Associate Security Analyst

Role Purpose & Context

Role Summary

The Associate Security Analyst is here to support the day-to-day operations of our security team, primarily by monitoring our systems for suspicious activity and helping to respond to basic alerts. You'll be right at the front line, working within our Security Operations Centre (SOC), making sure we catch anything that looks a bit off. When you do this well, we stop small issues from becoming big, expensive problems. If things go wrong here, we could miss a critical threat, putting our data and operations at risk. Honestly, it can be a bit repetitive sometimes, but the challenge is learning to spot the needle in the haystack. The reward? Knowing you're helping to protect the business from real, tangible threats every single day.

Reporting Structure

• Reports to: Security Analyst / Engineer (L2)
• Direct reports:
• Matrix relationships: Junior Cyber Security Analyst, Security Operations Centre (SOC) Trainee, Entry-Level Information Security Specialist,

Key Stakeholders

Internal:

• Security Analyst / Engineer (L2)
• Senior Security Engineer (L3)
• IT Operations Team
• Service Desk

External:

• None (direct interaction is rare, usually escalated)

Organisational Impact

Scope: Your main job is to help reduce our 'dwell time'—that's the time an attacker spends in our systems before we spot them. Catching things quickly means less damage, less cost, and less disruption for everyone. You're essentially the first line of defence, making sure the bigger security team has accurate, timely information to work with. Get it right, and you're saving us a headache. Get it wrong, and we might not know we've got a problem until it's too late.

Performance Metrics

Quantitative Metrics

1. Metric: Mean Time to Acknowledge (MTTA)
2. Desc: How quickly you pick up and start investigating a new security alert.
3. Target: < 15 minutes for critical alerts
4. Freq: Daily/Weekly
5. Example: An alert comes in about unusual login activity; you acknowledge it and start looking into it within 10 minutes.
6. Metric: Alert Triage Accuracy
7. Desc: The percentage of alerts you correctly classify (e.g., true positive, false positive, benign) according to our playbooks.
8. Target: 90% accuracy after 3 months
9. Freq: Weekly (via peer review)
10. Example: Out of 100 alerts, you correctly categorise 92, meaning you've followed the process and made the right call most of the time.
11. Metric: Vulnerability Patch Compliance Support
12. Desc: The percentage of assigned patching tasks you complete or escalate within the agreed timeframe.
13. Target: 95% completion/escalation rate
14. Freq: Monthly
15. Example: You're given 20 servers that need a critical patch; you ensure 19 of them are patched or escalated to the right team within the 7-day window.
16. Metric: Phishing Simulation Identification Rate
17. Desc: Your ability to correctly identify and report simulated phishing emails.
18. Target: 100% identification rate
19. Freq: Monthly (via internal simulations)
20. Example: During a simulated phishing campaign, you correctly identify and report all test emails, showing you're sharp on common attack vectors.

Qualitative Metrics

1. Metric: Adherence to Playbooks & Procedures
2. Desc: How consistently you follow our established security playbooks and operational procedures for incident response and daily tasks.
3. Evidence: Your incident notes are clear and complete, showing each step taken. Your manager rarely needs to correct your process. You proactively ask for clarification if a playbook isn't clear.
4. Metric: Proactive Learning & Curiosity
5. Desc: Your initiative in learning new security concepts, tools, and threat landscapes, and asking insightful questions.
6. Evidence: You complete assigned training modules ahead of schedule. You bring up interesting articles or new attack types you've read about. You ask 'why' something works the way it does, not just 'how'.
7. Metric: Communication Clarity (Internal)
8. Desc: How clearly and concisely you communicate findings and escalate issues to your immediate team and manager.
9. Evidence: Your incident handovers are easy to understand. Your written summaries for escalations contain all the necessary details without waffle. Other team members find your questions clear.
10. Metric: Team Collaboration & Support
11. Desc: Your willingness to help out other team members and contribute positively to the SOC environment.
12. Evidence: You offer to take on tasks when others are swamped. You share useful information you've found. You're generally a good egg to work with, even when things are stressful.

Primary Traits

• Trait: Meticulous Follower of Instructions
• Manifestation: You're the kind of person who reads the entire manual before assembling flat-pack furniture. When we give you a playbook for an incident, you'll go through it step-by-step, checking off each item. If something's unclear, you'll flag it, not just guess. You understand that 'good enough' isn't good enough when it comes to security.
• Benefit: In security, especially at this level, consistency is king. One missed step in a response playbook can mean the difference between containing a breach and letting it spread. We need you to be our reliable pair of hands, executing precisely as instructed, because the stakes are genuinely high.
• Trait: Calm Under Mild Pressure
• Manifestation: When a critical alert pops up and everyone's looking, you don't panic. You take a deep breath, open the playbook, and start working through it. You're able to focus on the task at hand even when there's a bit of background noise or a tight deadline. You might feel the stress, but you don't let it show or stop you from doing your job.
• Benefit: The SOC can get hectic. Critical alerts don't wait for a quiet moment. If you freeze or get flustered, you'll miss crucial details or make mistakes. We need you to keep a level head, especially when the clock is ticking, so we can respond effectively and prevent a small fire from becoming a blaze.
• Trait: Curious Digital Detective
• Manifestation: You don't just close an alert; you wonder 'why' it happened. You'll dig a little deeper, maybe check a few extra logs, just to understand the full picture. You're genuinely interested in how attackers operate and how our systems work (or don't work). You're always asking questions, even if they seem basic.
• Benefit: Security isn't just about following rules; it's about understanding the game. Your curiosity helps us not just react to threats, but to learn from them. It's how we improve our defences and how you'll grow into a more senior analyst. Without that spark, you'll just be a button-pusher, and that's not what we're looking for.

Supporting Traits

• Trait: Patient
• Desc: You'll often be dealing with false positives or chasing down small, non-critical issues. Patience helps you stay focused and thorough, rather than rushing through things.
• Trait: Organised
• Desc: Keeping track of multiple alerts, investigations, and documentation requires a good level of personal organisation. You'll need to know where you left off and what needs doing next.
• Trait: Teachable
• Desc: You're open to feedback, willing to admit when you don't know something, and keen to absorb knowledge from more experienced team members. You understand that learning is a continuous process here.
• Trait: Reliable
• Desc: When you say you'll do something, you do it. Your team needs to trust that you'll complete your assigned tasks and follow through on investigations, especially during shift changes.

Primary Motivators

1. Motivator: Learning & Skill Development
2. Daily: You'll be excited to tackle new types of alerts, ask questions about how different security tools work, and spend time reading up on the latest threats or vulnerabilities. You'll see every investigation as a chance to learn something new.
3. Motivator: Problem Solving (Structured)
4. Daily: You enjoy the process of following a clear set of steps to diagnose and resolve an issue. You're good at piecing together clues from different log sources to understand what's happening.
5. Motivator: Contributing to Safety & Security
6. Daily: You genuinely feel a sense of purpose knowing your work helps protect our company and customers from cyber threats. You're driven by the idea of being a digital guardian.

Potential Demotivators

Honestly, this isn't a role for someone who needs constant novelty or struggles with following established processes. You'll spend a fair bit of time on repetitive tasks, like reviewing logs or closing out false positives. The 'exciting' incidents are actually quite rare, and most of your day will be about diligent, methodical work. If you're someone who gets bored easily with routine or chafes at strict procedures, you might find yourself frustrated.

Common Frustrations

1. Dealing with a high volume of low-fidelity or false positive alerts, which can feel like busywork.
2. The need to strictly adhere to playbooks, even when you think there might be a quicker way (there usually isn't, at this level).
3. The occasional late-night or weekend shift when a critical incident demands immediate attention.
4. Sometimes, things move slowly. You might escalate an issue and then have to wait for another team to get back to you.

What Role Doesn't Offer

1. High-level strategic decision-making or setting security policy.
2. Autonomy to deviate significantly from established procedures without explicit approval.
3. Direct interaction with external clients or high-profile stakeholders on security matters.
4. A quiet, predictable 9-to-5 schedule every single day (incidents don't respect office hours).

ADHD Positives

1. The fast-paced nature of alert triage and incident response during busy periods can be highly engaging, providing novel stimuli and immediate feedback.
2. Hyperfocus can be a huge asset when deep-diving into log analysis or threat hunting for specific indicators, allowing for intense concentration.
3. The clear, step-by-step nature of security playbooks can provide a helpful structure for task execution, reducing cognitive load for planning.

ADHD Challenges and Accommodations

1. **Challenge:** Sustained attention on repetitive monitoring tasks can be difficult. **Accommodation:** We can rotate tasks regularly and use automation (SOAR) for low-level alerts to keep the human focus on more complex, engaging problems.
2. **Challenge:** Organisation and documentation can be a struggle. **Accommodation:** We use templated incident reports and ticketing systems with mandatory fields to guide documentation, and we're happy to provide digital organisation tools.
3. **Challenge:** Impulsivity in decision-making, especially under pressure. **Accommodation:** Strict adherence to pre-approved playbooks and mandatory peer review for critical actions helps mitigate this, ensuring a structured approach.

Dyslexia Positives

1. Strong visual-spatial reasoning, which can be excellent for understanding network diagrams, data flows, and identifying patterns in complex log data.
2. Often good at 'big picture' thinking, seeing connections that others might miss, which is useful in understanding attack chains.
3. Verbal communication strengths can be valuable for explaining findings during incident handovers or team discussions.

Dyslexia Challenges and Accommodations

1. **Challenge:** Reading and writing detailed log entries, reports, or policy documents can be time-consuming and error-prone. **Accommodation:** We use tools with syntax highlighting, text-to-speech, and grammar checkers. We also encourage verbal summaries and provide templates for written reports.
2. **Challenge:** Remembering complex sequences or technical jargon. **Accommodation:** We rely heavily on visual aids, flowcharts for playbooks, and clearly defined glossaries. We're patient with questions and encourage using personal notes.
3. **Challenge:** Time pressure during incident response when extensive reading is required. **Accommodation:** Critical information is often summarised visually or verbally by a peer, and we use tools that highlight key data points in logs.

Autism Positives

1. Exceptional attention to detail, which is critical for spotting anomalies in logs or configuration files that others might overlook.
2. Strong logical and analytical reasoning skills, perfect for dissecting complex security incidents and understanding system vulnerabilities.
3. A preference for clear, unambiguous rules and procedures, which aligns perfectly with the structured nature of security playbooks and compliance standards.

Autism Challenges and Accommodations

1. **Challenge:** Navigating ambiguous social cues or unwritten team expectations. **Accommodation:** We foster a direct, clear communication style. Expectations for collaboration are explicitly stated, and we provide clear feedback.
2. **Challenge:** Sensory overload in a busy SOC environment (e.g., flashing alerts, multiple conversations). **Accommodation:** We can provide noise-cancelling headphones and offer options for focused work in quieter areas. Visual alerts can be tuned.
3. **Challenge:** Unexpected changes to routine or sudden shifts in priorities. **Accommodation:** We aim to provide as much advance notice as possible for changes. For urgent incidents, the focus is on clear, direct instructions and a structured response.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Entry Level (0-2 years)
2. Responsibilities: Monitor security dashboards and alerts from our SIEM (Splunk ES, Azure Sentinel) and other security tools, looking for anything suspicious. This is your primary daily task.
3. Investigate low-level security alerts following strict, step-by-step playbooks. Think 'is this a real threat or just a system hiccup?'
4. Document your findings and actions clearly in our incident management system, making sure all the details are there for the next shift or for escalation.
5. Help with basic vulnerability management tasks, like running pre-defined scans or verifying that patches have been applied correctly on specific systems.
6. Assist with user access reviews, making sure people only have the permissions they actually need—yes, it's tedious but crucial.
7. Participate in regular team meetings and training sessions, soaking up knowledge from our more experienced analysts and engineers.
8. Keep our security documentation updated. If you spot something that's not quite right in a playbook, you'll flag it for review, rather than just ignoring it.
9. Supervision: You'll have daily check-ins with your direct manager or a more senior analyst. For any non-routine alert or decision, you'll be expected to ask for guidance. We won't just throw you in the deep end; we'll be right there to support you.
10. Decision: You won't be making independent decisions on anything critical. All your investigations and proposed actions will be reviewed by a senior team member before they're implemented. Your job is to gather the facts and execute the initial steps, not to make the final call. Escalate anything that feels outside the playbook or above your comfort level.
11. Success: You're doing well if you consistently acknowledge alerts within target times, your initial investigations are thorough, and you follow our playbooks without needing constant correction. Learning quickly and asking smart questions are also big indicators of success here.

Decision-Making Authority

• Type: Incident Classification (e.g., critical, major, minor)
• Entry: Propose initial classification based on playbook; requires review and approval from L2+.
• Mid: Classify routine incidents independently; escalate complex/major incidents for review.
• Senior: Final authority on incident classification within their domain; consults Lead/Manager on enterprise-wide impact.
• Type: System Isolation (e.g., disconnecting a server)
• Entry: Never. Immediately escalate to L2+ with all available information.
• Mid: Execute isolation for pre-approved, high-confidence threats following strict playbooks; requires L3+ sign-off for critical systems.
• Senior: Authorise isolation for systems within their domain; consults Director for business-critical systems.
• Type: User Account Disablement
• Entry: Never. Escalate to L2+ with evidence.
• Mid: Disable accounts for clear policy violations or confirmed compromises, following strict internal procedures and L3+ sign-off.
• Senior: Authorise account disablement for high-risk or executive accounts, in coordination with HR/Legal.
• Type: Tool Configuration Changes
• Entry: Never. Only use tools as configured.
• Mid: Propose and implement minor configuration changes (e.g., adding a new detection rule) with L3+ review.
• Senior: Design and implement significant configuration changes; approve changes made by junior team members.

Competency Requirements

Foundation Skills (Transferable)

Even at an entry level, there are some core skills that are non-negotiable. These aren't just about knowing how to click buttons; they're about how you approach problems, how you talk to people, and how you manage yourself. Think of these as the bedrock for your entire career in security.

• Category: Communication
• Skills: Clear Written Communication: You'll need to write clear, concise incident notes and emails, making sure others can easily understand what you've found and what you've done.
• Active Listening: When a senior analyst is explaining a complex attack or a new procedure, you'll need to listen carefully and ask clarifying questions, not just nod along.
• Basic Report Writing: The ability to summarise technical findings into a digestible format, even if it's just filling in a template.
• Category: Problem-Solving
• Skills: Logical Troubleshooting: Following a defined set of steps to diagnose an issue, rather than jumping to conclusions. It's like following a recipe.
• Pattern Recognition (Basic): Being able to spot unusual activity in logs or dashboards when it deviates from the norm, even if you don't fully understand why yet.
• Resourcefulness: Knowing when to look up documentation, search internal knowledge bases, or ask a colleague for help, rather than getting stuck.
• Category: Adaptability & Learning
• Skills: Eagerness to Learn: A genuine desire to understand new technologies, threats, and security concepts. Security changes constantly, so you need to be a sponge.
• Following Procedures: The discipline to stick to established playbooks and processes, even when they seem long-winded.
• Handling Feedback: Being open to constructive criticism and using it to improve your performance and understanding.
• Category: Teamwork
• Skills: Collaboration: Working effectively with other SOC analysts, sharing information, and helping out when needed.
• Respect for Others: Treating colleagues with professionalism and contributing positively to the team environment.
• Reliability: Being someone the team can count on to complete tasks and be present for shifts.

Functional Skills (Role-Specific Technical)

These are the specific security and technical skills you'll need to do the job day-to-day. We're not expecting you to be an expert, but a solid grasp of the fundamentals will help you hit the ground running.

Technical Competencies

• Skill: Basic Networking Concepts
• Desc: Understanding IP addresses, ports, common protocols (TCP/IP, HTTP, DNS), and how data moves across a network. It's the plumbing of the internet, and you need to know how it works to spot a leak.
• Level: Basic
• Skill: Operating System Fundamentals (Windows/Linux)
• Desc: Knowing your way around command lines (cmd, PowerShell, Bash), understanding file systems, processes, and user management. Most attacks target operating systems, so you need to know their weak spots.
• Level: Basic
• Skill: Threat Modeling & Risk Assessment (Basic Awareness)
• Desc: Understanding what a threat is, what a vulnerability is, and the basic idea of how attackers might try to exploit weaknesses. You'll learn about frameworks like MITRE ATT&CK.
• Level: Basic
• Skill: Incident Response (Initial Steps)
• Desc: Knowing the first few steps of an incident response process: identification, containment, and basic documentation. You'll be following our playbooks for this.
• Level: Basic
• Skill: Vulnerability Management (Basic Scanning & Remediation)
• Desc: Understanding what a vulnerability scan does and how to verify if a patch has been applied. You won't be configuring scanners, but you'll be using their outputs.
• Level: Basic

Digital Tools

• Tool: Splunk ES / Azure Sentinel (SIEM)
• Level: Basic
• Usage: Monitoring dashboards, searching for specific log entries (e.g., failed logins), investigating pre-defined alerts, and understanding basic KQL/SPL queries.
• Tool: Palo Alto Cortex XSOAR (SOAR)
• Level: Basic
• Usage: Executing automated playbooks for alert triage, enriching incident data, and documenting actions within the platform.
• Tool: Wiz / Palo Alto Prisma Cloud (CSPM)
• Level: Basic
• Usage: Reviewing findings from cloud security scans, identifying misconfigurations, and helping to remediate them based on documented procedures.
• Tool: CrowdStrike Falcon / SentinelOne (EDR)
• Level: Basic
• Usage: Responding to endpoint detection and response (EDR) alerts, investigating suspicious processes, and isolating endpoints under guidance.
• Tool: ServiceNow GRC / Jira
• Level: Basic
• Usage: Tracking remediation tasks, entering data for compliance audits, and pulling standard reports for your manager.

Industry Knowledge

• Area: Common Cyber Attack Types
• Desc: Understanding what phishing, malware, ransomware, and denial-of-service attacks are at a high level. You need to know what you're looking for, roughly.
• Area: Basic Information Security Principles
• Desc: Concepts like confidentiality, integrity, and availability (CIA triad). What they mean and why they're important for a secure system.

Regulatory Compliance Regulations

• Reg: GDPR (General Data Protection Regulation)
• Usage: Understanding that personal data needs to be protected, and recognising when an incident might involve a data breach that requires GDPR consideration. You'll know who to escalate to.
• Reg: ISO 27001 (Information Security Management)
• Usage: Understanding that we have an Information Security Management System (ISMS) and that our processes (like incident response) contribute to its compliance. You'll know your role in it.

Essential Prerequisites

• A foundational understanding of IT systems and networks, perhaps from a college course, an apprenticeship, or self-study.
• Some experience with command-line interfaces (Windows or Linux) – you should be comfortable typing commands, not just clicking.
• A genuine, demonstrable interest in cyber security. We'll want to hear about what you've been learning, what blogs you read, or any home lab projects you've tinkered with.
• The ability to learn quickly and adapt to new tools and technologies. This field moves fast, so you can't be afraid of change.
• Strong attention to detail – you'll be sifting through a lot of data, and missing one tiny clue could be a big deal.

Career Pathway Context

This role is designed as a stepping stone. We're looking for raw talent and a hunger to learn. You don't need years of experience, but you do need to show us you've got the aptitude and the drive to build a career in cyber security. This is where you'll get the real-world experience that textbooks can't teach you, setting you up for a solid progression.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: Basic Prompt Engineering for Security Tools
• Why: AI is being integrated into almost every security tool, from SIEMs to threat intelligence platforms. Knowing how to ask the right questions and structure your queries for these AI assistants will make you significantly more efficient.
• Concepts: [{'concept_name': 'Clear, concise prompting', 'description': "Formulating direct questions to get specific information from AI-powered tools, like 'Summarise recent CVEs for Apache Kafka'."}, {'concept_name': 'Contextual input', 'description': 'Providing enough relevant information (e.g., log snippets, alert details) to the AI for it to give useful answers.'}, {'concept_name': 'Output validation', 'description': "Understanding that AI can 'hallucinate' and always verifying its responses with human judgment or other sources."}, {'concept_name': 'Iterative prompting', 'description': 'Refining your prompts based on initial AI responses to get more precise or detailed information.'}]
• Prepare: This week: Experiment with ChatGPT or Claude to summarise security news or explain complex attack techniques.
• This month: Start using AI features in our SIEM (if available) to refine your log searches or explain alert details.
• Month 2: Document one instance where AI significantly sped up an investigation for you and share it with your team.
• Month 3: Take an online course on basic prompt engineering; there are plenty of free ones out there.
• QuickWin: Start using AI to draft email summaries for incident updates or to help you understand a new technical term you encounter. It's low-risk and immediately helpful.
• Skill: Cloud Security Fundamentals (Beyond Basic Awareness)
• Why: More and more of our infrastructure is moving to the cloud (Azure, AWS). Understanding how cloud environments work and their unique security challenges isn't just for senior folks anymore; it's becoming a basic requirement for everyone on the team.
• Concepts: [{'concept_name': 'Shared Responsibility Model', 'description': "Understanding what the cloud provider secures versus what we're responsible for securing in the cloud."}, {'concept_name': 'Identity and Access Management (IAM) in Cloud', 'description': "How permissions work in Azure AD or AWS IAM, and why they're critical for cloud security."}, {'concept_name': 'Cloud Storage Security', 'description': 'Understanding common misconfigurations in S3 buckets or Azure Blob storage that lead to data leaks.'}, {'concept_name': 'Basic Cloud Networking', 'description': 'Concepts like Virtual Private Clouds (VPCs), security groups, and network access control lists (NACLs).'}]
• Prepare: This week: Read up on the Azure/AWS Shared Responsibility Model – it's foundational.
• This month: Complete a free 'Cloud Security Basics' course from Microsoft or AWS.
• Month 2: Ask a senior analyst to walk you through our cloud security posture management (CSPM) tool (Wiz/Prisma Cloud) and explain some of the findings.
• Month 3: Try to set up a free-tier cloud account and secure a basic virtual machine, just to get hands-on.
• QuickWin: Familiarise yourself with the basic terminology of Azure or AWS. Knowing what a 'resource group' or an 'S3 bucket' is will make a huge difference in understanding cloud alerts.

Advancing Technical Skills

• Skill: Advanced SIEM Querying (KQL/SPL)
• Why: To move beyond simply monitoring dashboards, you'll need to write your own complex queries to hunt for threats, investigate incidents more deeply, and build custom reports. This is how you really get value out of our SIEM.
• Concepts: [{'concept_name': 'Aggregations and statistics', 'description': 'Using functions to count events, calculate averages, and summarise large datasets in logs.'}, {'concept_name': 'Joins and lookups', 'description': 'Combining data from different log sources or external threat intelligence lists to enrich your investigations.'}, {'concept_name': 'Time-based analysis', 'description': 'Analysing trends and anomalies over specific time windows to spot subtle attacker behaviour.'}, {'concept_name': 'Regular expressions (Regex)', 'description': 'Using powerful pattern matching to find specific strings or data formats within unstructured log data.'}]
• Prepare: This week: Practice basic KQL/SPL queries on our training environment or a public dataset.
• This month: Aim to write one custom query per week to investigate a specific alert type more deeply.
• Month 2: Work with a senior analyst to build a simple detection rule using your custom queries.
• Month 3: Take a dedicated course on advanced Splunk/Azure Sentinel querying.
• QuickWin: Start by trying to recreate a dashboard widget using a raw query. It forces you to understand the underlying data.
• Skill: Scripting for Automation (Python/PowerShell)
• Why: While we have SOAR, not everything can be automated out-of-the-box. Basic scripting skills will let you automate repetitive tasks, parse logs more efficiently, or quickly gather information from different sources. It's a huge time-saver and a critical skill for progression.
• Concepts: [{'concept_name': 'Variables and data types', 'description': 'Storing and manipulating information within your scripts.'}, {'concept_name': 'Conditional logic (if/else)', 'description': 'Making decisions within your script based on certain conditions.'}, {'concept_name': 'Loops (for/while)', 'description': 'Repeating actions over a list of items or until a condition is met.'}, {'concept_name': 'API interaction (basic)', 'description': 'Using scripts to talk to other tools or services (e.g., pulling data from a threat intelligence platform).'}]
• Prepare: This week: Complete a 'Python for Beginners' or 'PowerShell Basics' tutorial online.
• This month: Write a simple script to automate a task you do manually every day (e.g., parsing a CSV log file).
• Month 2: Ask a senior engineer for a small, automatable task and try to script a solution.
• Month 3: Explore how to use Python libraries for security tasks (e.g., 'requests' for API calls, 'os' for file system interaction).
• QuickWin: Write a small script that takes a list of IP addresses and checks them against a public blacklist. It's a practical, immediate application.

Education Requirements

• Level: Minimum
• Req: A-Levels or equivalent vocational qualification (e.g., BTEC Level 3 in IT/Computing)
• Alts: We're flexible here. If you've got demonstrable experience from a relevant apprenticeship, self-study, or a strong portfolio of personal projects, we'd love to hear about it. A degree isn't strictly necessary if you can show us you've got the foundational knowledge and the right attitude.
• Level: Preferred
• Req: A Bachelor's degree in Computer Science, Cyber Security, or a related technical field
• Alts: While not essential, a degree can sometimes fast-track your foundational understanding. That said, practical experience often trumps academic qualifications in our world.

Experience Requirements

You'll need 0-2 years of experience in an IT support role, network operations, or a very junior security position. We're looking for someone who understands the basics of how computers and networks work, and who has a keen interest in security. This isn't a 'first job ever' role, but it's very close to it. If you've spent time building your own home lab or participating in CTF (Capture The Flag) competitions, that absolutely counts.

Preferred Certifications

• Cert: CompTIA Security+
• Prod: CompTIA
• Usage: This is a fantastic entry-level certification that covers core security concepts, network security, threats, and vulnerabilities. It shows you've got a solid grasp of the fundamentals.
• Cert: Certified in Cyber Security (CC)
• Prod: (ISC)²
• Usage: Another great starting point, covering foundational security principles and practices. It's a good stepping stone to more advanced (ISC)² certifications later on.

Recommended Activities

• Regularly reading industry blogs and news (e.g., KrebsOnSecurity, BleepingComputer) to stay current on threats.
• Participating in online security communities or forums to learn from others and ask questions.
• Setting up a home lab environment to experiment with security tools and practice basic attack/defence scenarios.
• Attending virtual webinars or local meetups on cyber security topics.
• Completing internal training modules on our specific tools and platforms.

Career Progression Pathways

Entry Paths to This Role

• Path: IT Support / Helpdesk Specialist
• Time: 1-3 years
• Path: Network Operations Centre (NOC) Technician
• Time: 1-2 years
• Path: Self-Taught Enthusiast / Apprenticeship Graduate
• Time: 0-2 years (post-apprenticeship/intensive self-study)

Career Progression From This Role

• Pathway: Security Analyst / Engineer (L2)
• Time: 2-3 years

Long Term Vision Potential Roles

• Title: Senior Security Engineer (L3)
• Time: 5-8 years from entry
• Title: Lead Security Architect (L4)
• Time: 8-12 years from entry
• Title: Security Manager (L5)
• Time: 12-16 years from entry

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.