Associate Security Analyst

Role Purpose & Context

Role Summary

The Associate Security Analyst is here to help keep our digital doors locked. Day-to-day, you'll be monitoring our security systems, looking for anything out of the ordinary, and making sure we follow our established security playbooks. This role sits right at the heart of our security operations, acting as the first point of contact for alerts and potential threats. You'll be translating raw data from our systems into actionable insights for the wider team, helping them decide what needs a closer look. When you do this well, we catch issues early, before they cause real damage or cost us a fortune. If it's not done properly, well, that's when we end up on the news for the wrong reasons. The challenge? Learning to tell the difference between a genuine threat and just a noisy system. The reward? Knowing you're a crucial part of keeping our business and our customers safe.

Reporting Structure

• Reports to: Senior Security Analyst
• Direct reports:
• Matrix relationships: Junior Cybersecurity Specialist, Security Operations Centre (SOC) Analyst L1, Entry-Level Cyber Defence Analyst,

Key Stakeholders

Internal:

• Senior Security Analysts (your direct line for help)
• Security Operations Centre (SOC) Team (your daily colleagues)
• IT Operations Team (they'll help with system access and changes)
• Service Desk (they'll pass on user reports of suspicious activity)

External:

• None directly, you'll be internal-facing for now.

Organisational Impact

Scope: Your work is the first line of defence against cyber threats. If you're sharp and catch things quickly, we minimise downtime, protect customer data, and avoid hefty fines. Miss something, and it could mean significant financial loss, reputational damage, and a whole lot of stress for everyone. Honestly, it's a big deal, even at this level.

Performance Metrics

Quantitative Metrics

1. Metric: Mean Time to Acknowledge (MTTA) Critical Alerts
2. Desc: How quickly you pick up and start looking at a high-priority security alert.
3. Target: <15 minutes
4. Freq: Daily, reviewed weekly
5. Example: An alert for a potential server compromise comes in. You should be investigating it within 10 minutes, not 20.
6. Metric: Alert Triage Accuracy
7. Desc: The percentage of alerts you correctly classify as either a true threat or a false alarm, following our playbooks.
8. Target: >95%
9. Freq: Weekly, via peer review
10. Example: Out of 100 alerts, you correctly identify 97 as false positives or true incidents, only misclassifying 3.
11. Metric: Playbook Adherence
12. Desc: How consistently you follow the documented steps for handling standard security incidents.
13. Target: 100% for standard incidents
14. Freq: Monthly, through incident review
15. Example: For a phishing alert, you complete every step in the 'Phishing Incident Response' playbook, from isolating the email to notifying the user.
16. Metric: Documentation Quality
17. Desc: The clarity, completeness, and accuracy of your notes and reports for each incident you handle.
18. Target: Minimal feedback required from Senior Analyst
19. Freq: Per incident, reviewed weekly
20. Example: Your incident report clearly details the alert, your investigation steps, findings, and actions taken, requiring only minor edits from your Senior Analyst.

Qualitative Metrics

1. Metric: Proactive Learning & Curiosity
2. Desc: Showing a genuine interest in understanding *why* things happen and seeking out new knowledge, rather than just following instructions.
3. Evidence: Asking thoughtful questions during daily stand-ups; independently researching new attack techniques; suggesting improvements to playbooks (even if small); actively participating in team learning sessions.
4. Metric: Effective Communication
5. Desc: Clearly explaining what you've found to your Senior Analyst, especially when you're not sure what's going on, or when you need help.
6. Evidence: Providing concise summaries of alerts; escalating issues with enough context for others to understand; asking for clarification when instructions aren't clear; not being afraid to say 'I don't know' but following up with 'I'll find out'.
7. Metric: Reliability & Follow-Through
8. Desc: Consistently completing your assigned tasks on time and making sure things don't fall through the cracks.
9. Evidence: Meeting MTTA targets consistently; completing all steps of a playbook; updating incident tickets promptly; letting your Senior Analyst know if you're stuck or won't meet a deadline *before* it's missed.
10. Metric: Team Collaboration
11. Desc: Working well with your colleagues, offering help when you can, and being receptive to feedback.
12. Evidence: Helping a teammate with a tricky query; sharing interesting findings with the team; taking feedback on your reports positively; contributing to team discussions.

Primary Traits

• Trait: Methodical Problem-Solver
• Manifestation: You're the sort who, when faced with a weird alert, doesn't just panic. Instead, you'll break it down, follow the steps in the playbook, and methodically check each piece of the puzzle. You'll connect the dots between a strange login and a file modification, even if they seem unrelated at first glance. You'll document every little thing you do, because you know future-you (or a colleague) will thank you for it.
• Benefit: Cybersecurity isn't about guesswork; it's about evidence. The initial alert is rarely the full story. This trait means you'll dig deeper, beyond the obvious, to understand what's *really* happening. That's how we stop the actual attack, not just a symptom, and prevent it from happening again.
• Trait: Productive Paranoia (Healthy Scepticism)
• Manifestation: You don't just trust that a system is 'fine' because someone said so. You'll check the logs yourself. When a user asks for 'temporary admin access,' you'll question *why* they need it, for *how long*, and what specific task it's for, even if it feels a bit awkward. You'll assume the worst, just in case, because that's how you find the holes.
• Benefit: Honestly, this is the bedrock of good security. If you assume everything is secure, you'll miss the glaring vulnerabilities. This mindset helps us find weaknesses before the bad guys do. It's not about being negative, it's about being smart and always verifying, which is crucial for protecting our systems.
• Trait: Calm Under Pressure
• Manifestation: When a critical alert goes off at 2 AM, and everyone's a bit stressed, you'll be the one who can still think straight. You'll follow the incident response playbook step-by-step, even when the boss is asking for updates every five minutes. You can make a sensible decision about whether to immediately shut something down or watch it for a bit longer, without panicking.
• Benefit: In a live incident, panic causes mistakes. Shutting down the wrong server, deleting crucial evidence, or making a rash decision can make a bad situation much worse. We need people who can keep their head, follow the process, and make logical decisions when the stakes are high. Your calm approach helps us recover faster and more effectively.

Supporting Traits

• Trait: Self-Directed Learner
• Desc: The cyber world changes constantly. You'll need to be the kind of person who's always looking up new threats, reading security blogs, and trying to understand how things work, even when no one's telling you to. It's about staying ahead of the curve.
• Trait: Articulate Translator
• Desc: You'll need to explain technical stuff to non-technical people. That means being able to tell a manager *why* a vulnerability is a problem, without using a load of jargon they won't understand. It's about getting your point across clearly.
• Trait: Resilient
• Desc: This job can be a bit of a rollercoaster. You'll deal with high-stress incidents, repetitive tasks (hello, false positives!), and sometimes, the frustration of users making the same mistakes. You need to be able to bounce back and not let it get to you.

Primary Motivators

1. Motivator: Protecting What Matters
2. Daily: You'll feel a genuine sense of purpose knowing your daily monitoring and investigations are directly contributing to safeguarding our company's data, systems, and reputation. It's about being the digital guardian.
3. Motivator: Continuous Learning & Growth
4. Daily: The cybersecurity landscape is always evolving, so you'll be constantly challenged to learn new attack techniques, defence strategies, and tools. If you love feeling like you're always expanding your knowledge, you'll fit right in.
5. Motivator: Solving Puzzles & Unravelling Mysteries
6. Daily: Every alert is a puzzle. You'll get to piece together clues from logs, network traffic, and endpoint data to figure out what happened, who did it, and how to stop it. It's like being a digital detective.

Potential Demotivators

Honestly, this role isn't for everyone. If you're someone who needs constant praise for every little thing, or you get easily frustrated by repetitive tasks, you might struggle. You'll spend a fair bit of time dealing with false positives—alerts that look scary but turn out to be nothing. Sometimes, you'll identify a problem, but getting it fixed can take ages because other teams have their own priorities. If you need to see immediate, tangible results from every single piece of work you do, you might find the pace of remediation frustrating. You'll also be on the receiving end of a lot of 'urgent' requests that turn out not to be so urgent after all. And let's be real, the bad guys don't always work 9-5, so there's an element of on-call or out-of-hours work sometimes.

Common Frustrations

1. Alert fatigue: Drowning in thousands of low-fidelity alerts from poorly tuned security tools, making it easy to miss the one that actually matters.
2. The 'Department of No': Constantly being seen as a blocker by development and business teams who prioritise speed over security, only to be blamed when something goes wrong.
3. Users are Gonna Click: The soul-crushing reality that despite hours of phishing training, someone will inevitably click the link and give up their credentials.
4. The Remediation Black Hole: Identifying a critical vulnerability and assigning it to a system owner, only to see the ticket sit unaddressed for months due to 'other priorities'.

What Role Doesn't Offer

1. A quiet, predictable 9-5 routine with no surprises.
2. Immediate high-level strategic influence on company-wide security posture.
3. Freedom from following established procedures and playbooks (at this level, they're your guide).
4. A role where you're always building new, shiny things (much of it is about maintenance and response).

ADHD Positives

1. The fast-paced nature of incident response and the constant stream of new alerts can be really engaging, providing novel stimuli.
2. Hyperfocus can be a superpower when diving deep into a complex log file or tracking an attacker's movements.
3. The need for quick, decisive action during an incident can be energising and play to strengths in rapid problem-solving.

ADHD Challenges and Accommodations

1. Alert fatigue from thousands of low-priority alerts can be overwhelming and lead to burnout; we can help by ensuring tools are tuned and you have clear prioritisation guidance.
2. Maintaining meticulous documentation can be a challenge; we use templates and automated tools to make this easier, and your Senior Analyst will review for completeness.
3. Sitting still for long periods monitoring dashboards might be tough; we encourage regular breaks, movement, and task switching where appropriate, and our office layout allows for standing desks.

Dyslexia Positives

1. Often excel at 'big picture' thinking and pattern recognition, which is brilliant for spotting unusual trends in security data that others might miss.
2. Strong verbal communication skills can be a real asset when explaining findings or escalating incidents to colleagues.
3. Creative problem-solving approaches can help when standard playbooks don't quite fit a novel attack scenario.

Dyslexia Challenges and Accommodations

1. Reading through vast amounts of log data can be taxing; we use SIEM tools with strong visualisation capabilities, colour-coding, and search functions to reduce text heavy analysis.
2. Writing detailed incident reports might take longer; we provide structured templates, offer dictation software, and your Senior Analyst can help with proofreading.
3. Memorising complex command syntax or IP addresses can be tricky; we encourage the use of cheat sheets, aliases, and robust documentation for common commands.

Autism Positives

1. A strong preference for logic, patterns, and objective data aligns perfectly with cybersecurity investigations.
2. Exceptional attention to detail can be invaluable for spotting subtle anomalies or inconsistencies in logs and network traffic.
3. Following established procedures and playbooks precisely is a core part of this role, which can be a comfortable and effective way to work.

Autism Challenges and Accommodations

1. Navigating ambiguous or rapidly changing situations during a live incident can be stressful; we provide clear escalation paths and structured incident response frameworks to follow.
2. Interpreting unspoken social cues in team meetings or during high-pressure incidents might be difficult; we encourage direct, clear communication and provide written summaries of key decisions.
3. Sensory overload from a busy SOC environment; we offer noise-cancelling headphones, quiet focus zones, and flexibility to work from home on certain days if needed.

Key Responsibilities

Experience Levels Responsibilities

1. Level: Entry Level (0-2 years)
2. Responsibilities: Monitor security dashboards and alert queues in our SIEM (Splunk, typically) for suspicious activity, making sure nothing slips through the cracks.
3. Execute initial triage and investigation of security alerts following our established playbooks—this means figuring out if it's a real threat or just a false alarm.
4. Assist Senior Analysts with ongoing incident response activities, which could mean gathering logs or running specific commands, under their guidance.
5. Document all your findings, investigation steps, and actions taken in our incident management system (ServiceNow usually), keeping things clear and concise.
6. Learn and apply new security concepts, tools, and techniques, especially around common attack vectors and our specific defence mechanisms.
7. Support vulnerability scanning by running pre-configured scans and helping to interpret the basic reports (like from Tenable.sc).
8. Participate in daily team stand-ups, sharing what you've been working on and any interesting (or confusing) alerts you've seen.
9. Supervision: You'll have daily check-ins with your Senior Security Analyst. All your investigation reports and decisions on critical alerts will be reviewed before they go anywhere. Think of it as having a safety net while you learn.
10. Decision: No independent decisions on critical incidents or system changes. You'll follow playbooks and escalate anything that isn't explicitly covered or that feels 'off' to your Senior Analyst. For routine alerts, you'll decide if it's a false positive or needs escalation, but even those decisions will be reviewed initially.
11. Success: Successfully triaging 95% of alerts accurately, adhering to playbook steps 100% of the time for standard incidents, and consistently meeting MTTA targets. Basically, getting the basics right, every single time, and showing a genuine eagerness to learn.

Decision-Making Authority

• Type: Incident Classification (True Positive vs. False Positive)
• Entry: Classify routine, low-severity alerts based on established playbooks. Escalate anything ambiguous or high-severity to Senior Analyst.
• Mid: Independently classify most Tier 1/2 incidents. Consult Senior Analyst on novel or complex cases.
• Senior: Independently classify all but the most critical or ambiguous incidents. Provide guidance to junior team members.
• Type: System Configuration Changes (e.g., Firewall rules)
• Entry: No authority. Escalate all requests to Senior Analyst or IT Operations.
• Mid: Propose minor, pre-approved changes for review. Cannot implement independently.
• Senior: Approve and implement technical changes within defined security policies. Consult Lead Engineer for architectural changes.
• Type: Tool Tuning (e.g., SIEM alert thresholds)
• Entry: No authority. Report noisy alerts or false positives to Senior Analyst for review and potential tuning.
• Mid: Propose specific tuning recommendations to Senior Analyst based on analysis of false positives.
• Senior: Independently tune SIEM alerts and rules within defined parameters to reduce noise and improve detection efficacy.
• Type: Communication with External Parties (e.g., Vendors, Law Enforcement)
• Entry: Absolutely no direct communication. All external contact must be handled by Senior Analyst or above.
• Mid: May communicate with internal IT teams or low-level vendors under supervision.
• Senior: Communicate with vendors and internal business units regarding technical aspects of incidents or vulnerabilities. External legal/PR comms still handled by leadership.

Competency Requirements

Foundation Skills (Transferable)

These are the bedrock skills you'll need to get started. Think of them as the basic toolkit for any cybersecurity professional. We're looking for common sense, a willingness to learn, and the ability to work with others.

• Category: Communication & Collaboration
• Skills: Clear Written Communication: Can write concise, understandable notes and emails, especially when escalating an issue.
• Verbal Communication: Can explain technical observations to a Senior Analyst without getting too lost in the weeds.
• Active Listening: Can listen to instructions and feedback carefully, asking clarifying questions when needed.
• Teamwork: Willing to help out colleagues and contribute positively to team discussions.
• Category: Problem-Solving & Critical Thinking
• Skills: Logical Reasoning: Can follow a sequence of steps to diagnose a problem, like tracing an IP address through logs.
• Troubleshooting Basics: Can identify simple causes of issues, like a service not running or a misconfigured setting.
• Attention to Detail: Notices small discrepancies in logs or reports that might indicate a larger issue.
• Category: Learning & Adaptability
• Skills: Eagerness to Learn: A genuine desire to understand new technologies, threats, and security concepts.
• Adaptability: Can adjust to new procedures or tools as the security landscape evolves.
• Self-Motivation: Can work independently on assigned tasks after receiving clear instructions.

Functional Skills (Role-Specific Technical)

These are the more specific technical skills you'll need. We don't expect you to be an expert, but a basic understanding and a willingness to learn are crucial. We'll teach you the specifics, but having a foundation helps.

Technical Competencies

• Skill: Incident Response Frameworks (NIST 800-61, PICERL)
• Desc: Understanding the basic steps of how we handle a security incident, from detecting it to getting things back to normal. You'll be following these playbooks.
• Level: Basic
• Skill: MITRE ATT&CK Framework
• Desc: Knowing what this framework is and how it helps us understand how attackers operate. You'll use it to categorise observed attacker behaviours.
• Level: Basic
• Skill: Basic Networking Concepts
• Desc: Understanding IP addresses, firewalls, and how computers talk to each other on a network. This helps you figure out where an attack might be coming from or going to.
• Level: Basic
• Skill: Operating System Fundamentals (Windows/Linux)
• Desc: Knowing your way around Windows and basic Linux commands. You'll be looking at logs and file systems on these, so a basic grasp is essential.
• Level: Basic
• Skill: Vulnerability Management Basics
• Desc: Understanding what a vulnerability is and why it matters. You'll be helping to identify them and get them assigned for fixing.
• Level: Basic

Digital Tools

• Tool: Splunk (or similar SIEM)
• Level: Basic
• Usage: Running pre-built SPL queries, monitoring dashboards for alerts, triaging alerts based on defined rules.
• Tool: CrowdStrike Falcon (or similar EDR)
• Level: Basic
• Usage: Investigating endpoint detections, viewing host details, initiating basic host containment actions under guidance.
• Tool: Tenable.sc / Nessus (or similar Vulnerability Scanner)
• Level: Basic
• Usage: Running pre-configured vulnerability scans, interpreting basic scan reports, assigning tickets for remediation.
• Tool: Microsoft Defender for Cloud / AWS Security Hub (or similar CSPM)
• Level: Basic
• Usage: Reviewing cloud security findings, following runbooks for common misconfigurations (e.g., public S3 buckets).
• Tool: ServiceNow (or similar IT Service Management)
• Level: Basic
• Usage: Creating, updating, and closing incident tickets, documenting investigation steps and actions taken.

Industry Knowledge

• Area: Common Cyber Attack Vectors
• Desc: Understanding what phishing, malware, ransomware, and basic denial-of-service attacks are, and how they typically work.
• Area: Basic Security Principles
• Desc: Knowing about concepts like confidentiality, integrity, and availability (the CIA triad) and why they're important in security.
• Area: Data Privacy Fundamentals
• Desc: A basic awareness of why protecting personal data is crucial and what could happen if it's not.

Regulatory Compliance Regulations

• Reg: GDPR (General Data Protection Regulation)
• Usage: Understanding that protecting personal data is legally required and knowing who to escalate to if a data breach is suspected.
• Reg: ISO 27001 (Information Security Management)
• Usage: Knowing that we have security policies and procedures in place, and that your role contributes to meeting these standards.

Essential Prerequisites

• A foundational understanding of IT systems and networking (e.g., from a college course, self-study, or a previous IT support role).
• Basic experience with command-line interfaces (CLI) in either Windows (PowerShell/CMD) or Linux.
• An analytical mindset—you enjoy figuring things out and connecting disparate pieces of information.
• A strong ethical compass; you understand the importance of integrity and confidentiality in this field.
• The ability to work effectively in a team, asking for help when needed and offering support to others.

Career Pathway Context

We're not expecting you to walk in as a seasoned pro, but a solid grasp of IT fundamentals will really help you hit the ground running. Think of it as knowing how to drive before you learn to race. If you've tinkered with home networks, built your own PC, or done some basic coding, that's a great start. What we really care about is your potential and your hunger to learn.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: Prompt Engineering for Security Tools
• Why: AI-powered assistants and tools are becoming standard in SOCs. Knowing how to ask the right questions (prompt engineering) to these tools will massively speed up investigations and reporting. Analysts who master this will be significantly more efficient.
• Concepts: [{'concept_name': 'Clear and concise prompting for context and intent', 'description': 'Clear and concise prompting for context and intent'}, {'concept_name': 'Iterative prompting to refine results', 'description': 'Iterative prompting to refine results'}, {'concept_name': "Understanding AI's limitations and 'hallucinations", 'description': "Understanding AI's limitations and 'hallucinations'"}, {'concept_name': 'Using AI for log analysis summarisation', 'description': 'Using AI for log analysis summarisation'}, {'concept_name': 'Generating incident report drafts with AI', 'description': 'Generating incident report drafts with AI'}]
• Prepare: This week: Start using ChatGPT or Claude to summarise security news articles.
• This month: Experiment with using AI to draft email responses for common security queries.
• Month 2: Try using an AI assistant (like GitHub Copilot) to help write simple Splunk queries or PowerShell scripts.
• Month 3: Document how AI has saved you time on at least two tasks and share with your Senior Analyst.
• QuickWin: Use AI to help you understand complex security concepts or summarise long technical documents. It's an instant learning accelerator.
• Skill: Basic Cloud Security Posture Awareness
• Why: More and more of our infrastructure is moving to the cloud (AWS, Azure, GCP). Understanding basic cloud security issues, like misconfigured storage buckets or insecure access controls, is becoming fundamental, even at an entry level.
• Concepts: [{'concept_name': 'Shared Responsibility Model in cloud security', 'description': 'Shared Responsibility Model in cloud security'}, {'concept_name': 'Common cloud misconfigurations (e.g., public S3 bu', 'description': 'Common cloud misconfigurations (e.g., public S3 buckets, open security groups)'}, {'concept_name': 'Basic identity and access management (IAM) in clou', 'description': 'Basic identity and access management (IAM) in cloud'}, {'concept_name': 'Understanding cloud logs (e.g., CloudTrail, Azure ', 'description': 'Understanding cloud logs (e.g., CloudTrail, Azure Activity Logs)'}, {'concept_name': 'Importance of least privilege in cloud environment', 'description': 'Importance of least privilege in cloud environments'}]
• Prepare: This week: Read a 'Cloud Security 101' blog post or watch an intro video on AWS/Azure security.
• This month: Get a free tier account on AWS or Azure and explore their security settings.
• Month 2: Learn about the 'shared responsibility model' and what it means for our cloud assets.
• Month 3: Try to identify common cloud misconfigurations in a test environment using a free tool or manual checks.
• QuickWin: Familiarise yourself with the names of common cloud services (EC2, S3, Azure VMs, Azure Storage) and their basic functions. It'll make conversations much easier.

Advancing Technical Skills

• Skill: Advanced SIEM Querying & Rule Creation
• Why: While AI helps, the ability to write complex, efficient queries in Splunk (or similar) to hunt for threats and create custom detection rules will remain a critical skill. This allows us to detect novel attacks that AI might not yet recognise.
• Concepts: [{'concept_name': 'Advanced SPL (Search Processing Language) commands', 'description': 'Advanced SPL (Search Processing Language) commands'}, {'concept_name': 'Optimising queries for performance', 'description': 'Optimising queries for performance'}, {'concept_name': 'Correlation rules and use cases', 'description': 'Correlation rules and use cases'}, {'concept_name': 'Data model tuning and normalisation', 'description': 'Data model tuning and normalisation'}, {'concept_name': 'Alert suppression and false positive reduction tec', 'description': 'Alert suppression and false positive reduction techniques'}]
• Prepare: This week: Take an online course on intermediate Splunk SPL.
• This month: Try to rewrite one of our existing basic queries to be more efficient.
• Month 2: Propose a new custom alert rule based on a recent threat intelligence report.
• Month 3: Work with a Senior Analyst to tune an existing noisy alert, documenting the process.
• QuickWin: Practice writing your own simple queries to answer specific questions about log data, even if it's just for personal learning.
• Skill: Basic Scripting for Automation (Python/PowerShell)
• Why: Automation is key to scaling security operations. Being able to write small scripts to automate repetitive tasks (like gathering data, enriching alerts, or performing basic response actions) will become essential for efficiency and career progression.
• Concepts: [{'concept_name': 'Variables, loops, and conditional statements', 'description': 'Variables, loops, and conditional statements'}, {'concept_name': 'Working with APIs (Application Programming Interfa', 'description': 'Working with APIs (Application Programming Interfaces)'}, {'concept_name': 'Basic data parsing (JSON, CSV)', 'description': 'Basic data parsing (JSON, CSV)'}, {'concept_name': 'Automating simple administrative tasks', 'description': 'Automating simple administrative tasks'}, {'concept_name': 'Error handling in scripts', 'description': 'Error handling in scripts'}]
• Prepare: This week: Complete a 'Python for Beginners' or 'PowerShell Fundamentals' online tutorial.
• This month: Write a script to automate a task you do manually every day (e.g., parsing a log file).
• Month 2: Experiment with using a simple API (like VirusTotal's public API) in your script.
• Month 3: Share a small, useful script with your team for feedback and potential use.
• QuickWin: Learn how to write a basic script that can read a file and print specific lines based on a keyword. It's a small step, but a powerful one.

Education Requirements

• Level: Minimum
• Req: A-Levels (or equivalent) in a STEM subject (e.g., Computing, Maths, Science)
• Alts: Alternatively, a Level 3/4 apprenticeship in IT or Cybersecurity, or demonstrable equivalent professional experience (e.g., 1-2 years in IT support with a strong interest in security).
• Level: Preferred
• Req: A Bachelor's degree (or equivalent) in Cybersecurity, Computer Science, or a related technical field.
• Alts: While a degree is great, we value practical skills and a proven ability to learn just as much. If you've got a strong portfolio of self-taught projects or relevant work experience, we'd still love to hear from you.

Experience Requirements

You'll need 0-2 years of experience. This could be from an internship, a graduate programme, or a previous role in IT support, network administration, or a similar technical field where you've gained a foundational understanding of IT systems and a keen interest in security. We're looking for potential and a solid grasp of the basics, not decades of experience.

Preferred Certifications

• Cert: CompTIA Security+
• Prod: CompTIA
• Usage: This certification covers fundamental security concepts, network security, threats, and vulnerabilities. It's a fantastic baseline for any entry-level security role and shows you've got the foundational knowledge.
• Cert: CompTIA CySA+
• Prod: CompTIA
• Usage: Focuses on security analytics, threat detection, and incident response. If you've got this, it shows you're already thinking like an analyst, which is a big plus.
• Cert: Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900)
• Prod: Microsoft
• Usage: Great for showing a basic understanding of Microsoft's cloud security offerings, which is increasingly relevant as more companies move to Azure.

Recommended Activities

• Participating in online cybersecurity challenges or 'Capture The Flag' (CTF) events to practice your skills.
• Following reputable cybersecurity blogs, podcasts, and news outlets to stay current on threats.
• Attending local cybersecurity meetups or webinars to network and learn from others.
• Contributing to open-source security projects (even small contributions count!).
• Setting up a home lab to experiment with security tools and concepts in a safe environment.

Career Progression Pathways

Entry Paths to This Role

• Path: Graduate Programme (Cybersecurity Focus)
• Time: 1-2 years
• Path: IT Support / Helpdesk Specialist
• Time: 1-3 years in IT support
• Path: Self-Taught Enthusiast / Hobbyist
• Time: Variable, often 1-2 years of dedicated self-study

Career Progression From This Role

• Pathway: Security Analyst (Level 2)
• Time: 2-3 years in the Associate role

Long Term Vision Potential Roles

• Title: Senior Security Analyst / Incident Responder (L3)
• Time: 5-8 years from entry
• Title: Lead Security Engineer / Threat Hunter (L4)
• Time: 8-12 years from entry
• Title: Security Manager / Principal Security Architect (L5)
• Time: 12-16 years from entry

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.