# Cybersecurity Analyst

> Use when analyzing security threats, reviewing security logs, performing vulnerability assessments, or implementing security controls. Trigger phrases: "cybersecurity", "security analysis", "threat assessment", "vulnerability scan", "security monitoring", "SIEM", "threat intelligence", "security incident", "malware analysis", "CVE", "risk assessment", "security audit", "security posture", "attack surface", "indicators of compromise", "IOC".

- Skill: `barastrong/cybersecurity-analyst` (Agent Skill, multi-file: 4 files)
- Install (CLI): `npx skillmds@latest add barastrong/cybersecurity-analyst`
- Raw SKILL.md: https://api.skillmd.com/api/skills/barastrong/cybersecurity-analyst/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: barastrong (https://skillmd.com/u/barastrong)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/barastrong/cybersecurity-analyst

---


# Cybersecurity Analyst

## Role Summary

A Cybersecurity Analyst monitors, detects, and responds to security threats
across the organization's IT infrastructure. The role involves continuous
security monitoring, vulnerability assessment, incident analysis, and
implementing defensive controls.

## Core Responsibilities

- Monitor security events and alerts from SIEM and detection tools
- Perform vulnerability assessments and scanning
- Analyze security incidents and determine impact/scope
- Maintain and tune detection rules and alerts
- Conduct threat intelligence gathering and analysis
- Recommend and implement security controls
- Produce security reports for management
- Participate in incident response activities
- Security awareness training support

## Standard Workflow

1. **Monitor** — review SIEM dashboards, alert queues, threat intel feeds.
2. **Triage** — classify alerts (true positive, false positive, benign),
   assign severity.
3. **Investigate** — correlate events, analyze logs, identify indicators
   of compromise (IOCs).
4. **Contain** — isolate affected systems, block malicious IPs/domains,
   disable compromised accounts.
5. **Remediate** — patch vulnerabilities, update rules, harden systems.
6. **Report** — incident report, lessons learned, metrics update.
7. **Improve** — tune detection rules, update playbooks, reduce false positives.

## Technology Stack

| Layer | Tools |
|-------|-------|
| SIEM | Splunk, Elastic Security, Microsoft Sentinel, QRadar |
| EDR | CrowdStrike, SentinelOne, Carbon Black, Microsoft Defender |
| Vulnerability | Nessus, Qualys, OpenVAS, Rapid7 InsightVM |
| Threat Intel | MISP, VirusTotal, AlienVault OTX, Recorded Future |
| Network | Zeek, Suricata, Snort, Wireshark |
| Forensics | Volatility, Autopsy, KAPE, FTK |
| Frameworks | MITRE ATT&CK, NIST CSF, CIS Controls, Kill Chain |

## Best Practices

- MITRE ATT&CK mapping for all detections — understand coverage gaps.
- Prioritize alerts by business impact, not just severity score.
- Automate repetitive triage with SOAR playbooks.
- Continuous vulnerability scanning (weekly minimum for critical assets).
- Threat-informed defense: prioritize controls against relevant threat actors.
- Document investigation steps for reproducibility.
- Maintain IOC feeds and share with industry ISACs.
- Regular tabletop exercises for incident response readiness.

## Anti-Patterns to Avoid

- Alert fatigue from untuned SIEM rules — tune or disable noisy rules.
- Ignoring low-severity vulnerabilities that chain into critical exploits.
- Security through obscurity as primary defense.
- No documentation of investigation steps — impossible to hand off.
- Reactive-only posture — no proactive threat hunting.

## References

- `references/incident-classification.md` — incident severity classification
- `references/mitre-attack-mapping.md` — ATT&CK technique coverage map
- `references/vulnerability-management-sop.md` — vulnerability management process

## Expected Output Format

1. Investigation report (timeline, IOCs, affected assets, impact)
2. Detection rule (SIEM query with documentation)
3. Vulnerability assessment report (prioritized findings + remediation)
4. Security metrics dashboard (alert volume, MTTD, MTTR, vuln aging)