What I Learned After my First Year as a Security Analyst

The talk opens with a plain definition of the analyst role: take in logs and alerts, investigate them, and decide whether a threat is present, with the response often set by organizational policy rather than by the analyst. The speaker argues that networking fundamentals, clear communication, attention to detail, and a curious, hacker-style mindset matter more than any particular degree or certification.

The middle section covers practical lessons. Reading raw log data at the source helps when parsers miss fields or hostnames and IP addresses get swapped. Threat intelligence knowledge is essential for quickly learning about events such as Log4j. Mistakes are inevitable and should be handled as learning opportunities, while escalations may never be fixed or even acknowledged. Missing logs limit what an investigation can prove, and every SOC has weaknesses that depend on its alert rules and on analysts' understanding of them. The speaker also shares tips for sleeping through night shifts and warns against staying in a role that offers no growth.

The closing section offers ways to start learning. Graylog, Kibana, and trial or free editions of commercial SIEMs can run on a home lab, and Splunk's Boss of the SOC datasets give practice material. The Open SOC competition run at DEF CON simulates analyst and threat-hunting work. Incident response is presented as a natural next step from analyst work.