gradovioSign up

Cyber Security Analyst

A cyber security analyst monitors an organisation's computers, networks and cloud systems for signs of attack or misuse, investigates anything suspicious, and helps fix the weaknesses that let it happen. The work is done either in-house for a single employer (a bank, retailer, hospital trust, government department) or for a consultancy or managed security provider that watches over many client organisations at once. Much of it is triage: deciding which of the many alerts a security system throws up are real problems, and escalating or containing the ones that are.

Approximate graduate salary

Typically around GBP 25,000-35,000 to start, though this varies widely - London, financial services and defence tend to sit at the higher end, while regional in-house IT teams and smaller managed service providers often start lower. Shift allowances, on-call payments and employer-funded certifications can add meaningfully to the package, and salaries in this field tend to rise fairly quickly once you specialise.

What you'd actually do

  • Working through a queue of security alerts from monitoring tools - typically a SIEM (Security Information and Event Management system, which collects logs from across the network and flags odd patterns) - and deciding for each one whether it is a real attack, a misconfiguration or a false alarm
  • Investigating an incident by pulling together evidence: which user account was involved, what emails they received, what processes ran on their laptop, what the firewall logs show, and writing up a timeline of what happened
  • Handling phishing reports from staff - checking whether links or attachments are malicious, seeing who else received the email, and getting it blocked or removed from mailboxes
  • Chasing up vulnerabilities: reading the output of scanning tools, working out which unpatched systems actually pose a risk in your environment, and nagging IT and application teams to patch or reconfigure them
  • Reading threat intelligence - reports on new malware, ransomware groups and exploited software flaws - and checking whether your own organisation is exposed
  • Tuning detection rules so that a noisy alert stops firing hundreds of times a day, or writing a new rule after an incident showed a gap in coverage
  • Writing reports and updates: incident summaries for managers, monthly metrics, and evidence for auditors or certification schemes such as Cyber Essentials or ISO 27001
  • Attending handover meetings at shift change if the team runs extended or 24/7 cover, and joining post-incident reviews to agree what should change

How graduates get in

  • Graduate schemes in cyber security or technology, run by large banks, insurers, telecoms firms, retailers, defence contractors, consultancies and the Civil Service - common, competitive, and usually the most structured route with rotations and paid certifications
  • Direct entry into a junior or 'Tier 1' analyst role in a Security Operations Centre (SOC) - the team that watches the alert queue. Managed security service providers and larger in-house teams hire at this level regularly, and it is one of the most reliable ways in even without a graduate scheme
  • Sideways from an IT service desk, network or systems administration job. Very common, and often underrated: a year or two of understanding how corporate IT actually works makes you a much stronger analyst, and many employers hire internally into security teams
  • Degree apprenticeships and higher apprenticeships in cyber security - an alternative to the graduate route rather than a follow-on, but relevant if you are still choosing
  • Government-linked routes: the Civil Service Fast Stream digital and cyber options, and graduate entry into intelligence and security organisations. These involve security clearance, which needs UK residency history and takes time
  • Self-taught plus certification: building home labs, working through hands-on platforms and capture-the-flag competitions, then entering with an entry-level certification. This works, but usually for a first junior role rather than a graduate scheme, and needs you to evidence practical work

What employers ask for

  • A degree is usually expected for graduate schemes but the subject matters less than people assume. Cyber security, computer science, networking and software engineering are the obvious fits; maths, physics, engineering and even non-technical degrees are accepted by plenty of employers if you can show genuine technical interest
  • Grade requirements vary a lot - some graduate schemes ask for a 2:1 and specify UCAS points or A-level grades, while many direct-entry SOC roles have no formal grade bar and care more about what you can demonstrate
  • Practical evidence of interest: a home lab, a virtual machine setup, hands-on training platforms, capture-the-flag write-ups, a personal blog, or a university society. This carries real weight because employers are trying to distinguish curiosity from a passing interest in the job title
  • Foundational knowledge of how networks and operating systems work - TCP/IP, DNS, Windows and Active Directory, Linux command line, and increasingly cloud platforms. Interviews commonly test this rather than security theory
  • Certifications: entry-level ones such as CompTIA Security+ or vendor cloud fundamentals help for direct entry. More advanced ones (offensive security, incident response, or CISSP later in your career) are usually paid for by employers rather than expected up front
  • Security clearance for defence, government and some critical national infrastructure work - this can require several years of continuous UK residence, so check before applying

Skills that matter

Log and evidence analysis

The core task is reading raw log data from firewalls, servers, endpoints and cloud services and reconstructing what a user or attacker actually did.

Structured, sceptical reasoning

Most alerts are benign, so you need to form a hypothesis, test it against evidence and avoid both dismissing real attacks and escalating harmless noise.

Networking and operating system fundamentals

You cannot judge whether traffic or process behaviour is abnormal unless you know what normal looks like on Windows, Linux and in cloud environments.

Clear written communication under time pressure

Incident notes and escalations get read by people who were not there, sometimes by executives or regulators, and a vague write-up can stall a response.

Scripting and automation, usually Python or PowerShell

Repetitive enrichment and lookup tasks eat the day otherwise, and scripting is what separates analysts who stay in the alert queue from those who move up.

Diplomacy with other teams

You will regularly ask busy IT, developer or business teams to patch something, disable an account or take a system offline, and you have influence rather than authority.

Where it leads

  1. Junior or Tier 1 analyst: triaging alerts, following documented playbooks, escalating anything complicated. Typically your first year or two, though this varies with team size and how much they let you take on.

  2. Analyst or Tier 2/senior analyst: owning investigations end to end, tuning detections, leading on smaller incidents and mentoring newer joiners. Timelines vary widely - a busy SOC can get you there faster than a quiet in-house team.

  3. Specialisation, which is where most careers diverge. Common branches include incident response and digital forensics, threat hunting and detection engineering, penetration testing and red teaming, cloud security, security architecture, and governance/risk/compliance (policy, audit and regulatory work).

  4. Lead or principal specialist, or SOC team lead / incident response manager - either going deeper technically or taking on people and process management.

  5. Longer term: head of security operations, security architect, consultancy partner-track roles, or CISO (Chief Information Security Officer, the executive accountable for security). Many analysts also move into contracting or independent consultancy, where day rates can be high but work is less stable.

What people get wrong

“Cyber security analyst means hacking into things.”

Offensive work - penetration testing, red teaming - is a separate specialism. An analyst role is overwhelmingly defensive: monitoring, investigating, patching, reporting. If breaking into systems is what appeals, look specifically at penetration testing roles.

“It is a highly technical job with little writing or talking to people.”

A large share of the week is documentation, incident write-ups, chasing other teams and explaining risk to non-technical colleagues. Analysts who cannot write clearly struggle to progress regardless of technical depth.

“Most of what you deal with is sophisticated nation-state attacks.”

The bread and butter is phishing emails, stolen passwords, unpatched software, staff plugging in things they shouldn't and misconfigured cloud storage. Advanced attacks exist but they are not the daily diet.

“You need to already know a lot of security before anyone will hire you.”

Employers hiring graduates generally screen for networking and operating system fundamentals, curiosity and a methodical mind, then train the security specifics. A shaky grasp of DNS or Active Directory will hurt you more in an interview than not knowing malware families.

“It is always shift work and constant emergencies.”

Some roles are 24/7 shift-based, especially in managed service providers, but many in-house teams work ordinary office hours with an on-call rota, and governance or vulnerability-management roles rarely involve nights at all.

Where this varies

The job differs a lot depending on where you do it. In a managed security service provider or outsourced SOC you watch many client environments, work to strict response times, often on rotating shifts, and see high alert volumes - great for learning fast, but you rarely get to fix the underlying problems. In-house teams at a bank, retailer or NHS trust give you deep knowledge of one environment and more involvement in remediation and project work, usually on office hours plus on-call. Consultancies lean towards advisory work - assessments, audits, maturity reviews - with client travel and less hands-on monitoring. Defence, government and critical infrastructure add security clearance requirements and a heavier compliance element. Team size matters too: in a small organisation 'cyber security analyst' can mean you are the entire security function, doing everything from firewall changes to writing policy, whereas in a large one you may specialise narrowly from day one. Regulated sectors such as finance and health also involve more formal reporting obligations than, say, media or manufacturing.

General guidance about the role across the UK market, not about any specific employer. Entry routes and requirements vary — always check the individual job advert.