A Cybersecurity Analyst is the professional who monitors an organization's information systems, detects threats, analyzes security incidents and takes part in the response.
Day to day, they work in a SIEM (a tool that centralizes logs and alerts) and in detection tools on workstations and servers (EDR). They triage alerts, rule out false positives, investigate suspicious cases, assess an incident's severity and coordinate the first actions with IT teams.
They usually sit in a SOC (Security Operations Center), in-house or at a managed security services provider. Levels are often split into L1 (alert triage), L2 (investigation) and L3 (incident response, threat hunting).
The role exists in every sector, with growing demand among operators subject to security obligations such as NIS2.
Why it matters when hiring
The title covers very different realities: an L1 analyst triaging alerts is not at the level of an L3 able to lead a full investigation. Ask the candidate to describe an incident handled end to end: sources checked, hypotheses, decision taken. Also tell it apart from a pentester (offensive) and a security engineer (who builds the defenses). Certifications do not replace hands-on practice.