The scoreboard, and what is not on it. The hard targets, how often each is actually
looked at, and the quiet signals that never reach a dashboard.
Detection Rule Efficacy
The percentage reduction in manual investigation time for specific alert types after implementing new detection rules you've designed.
Target · Reduce manual investigation time by at least 15% for 3-5 key alert types per quarter. After implementing a new Splunk rule for 'suspicious PowerShell activity', the average time an L2 analyst spends investigating these alerts drops from 30 minutes to 10 minutes, saving roughly 20 hours per month across the team.
Mean Time to Respond (MTTR) for Complex Incidents
The average time it takes from initial detection to full containment and eradication for major security incidents you've led.
Target · Maintain MTTR for critical incidents below 72 hours, aiming for under 48 hours for common attack vectors. During a ransomware scare, you led the response, containing the spread and eradicating the threat within 36 hours, well within our target.
Team Mentorship & Development
The number of junior or mid-level analysts you've directly mentored who take on new responsibilities, lead minor incidents, or receive promotions.
Target · At least two mentored L1/L2 analysts demonstrate significant growth (e.g., promotion, leading a small project) within 18 months. One of your mentees, an L2 analyst, successfully led the response to a complex phishing campaign from start to finish, something they couldn't have done six months ago.
Process Improvement Adoption
The percentage of new or updated incident response playbooks and procedures you've designed that are actively adopted and followed by the team.
Target · Achieve 90% adoption and adherence for all new playbooks within one month of release. You updated the 'Malware Outbreak' playbook, and within weeks, every analyst was following the new steps, leading to faster containment times.
Strategic Influence
Your ability to influence senior stakeholders on security architecture, tool selection, and strategic defence priorities.
- You're regularly invited to architecture review boards, your opinions are sought on new security tool investments, and your proposals for improving our security posture are often adopted by leadership.
Threat Hunting Maturity
The sophistication and impact of your proactive threat hunting efforts, moving beyond basic IOC matching to behavioural analysis.
- You regularly uncover previously undetected malicious activity, develop novel hunting queries that are shared across the team, and contribute to a more proactive security posture.
Incident Leadership & Clarity
Your ability to remain calm, provide clear direction, and manage complex information during high-stress security incidents.
- During a major incident, you're seen as the steady hand, providing clear technical guidance, delegating effectively, and communicating incident status concisely to management.
Knowledge Sharing & Documentation
The quality and impact of the technical documentation, playbooks, and training materials you create to uplift the team's capabilities.
- Your playbooks are considered the 'gold standard', junior analysts frequently refer to your documentation, and you regularly run internal training sessions that improve team skills.
