When an attack is underway, someone has to see it in the noise — sifting alerts, logs, and signals to spot and investigate the real threats. That's the threat analyst. Separating real attacks from the noise.
The day runs on monitoring and investigation — triaging alerts, digging into suspicious activity, correlating signals, and deciding what's benign and what's an actual threat. You sit in the defensive line, often under time pressure, and most alerts are noise hiding the few that aren't. Much of the craft is knowing what's worth chasing.
The role shifts by environment. In a busy SOC, the alert volume can be punishing and shift work common; on a smaller team, you wear more hats and own more of the response. Attacker tactics change constantly, alert fatigue is real, and missing the one that matters carries real weight. For many, the strain is constant vigilance against a flood of false alarms.
It tends to suit the curious and pattern-minded — people who can stay alert through tedium and pounce when something's off. If you want to build or to break in, defensive monitoring may feel reactive. But if being the one who catches the attack early appeals, the work sits at the heart of real defense.
Still figuring out what you want to become
when you grow up?
Where this role sits in the broader career landscape — and where it can take you.
It's your career.
Take the wheel.
Roles like this one sit within a broader occupational category. The numbers below reflect that full landscape — helpful for context, but your specific experience will depend on level, specialty, and where you work.
No skills data available
Roles with similar work and overlapping career paths
View all Technology roles →When an attack is underway, someone has to see it in the noise — sifting alerts, logs, and signals to spot and investigate the real threats. That's the threat analyst. Separating real attacks from the noise.
Median pay for a Cyber Threat Analyst is about $109K nationally, with the field ranging roughly from $53K to $177K depending on experience, employer, and metro (BLS).
Employment in this field is projected to grow about 8.2% through 2034, with roughly 439,380 people working in it today (BLS).
Closely related roles include Security Management Consultant, IAM Consultant (Identity and Access Management Consultant), and Security Analyst.
Turn your career record
into a springboard for growth.