Retaining Your Best IT Analysts, Employees, and Company Knowledge

Abstract:

The role of a SOC analyst is not an easy one. Repetitive tasks, burnout, and constantly evolving cyber threats are rampant, and it’s been leading to a skills gap in the cybersecurity industry. Thankfully, AI-Assisted Cybersecurity is here to help. This is a tool that alleviates the workload of cybersecurity analysts by assisting decision and automatepost-decision manual tasks. The tool works in tandem with your SOC team, harnessing their collective knowledge to analyze threats, streamlines and enhances the work of your SOC analysts throughout all the phases of threat detection and negation, and relies on human and machine synergy as a key component of the successful SOC to enhance your cybersecurity department.
It’s been a challenging few years for SOC analysts. Between the pandemic, decreasing budgets, uncertain company futures, and the growth of remote work (which could mean potential unsecured endpoints), security professionals have been overworked and overwhelmed.
But is this inevitable? Is this the new normal of cybersecurity work in a SOC? It doesn’t have to be. There are ways to ensure that you retain your talent and strengthen your security posture.

‍

Can’t Take it Anymore

There are amyriad of reasons why analysts are leaving their jobs and/or their cybersecurity careers behind. To quickly summarize, the reason for quitting was one, or all, of these reasons:

Alert fatigue and burnout.
Too many repetitive and mundane tasks.
No visibility or alignment between the organization and the SOC.
Financial considerations.
Lack of growth, professional investment, or leadership.

This leads to a significant cybersecurity skills gap in the security operations centers that’s only been growing over the past half-decade. This leads to increased job openings, more job seekers, more workload for the existing staff, and a significant amount of risk for CISOs who can’t keep their SOCs running.
Intuitively, the first question that comes to mind is why not go on an aggressive hiring spree to fill the pipeline with new analyst recruits. But, it’s not that simple. Recruitment is hampered by several factors including:

Very little, to no, apprenticeship-style opportunities within the cybersecurity field to assist with education and recruitment.
There’s a lack of a clearly-defined career path.
Businesses fail to take into account the time it takes to train new security staff. On average, it can take between 3-5 years for true cybersecurity proficiency.
Hiring managers (50%) have found that they generally don’t believe that their applicants are qualified for the roles.
Seasoned analysts are not immune to the pressures either, with an average of 30 months spent in a SOC analyst role, before burning out.

Therefore, hiring entry-level staff is not the immediate fix an organization would hope for. Instead, they need to focus inwards and upskill their teams.

‍

Listen to Your Analysts

The first job of a SOC manager and even the CISO is to listen to those they are responsible for and facilitate a productive and optimal workplace. The analysts are dealing with the day-to-day responsibilities of the SOC, and they know what they need. They’re also susceptible to burnout and the aforementioned alarm fatigue.

This means finding ways to manage their stress, ensuring a proper work/life balance, and finding resources to help them automate their workflows, address critical issues faster, and help them to focus on improving their skillset. By paying attention, leaders will create a more successful SOC, from both a skills retention and performance perspective, which creates a stronger overall security position.

‍

Address The Skills Gap

When we talk about the skills gap, the meaning is two-fold. On one hand, as mentioned above, there is a shortage of cybersecurity personnel in general. On the other hand, there is also a shortage of personnel with the right skill set to deal with emerging technologies and channels and the latest methods of cyber-intrusions.

When organizations look to digitize and move a lot of their infrastructure into the cloud, remote workplaces, and mobile devices, there needs to be qualified analysts to stand at the ready. It’s more than just manning a station in the SOC, but being a proactive analyst and engineer who’s constantly honing their skills and updating processes to prevent attacks. This means that Security departments have to be creative with their budgets and how they fill roles. Most importantly, they need to ensure that they’re hiring for the modern SOC.

This means problem solvers, those that think out of the box, who will pound away at a problem until it’s solved, and use creativity, according to Palo Alto Networks. At present, automation and technology are capable of handling the routine and rote stuff, and can always be made smarter with AI to improve processes. In the meantime, the analysts can remain free and focused on tackling the challenges that future cyberattacks will bring and address elements that machine learning can’t.

‍

Treasure The People You Already Have

Highly trained SecOps staff are very valuable. When it comes to their career trajectory, they can essentially write their own ticket. The ISC found that 27% of new hires come from other companies in their industry, while a separate study by the ISSA found that 44% of analysts are solicited by a recruiter at least once a week, while 76% are approached monthly. To keep them happy in their SOC, and ensure that they avoid getting headhunted and poached, you need to make sure that your staff is at the forefront of emerging trends and methodologies and ensure that you acknowledge their contributions.

A critical way to do this is by ensuring that training sessions are constant, consistent, and mandatory. A study conducted by the ISSA found that 96% of cybersecurity professionals felt that their organization faced a significant disadvantage against cyber adversaries because there wasn’t an organizational focus on upskilling. Of that same group, 66% admitted that they’re too busy with daily tasks to keep up their skills and seek out further training.

‍

Look to Automation and Technology, But Not Too Much

Automation is important, and a key to superstar retention and preventing burnout and fatigue, but it should be used in support of the people in your SOC, not as a replacement.

According to Ponemon:

67% of IT security leaders believe that automation isn’t capable of doing tasks that IT security staff can do.
55% say that automation will never replace intuition and hands-on experience
51% says that human intervention is necessary for network protection
46% automation will add complexity to jobs.

Except, these aren’t the views of the modern SOC; not by a long shot. Today, automation and technology tools are critical in maintaining a strong barrier against outside intrusions. But automation also serves to ensure that your best IT analysts remain focused and on-task for years to come, preparing for the unexpected. The key is that the analysts in your organization face cyber threats with intelligence, intuition, experience, and knowledge while leaving the mundane and routine to the AI and automation tools. This is where AI-Assisted Cybersecurity is critical for a security team. The best SOC analyst team is the one that has analysts and automation working hand in hand.

‍

AI-Assisted Cybersecurity is Human/Machine Synergy

This is where AI-Assisted Cybersecurity comes into play. AI-Assisted Cybersecurity offers a unique approach that promises to streamline security operations and reduce repetitive actions. The tool works in tandem with your SOC team, harnessing their collective knowledge to analyze threats via Deep Learning. This alleviates the workload of cybersecurity analysts by assisting decision makingand automating post-decision manual tasks. Together, the SOC team and AI-Assisted Cybersecurity keep your cybersecurity bubble closed.

In its simplest form, AI-Assisted Cybersecurity, is a hybrid approach to cybersecurity where humans and AI work together to improve efficiency in security operations by integrating cybersecurity expert knowledge within AI models and enabling analysts to validate AI results. This frees up analysts to focus on managing their workloads, have time for upskilling, and focus on the nebulous world of evolving cyberattacks, and elements that machine learning can’t.

When an alert is triggered, the AI-Assisted Cybersecurity system analyzes it and determines a course of action. The system also creates a ticket, adds threat intel, and the outcome is reviewed by an analyst, and feedback is given. The system then adds this learning into its processes. The platform also takes care of the post-decision manual tasks such as ticket creation or SOAR playbook triggering, so the analysts can focus on more pressing duties, and prepare for the next malicious activity.

Think of AI-Assisted Cybersecurity as the SOC analysts’ “driver assist” that continuously learns from existing enterprise cybersecurity experts and scales the SOC team’s capacity to deal with cybersecurity threats by assisting their decision-making. Tools such as Arcanna.ai offer the ability to:

Scale capacity to handle and address threats by leveraging collective knowledge to assist decision-making.
Aggregate and scale expert knowledge by collecting and consolidating expert knowledge within the AI model.
Automate alert handling to reduce noise by streamlining alert handling, ensuring incidents are escalated properly.
Improve operational efficiency through automation by leveraging institutional knowledge to improve automation with AI.

Given the tighter constraints of company operations and budgets, an AI-Assisted Cybersecurity offers a solution that is compatible with whatever cybersecurity systems are already in place - it doesn’t replace them but enhances them.

As a result, AI-Assisted Cybersecurity offers organizations and SOC the leeway of allowing their staff to focus on upskilling and enjoying the work that they do. By streamlining and enhancing the work of your SOC analysts throughout all the phases of threat detection and negation, the model becomes an integral part of your team. Along the way, as your team grows, both in number and capabilities, AI-Assisted Cybersecurity technologies and Arcanna.ai will continue to adapt and learn and offer new opportunities to enhance your security parameters.

‍