Security Leaders Grow Senior Analysts In House As Automation Handles Routine Alert Triage

Security teams that hire IT administrators and train them into analysts often build steadier SOC teams than those that hold out for senior hires. Senior searches can drag on for a year, while new hires with an operations background can be ready in about six months. That kind of in-house training matters more now that automation handles much of the entry-level triage where junior analysts used to learn.

Tanner Green is a Cyber Data Analytics Lead with a large amount of managerial experience. He leads a team of engineers responsible for security information and event management (SIEM) alerts and analytics. Green also serves as a Cyber Warfare Operator in the U.S. Air Force Reserve and holds a master’s degree from SANS Technology Institute. He spent roughly a decade in oilfield operations and building automation before moving into security, then worked his way up from a tier-one SOC analyst to shift lead and incident responder.

“If you’re willing to train people, not only do you save money, but they last longer, and you give them a chance to really go out and succeed,” Green says. Leaders can start by looking for candidates who already know how systems run day to day. Technical security skills are easier to teach on the job than operational instincts.

Roots in operations

Keeping security tools up and running is a large part of SOC work, alongside responding to threats. Some graduates arrive with years of security coursework and limited experience administering systems, which can make that side of the job harder to pick up. Hiring managers tend to value that administration experience. In ISC2’s 2025 Cybersecurity Hiring Trends report, 90% said they would consider candidates whose only background is IT work. Many longtime practitioners took that route into the field. “Most of us came from an IT background, and we pivoted in,” Green says.

Green’s own move into security followed a similar path. His first cybersecurity role came after the 2021 Colonial Pipeline ransomware attack, when an employer needed someone who understood industrial control systems. The attack showed how a security incident can halt physical operations, and Green’s years working on those systems gave him the context to help protect them.

Operations experience also helps analysts make sense of alerts. An event that looks alarming on a dashboard may be an administrator using emergency “break glass” access to fix an outage. Green estimates that the majority of what analysts see turns out to be harmless, and telling the difference takes hands-on time with the tools. Analysts without that experience tend to send basic questions to engineering staff, which slows down both teams.

Hiring for unicorns

Many job postings ask for tier-four or tier-five analysts, the most senior people on a SOC team, who can handle almost any problem without help. Few candidates fit that description, especially in specialized areas like SIEM engineering. “Stop going for unicorns. You’re going to get unicorn rates where people are overly expensive,” Green says.

Developing analysts offers a better return. Bureau of Labor Statistics data from May 2025 shows the lowest-paid 10% of information security analysts earning less than $75,090 a year, while the top 10% earn more than $199,850. Green estimates that a team can often hire nearly two developing analysts for the cost of one senior specialist. Those analysts often stay three to four years, and many grow into senior roles along the way. That keeps experienced people on the team longer than an outside senior hire typically lasts.

Senior analysts still anchor a strong team, and a mix of about half senior staff and half developing analysts keeps that core in place. Green puts annual attrition across cybersecurity at 20% to 30%, rising to 30% to 40% over two years, and his own teams run at about 8%.

With turnover that high, a deeper bench also protects the most experienced people, since they no longer have to absorb every gap when someone leaves. “If you frustrate the top of the stack because you think they’re going to be there forever, you don’t have backfills, and you’re going to hurt,” Green says.

Documentation as training

Detailed case notes are one of the best training tools a SOC team has. When experienced analysts write down each step of an investigation and explain why they took it, newer analysts can follow their thinking. For example, a note might say that an employee’s laptop suddenly started connecting to an unfamiliar server, so the analyst pulled the network logs to see what data was being sent and where it ended up. After reading enough of these notes, tier-one analysts start to spot similar patterns and know what to check next.

Notes work best alongside regular one-on-one guidance. Pairing new analysts with a shift lead and an incident responder gives them someone to ask when a note doesn’t cover a situation, and someone to check their reasoning before it becomes habit. “Mentorship is everything,” Green says.

Teams can apply the same discipline to engineering work by documenting every task and testing each document against a simple standard. “If somebody who knows nothing can’t do that task, your document’s not good enough for the next person,” Green says.

Assigning a primary, secondary and tertiary owner for each tool gives new hires a defined place to start. They begin as the tertiary owner and take low-risk tickets first, with tasks sorted by how much damage a mistake could cause. That structure lets them build confidence on work where errors are easy to fix, while the primary and secondary owners handle anything critical.

Attitude plays a big part too. New analysts who stick with repetitive tasks and check the documentation before asking for help tend to progress fastest. Green sees that self-reliance as an essential skill, since analysts often have to figure things out alone in the middle of an incident.

Funding the pipeline

Training new analysts doesn’t have to be expensive. Free and low-cost platforms like TryHackMe, Hack The Box, OverTheWire and pwn.college let analysts practice in realistic lab environments, and certifications like CompTIA Security+ and CySA+ give them clear goals to work toward. Green suggests setting aside $5,000 to $10,000 per analyst each year for this kind of development.

This approach also gives finance teams a clear view of what they’re paying for. The costs are low and predictable, and each certification shows exactly what an analyst has learned. Employers can add retention terms to training agreements so the people they invest in stay. “Understand the cost of what it is to create that person and know that your attrition rate is low,” Green says.

Green expects hiring budgets to get tighter in 2027, especially on fixed-price contracts where every cost gets scrutinized. Under that pressure, growing talent in-house is often the most practical way to keep a team staffed.

Many leaders are still overlooking the people best positioned to grow. “Everybody’s chasing best talent, and nobody’s chasing the young kids who are hungry," Green says.

The views and opinions expressed are those of Tanner Green and do not represent the official policy or position of any organization.