\/cite> Used for the definition of an observable event involving computing assets. Accessed 28 October 2026. <a href=\"https:\/\/csrc.nist.gov\/glossary\/term\/event\" rel=\"noopener\" target=\"_blank\">csrc.nist.gov<\/a>.<\/li>\n<li id=\"source-4\"><strong>NIST Computer Security Resource Center.<\/strong> <cite>Cybersecurity Incident \u2014 Glossary.<\/cite> Used to distinguish a cybersecurity incident from an ordinary observable event. Accessed 28 October 2026. <a href=\"https:\/\/csrc.nist.gov\/glossary\/term\/cybersecurity_incident\" rel=\"noopener\" target=\"_blank\">csrc.nist.gov<\/a>.<\/li>\n<li id=\"source-5\"><strong>National Institute of Standards and Technology (NIST).<\/strong> <cite>SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management.<\/cite> Published April 2025. Used for the incident-response and risk-management framework. <a href=\"https:\/\/csrc.nist.gov\/pubs\/sp\/800\/61\/r3\/final\" rel=\"noopener\" target=\"_blank\">csrc.nist.gov<\/a>.<\/li>\n<li id=\"source-6\"><strong>O*NET OnLine.<\/strong> <cite>Information Security Analysts (15-1212.00).<\/cite> Bright Outlook occupation profile updated 2026. Used for occupational tasks involving monitoring security measures, assessing vulnerabilities, analysis, decision-making, communication and documentation. Accessed 28 October 2026. <a href=\"https:\/\/www.onetonline.org\/link\/summary\/15-1212.00\" rel=\"noopener\" target=\"_blank\">onetonline.org<\/a>.<\/li>\n<li id=\"source-7\"><strong>Ministry of Information, Communications and the Digital Economy (Kenya), Directorate of ICT Security and Audit Control.<\/strong> <cite>Cybersecurity and System Audit Job Opportunities 2026.<\/cite> Used for current Kenyan role evidence covering analyst, SOC, SIEM, incident response, vulnerability management, network security and threat-detection skills. Published 2026; accessed 28 October 2026. <a href=\"https:\/\/ict.go.ke\/sites\/default\/files\/2026-03\/CYBERSECURITY%20AND%20SYSTEM%20AUDIT%20JOB%20OPPORTUNITIES%20-%202026.pdf\" rel=\"noopener\" target=\"_blank\">ict.go.ke<\/a>.<\/li>\n<li id=\"source-8\"><strong>Sidian Bank.<\/strong> <cite>Security Operations Centre Analyst (SOC Analyst).<\/cite> Used as current Kenyan workplace evidence for continuous monitoring, triage, escalation, threat hunting, rule tuning, log-source validation, reporting, remediation and shift handover. Accessed 28 October 2026. <a href=\"https:\/\/sidianbank.co.ke\/vacancy\/security-operations-centre-analyst-soc-analyst\/\" rel=\"noopener\" target=\"_blank\">sidianbank.co.ke<\/a>.<\/li>\n<li id=\"source-9\"><strong>Microsoft Learn.<\/strong> <cite>Microsoft Sentinel overview.<\/cite> Used for current descriptions of cloud-native SIEM, correlation, automation and AI-assisted security operations. Accessed 28 October 2026. <a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/sentinel-overview\" rel=\"noopener\" target=\"_blank\">learn.microsoft.com<\/a>.<\/li>\n<li id=\"source-10\"><strong>Newton Institute of Technology.<\/strong> <cite>Cybersecurity Career in Kenya: Jobs &amp; Skills Employers Need.<\/cite> Supporting internal resource for broader cybersecurity career families, vacancy evidence and employer expectations. Accessed 28 October 2026. <a href=\"https:\/\/niteducation.com\/resources\/cybersecurity-career-in-kenya\/\">niteducation.com<\/a>.<\/li>\n<li id=\"source-11\"><strong>Newton Institute of Technology.<\/strong> <cite>Cybersecurity Course in Kenya: 6 Months + 3-Month Attachment.<\/cite> Used for current NIT programme structure, training areas and fee information. Accessed 28 October 2026. <a href=\"https:\/\/niteducation.com\/resources\/cybersecurity-course-in-kenya\/\">niteducation.com<\/a>.<\/li>\n<\/ol>\n<\/section>\n<section aria-labelledby=\"register-title\" class=\"nit-pg-enrol\" id=\"register\">\n<div class=\"nit-pg-enrol__copy\">\n<p class=\"nit-pg-eyebrow\">Learn the workflow, not just the terminology<\/p>\n<h2 id=\"register-title\">Register for Cybersecurity Training at Newton Institute of Technology<\/h2>\n<p>NIT&#8217;s Cybersecurity programme builds practical foundations in computer systems, networking, Linux, authorised security testing, monitoring, incident response and technical reporting. The current programme includes six months of institutional training followed by a compulsory three-month industrial attachment. <\/p>\n<\/div>\n<div aria-label=\"Cybersecurity course details\" class=\"nit-pg-enrol__details\">\n<p><span>Institutional training<\/span><strong>6 months \u00b7 <a href=\"#source-11\">[11]<\/a><\/strong><\/p>\n<p><span>Industrial attachment<\/span><strong>Compulsory 3 months \u00b7 <a href=\"#source-11\">[11]<\/a><\/strong><\/p>\n<p><span>Institutional fee<\/span><strong>KSh 60,000 \u00b7 <a href=\"#source-11\">[11]<\/a><\/strong><\/p>\n<\/div>\n<div class=\"nit-pg-enrol__actions\">\n<a class=\"nit-pg-button nit-pg-button--gold\" href=\"https:\/\/niteducation.com\/admissions\/\">Register \/ admissions<\/a>\n<a class=\"nit-pg-button nit-pg-button--outline\" href=\"https:\/\/wa.me\/254713584858?text=Hello%20Newton%20Institute%20of%20Technology.%20I%20would%20like%20to%20register%20for%20the%20Cybersecurity%20Course.\" target=\"_blank\" rel=\"noopener\">WhatsApp +254 713 584 858<\/a>\n<\/div>\n<\/section>\n<\/div>\n<div class=\"nit-article__footer\">\n<p><strong>Newton Institute of Technology<\/strong> \u00b7 Migori Town, Migori County, Kenya \u00b7 +254 713 584 858 \u00b7 <a href=\"mailto:info@niteducation.com\">info@niteducation.com<\/a><\/p>\n<\/div>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>Analyst Workday Article 207 \u00b7 practical workflow What Does a Cybersecurity AnalystActually Do Every Day? event \u2192 alert \u2192 evidence \u2192 decision \u2192 action Follow the real work behind security alerts: how analysts prioritise, investigate, decide, respond, document and improve protection\u2014using practical beginner-friendly examples. Follow an investigation See practical examples The alert is only the [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[30],"tags":[751,752,750],"class_list":["post-3699","post","type-post","status-publish","format-standard","hentry","category-ict","tag-cybersecurity-analyst-daily-tasks","tag-cybersecurity-analyst-responsibilities","tag-what-does-a-cybersecurity-analyst-do-every-day"],"_links":{"self":[{"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/posts\/3699","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/comments?post=3699"}],"version-history":[{"count":1,"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/posts\/3699\/revisions"}],"predecessor-version":[{"id":3700,"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/posts\/3699\/revisions\/3700"}],"wp:attachment":[{"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/media?parent=3699"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/categories?post=3699"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/niteducation.com\/resources\/wp-json\/wp\/v2\/tags?post=3699"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}