Security

Analysis

—

Technical

Skills

CONT ENT S

Network

Infrastructure

Security

Analysis

SIEM

Log

Analysis

Detection

Engineering

Threat

Hunting

Forensics

Incident

Response

Vulnerability

Management

Security

Assessment

Endpoint

Operating

System

Analysis

Cloud

Container

Identity

Security

Analysis

Cyber

Threat

Intelligence

Threat

Modeling

Cryptography

Secure

Communications

Scripting

Automation

Data

Analysis

10.

Governance

Risk

Compliance

Analysis

11.

Analytical

Methods

Core

Frameworks

12.

Tooling

Matrix

13.

Proficiency

Scale

14.

Certifications

Validation

Network

Infrastructure

Security

Analysis

Reading

the

wire

capturing

decoding

and

baselining

network

traffic

detect

command

and

control

exfiltration

and

lateral

movement

Packet

capture

and

protocol

analysis

—

Wireshark

tshark

tcpdump

A D VA NC ED

Deep

packet

inspection

and

protocol

decoding

(

HTTP

/2,

QUIC

TLS

1.3,

SMB

DNS

SMTP

)

A D VA NC ED

Network

flow

analysis

and

traffic

baselining

(

NetFlow

IPFIX

sFlow

)

WORKING

IDS

IPS

signature

analysis

tuning

and

evasion

testing

(

Snort

Suricata

Zeek

scripts

)

A D VA NC ED

Beaconing

and

tunnelling

detection

—

fingerprinting

DNS

tunnelling

domain

fronting

A D VA NC ED

Firewall

policy

review

rule

hygiene

and

zone

segmentation

audits

(

Palo

Alto

Fortinet

AWS

)

WORKING

Secure

web

gateway

and

proxy

log

analysis

(

Zscaler

Netskope

Squid

)

WORKING

Wireless

security

assessment

(802.11

WPA

rogue

and

evil

twin

detection

)

FOU ND AT IONA L

PCAP

driven

root

cause

analysis

for

security

and

availability

incidents

A D VA NC ED

Tooling

Wireshark

Zeek

Suricata

Arkime

ntopng

Palo

Alto

Panorama

Zscaler

1 / 8

Security Analysis Technical Skills — page 2

SIEM

Log

Analysis

Detection

Engineering

Turning

raw

telemetry

into

tuned

documented

MITRE

mapped

detections

with

measurable

signal

quality

Splunk

SPL

data

models

and

Enterprise

Security

correlation

searches

A D VA NC ED

Microsoft

Sentinel

KQL

analytics

rules

workbooks

and

Logic

Apps

playbooks

A D VA NC ED

Elastic

Stack

querying

and

index

management

(

Elasticsearch

Logstash

Kibana

)

WORKING

Log

source

onboarding

parsing

and

normalization

(

syslog

CEF

LEEF

JSON

Windows

Event

Forwarding

)

A D VA NC ED

Detection

code

with

Sigma

rules

and

validation

pipelines

WORKING

MITRE

ATT

mapping

and

coverage

gap

analysis

(

ATT

Navigator

)

A D VA NC ED

Alert

triage

deduplication

and

false

positive

reduction

workflows

EXPERT

Detection

use

case

lifecycle

requirements

build

tune

retire

document

A D VA NC ED

Baselining

and

behavioural

analytics

—

UEBA

statistical

outlier

and

peer

group

deviation

WORKING

Tooling

Splunk

Enterprise

Security

Microsoft

Sentinel

Elastic

Security

Sumo

Logic

Panther

Sigma

Threat

Hunting

Forensics

Incident

Response

Hypothesis

driven

hunting

through

full

DFIR

casework

—

collection

timeline

reconstruction

and

evidence

backed

reporting

Hypothesis

driven

hunting

frameworks

(

PEAK

TaHiTI

)

and

hunt

documentation

A D VA NC ED

IOC

and

TTP

based

hunting

across

endpoint

network

and

identity

telemetry

A D VA NC ED

DFIR

triage

and

live

response

collection

(

KAPE

Velociraptor

CyLR

EDR

shell

access

)

A D VA NC ED

Memory

forensics

and

process

analysis

(

Volatility

Rekall

)

WORKING

Disk

and

file

system

forensics

(

Magnet

AXIOM

EnCase

FTK

Autopsy

Sleuth

Kit

)

WORKING

Timeline

reconstruction

and

artefact

correlation

(

Plaso

Timesketch

log

timeline

)

A D VA NC ED

Malware

triage

and

reversing

fundamentals

(

Ghidra

IDA

Free

dbg

CAPE

YARA

)

WORKING

Ransomware

and

business

compromise

playbook

execution

A D VA NC ED

Incident

scoping

containment

eradication

recovery

and

post

incident

review

A D VA NC ED

Chain

custody

evidence

handling

and

forensic

reporting

standards

WORKING

Tooling

Velociraptor

KAPE

Volatility

3 ·

Timesketch

Cyber

Triage

Magnet

AXIOM

YARA

2 / 8

Security Analysis Technical Skills — page 3

Vulnerability

Management

Security

Assessment

Finding

scoring

validating

and

driving

remediation

—

from

asset

discovery

exception

governance

Authenticated

and

unauthenticated

vulnerability

scanning

(

Tenable

Nessus

Qualys

VMDR

Rapid

InsightVM

)

A D VA NC ED

CVSS

3.1 /

4.0

scoring

with

EPSS

and

CISA

KEV

based

prioritization

A D VA NC ED

Remediation

tracking

SLAs

and

risk

acceptance

workflows

(

Kenna

Security

Vulcan

Cyber

)

WORKING

Configuration

and

hardening

assessment

(

CIS

Benchmarks

CIS

CAT

Pro

SCAP

)

WORKING

Web

application

testing

(

Burp

Suite

Pro

OWASP

ZAP

OWASP

Top

10)

WORKING

API

security

assessment

(

burp

Postman

OWASP

API

Security

Top

10)

FOU ND AT IONA L

SAST

DAST

and

SCA

integration

(

Semgrep

Checkmarx

Snyk

Trivy

)

WORKING

Attack

surface

discovery

and

external

exposure

review

(

Shodan

Censys

Cymulate

ASM

)

WORKING

Penetration

test

scoping

coordination

and

finding

validation

FOU ND AT IONA L

Tooling

Tenable

Qualys

Rapid

7 ·

Burp

Suite

Semgrep

Trivy

Nuclei

Endpoint

Operating

System

Security

Analysis

Host

level

evidence

across

Windows

Linux

and

macOS

—

persistence

privilege

escalation

and

execution

artefacts

EDR

administration

detection

tuning

and

policy

management

(

CrowdStrike

Falcon

SentinelOne

Defender

for

Endpoint

)

A D VA NC ED

Windows

internals

analysis

—

registry

WMI

services

scheduled

tasks

Sysmon

A D VA NC ED

Windows

event

log

analysis

(4624/4625, 4688, 4720, 5140, 7045)

A D VA NC ED

PowerShell

logging

AMSI

telemetry

and

script

block

analysis

A D VA NC ED

Linux

analysis

—

auditd

journald

eBPF

, /

proc

artefacts

cron

and

systemd

units

WORKING

macOS

analysis

—

unified

logs

launchd

TCC

database

XProtect

Endpoint

Security

framework

FOU ND AT IONA L

Living

off

the

land

binary

and

LOLBAS

abuse

detection

A D VA NC ED

Persistence

privilege

escalation

and

lateral

movement

artefact

analysis

A D VA NC ED

Application

allowlisting

and

host

hardening

validation

(

AppLocker

WDAC

SELinux

)

WORKING

Tooling

CrowdStrike

Falcon

Microsoft

Defender

XDR

Sysmon

OSQuery

Autoruns

Sysinternals

Suite

3 / 8

Security Analysis Technical Skills — page 4

Cloud

Container

Identity

Security

Analysis

Cloud

native

telemetry

posture

review

and

identity

centric

investigation

across

AWS

Azure

365

and

GCP

AWS

threat

detection

and

log

forensics

(

GuardDuty

CloudTrail

VPC

Flow

Logs

Security

Hub

)

A D VA NC ED

Azure

and

Microsoft

365

investigation

(

Defender

for

Cloud

Apps

Entra

sign

and

audit

logs

Purview

)

A D VA NC ED

GCP

security

telemetry

(

Security

Command

Center

Cloud

Audit

Logs

)

FOU ND AT IONA L

Cloud

posture

and

workload

protection

CSPM

CWPP

(

Wiz

Prisma

Cloud

Lacework

)

WORKING

IAM

policy

and

permission

analysis

including

privilege

escalation

path

review

WORKING

Kubernetes

and

container

runtime

security

(

Falco

Trivy

kube

bench

OPA

Gatekeeper

)

WORKING

Active

Directory

attack

path

analysis

(

BloodHound

Kerberoasting

DCSync

Golden

Ticket

detection

)

A D VA NC ED

Identity

analytics

—

impossible

travel

MFA

fatigue

token

theft

and

consent

phishing

detection

A D VA NC ED

Cloud

incident

response

snapshot

acquisition

log

preservation

cross

account

forensics

WORKING

Tooling

AWS

GuardDuty

CloudTrail

Microsoft

Defender

for

Cloud

Entra

Protection

Wiz

Falco

BloodHound

Cyber

Threat

Intelligence

Threat

Modeling

Producing

intelligence

that

changes

detection

priorities

—

collection

analysis

dissemination

and

feedback

Intelligence

lifecycle

management

—

PIRs

collection

planning

production

feedback

WORKING

OSINT

dark

web

and

credential

leak

monitoring

WORKING

CTI

platform

operations

(

MISP

OpenCTI

Recorded

Future

ThreatConnect

)

WORKING

STIX

2.1 /

TAXII

sharing

and

indicator

lifecycle

management

WORKING

Analytic

frameworks

—

MITRE

ATT

Diamond

Model

Cyber

Kill

Chain

Pyramid

Pain

A D VA NC ED

Threat

actor

profiling

campaign

tracking

and

attribution

assessment

WORKING

Threat

modeling

(

STRIDE

PASTA

attack

trees

ATT

based

modelling

)

WORKING

Adversary

emulation

planning

(

Atomic

Red

Team

MITRE

Caldera

)

FOU ND AT IONA L

Intelligence

driven

detection

prioritization

and

stakeholder

reporting

A D VA NC ED

Tooling

MISP

OpenCTI

Recorded

Future

VirusTotal

Enterprise

ATT

Navigator

Caldera

4 / 8

Security Analysis Technical Skills — page 5

Cryptography

Secure

Communications

Evaluating

cryptographic

implementation

key

handling

and

authentication

protocols

for

real

world

weaknesses

TLS

SSL

configuration

analysis

(

testssl

sslscan

Qualys

SSL

Labs

)

WORKING

Certificate

lifecycle

and

PKI

operations

(

ACME

OCSP

CRL

HSM

KMS

concepts

)

WORKING

Cryptographic

protocol

review

—

TLS

1.3,

IPsec

SSH

MIME

WORKING

Key

management

and

secrets

handling

(

HashiCorp

Vault

AWS

KMS

Azure

Key

Vault

)

WORKING

Hashing

HMAC

signature

verification

and

file

integrity

monitoring

WORKING

Authentication

protocols

—

SAML

2.0,

OAuth

2.0 /

OIDC

Kerberos

RADIUS

WORKING

Cryptographic

weakness

detection

—

weak

ciphers

key

reuse

broken

certificate

chains

A D VA NC ED

Data

rest

and

data

transit

protection

review

WORKING

Tooling

testssl

OpenSSL

HashiCorp

Vault

AWS

KMS

Step

Wireshark

TLS

decryption

Scripting

Automation

Data

Analysis

Building

the

tooling

that

shortens

triage

time

—

enrichment

correlation

reporting

and

SOAR

playbooks

Python

for

security

automation

(

requests

pandas

scapy

regex

YARA

)

A D VA NC ED

PowerShell

and

Bash

for

triage

enrichment

and

remediation

tasks

A D VA NC ED

Query

languages

—

SPL

KQL

Elastic

DSL

SQL

A D VA NC ED

SOAR

engineering

and

playbook

development

(

Cortex

XSOAR

Splunk

SOAR

Tines

Torq

)

WORKING

API

integration

—

REST

GraphQL

webhooks

and

enrichment

pipelines

WORKING

Regular

expressions

and

large

scale

log

parsing

A D VA NC ED

Jupyter

notebooks

for

repeatable

analysis

and

visualization

WORKING

Version

control

and

for

detection

content

(

Git

GitHub

Actions

pytest

)

WORKING

Metrics

automation

and

dashboarding

(

Splunk

Grafana

Power

)

WORKING

Tooling

Python

3.12 ·

PowerShell

7 ·

Git

Jupyter

Cortex

XSOAR

Tines

Grafana

5 / 8

Security Analysis Technical Skills — page 6

Governance

Risk

Compliance

Analysis

Mapping

technical

findings

control

frameworks

regulatory

obligations

and

measurable

risk

statements

Framework

application

—

NIST

CSF

2.0,

NIST

800-53, 800-61, 800-171

WORKING

ISO

IEC

27001

and

27035

incident

management

alignment

WORKING

Regulatory

mapping

—

PCI

DSS

4.0,

HIPAA

SOX

GDPR

CCPA

WORKING

CIS

Critical

Security

Controls

implementation

and

assessment

WORKING

Risk

assessment

and

treatment

methods

(

FAIR

OCTAVE

NIST

RMF

)

WORKING

Control

testing

evidence

collection

and

audit

support

WORKING

Security

policy

standard

and

procedure

authoring

WORKING

Metrics

KPIs

and

KRIs

for

executive

and

board

reporting

WORKING

Third

party

and

vendor

security

assessment

questionnaire

review

WORKING

Tooling

ServiceNow

GRC

Archer

Vanta

Drata

OneTrust

CIS

CAT

Pro

Analytical

Methods

Core

Frameworks

The

reasoning

and

communication

skills

that

determine

whether

technical

finding

actually

reduces

risk

Root

cause

analysis

Whys

fishbone

fault

tree

)

A D VA NC ED

Attack

chain

and

attack

graph

reconstruction

A D VA NC ED

Hypothesis

testing

and

structured

analytic

techniques

A D VA NC ED

Baseline

deviation

and

statistical

anomaly

detection

WORKING

Evidence

based

reasoning

and

calibrated

confidence

language

(

ICD

203)

A D VA NC ED

Data

visualization

for

incident

narratives

and

trend

reporting

WORKING

Technical

writing

—

incident

reports

runbooks

detection

documentation

A D VA NC ED

Peer

review

and

quality

assurance

analytic

products

WORKING

Tabletop

exercise

design

facilitation

and

after

action

review

WORKING

Tooling

Attack

Navigator

Maltego

Miro

Jira

Confluence

Splunk

Dashboards

6 / 8

Security Analysis Technical Skills — page 7

Tooling

Matrix

—

Domain

Platform

DOMAIN

PRIMARY

TOOLING

TYPICAL

LEVEL

Network

analysis

Wireshark

Zeek

Suricata

Arkime

NetFlow

collectors

Advanced

SIEM

detection

Splunk

Microsoft

Sentinel

Elastic

Security

Sigma

Advanced

DFIR

hunting

Velociraptor

KAPE

Volatility

Timesketch

YARA

Advanced

Vulnerability

mgmt

Tenable

Qualys

VMDR

Rapid

Kenna

Burp

Suite

Advanced

Endpoint

security

CrowdStrike

Falcon

Defender

XDR

SentinelOne

Sysmon

Advanced

Cloud

security

AWS

GuardDuty

Defender

for

Cloud

Wiz

Falco

Working

Identity

security

Entra

Protection

BloodHound

Okta

CyberArk

Advanced

Threat

intelligence

MISP

OpenCTI

Recorded

Future

VirusTotal

Enterprise

Working

Cryptography

OpenSSL

testssl

HashiCorp

Vault

AWS

KMS

Working

Automation

Python

PowerShell

Cortex

XSOAR

Tines

Git

Advanced

GRC

compliance

ServiceNow

GRC

Vanta

CIS

CAT

Pro

Archer

Working

Proficiency

Scale

LEVEL

DEFINITION

EVIDENCE

Foundational

Understands

core

concepts

;

performs

tasks

with

supervision

and

clear

procedures

Coursework

labs

supervised

tickets

entry

level

certification

Working

Operates

independently

routine

work

;

identifies

when

escalate

ambiguous

cases

1–3

years

production

use

role

certification

call

rotation

Advanced

Designs

solutions

tunes

complex

systems

mentors

peers

and

leads

investigations

end

3–6

years

authored

detections

playbooks

led

major

incident

Expert

Recognized

authority

;

sets

organizational

standards

and

consulted

across

teams

years

framework

ownership

conference

talks

published

research

How

read

this

document

level

assigned

per

skill

not

per

person

Any

individual

profile

expected

span

three

levels

with

depth

concentrated

two

three

domains

rather

than

evenly

distributed

across

all

eleven

7 / 8

Security Analysis Technical Skills — page 8

Certifications

Validation

Credentials

commonly

used

validate

the

skills

listed

above

GIAC

(

SANS

GCIH

—

Incident

Handler

GCIA

—

Intrusion

Analyst

GCFA

—

Forensic

Analyst

GNFA

—

Network

Forensic

Analyst

GPEN

—

Penetration

Tester

ISC

CISSP

CCSP

SSCP

CompTIA

Security

+ ·

CySA

+ ·

CASP

+ /

SecurityX

OffSec

OSCP

OSDA

OSWA

Microsoft

-200

Security

Operations

Analyst

-100

Cybersecurity

Architect

-500

Azure

Security

Engineer

Cloud

AWS

Certified

Security

–

Specialty

Google

Professional

Cloud

Security

Engineer

Vendor

platforms

Splunk

Certified

Power

User

Admin

Elastic

Certified

Analyst

CrowdStrike

Certified

Falcon

Administrator

Governance

CISM

CISA

CRISC

8 / 8

Security Analysis Technical Skills

Prompt to Clone This Security Analysis Technical Skills

Apply this example's core structure, strategic pacing, and structural hierarchy directly to your own topic.

What are you generating today?

Civil Engineering Technical Skills

Electrical Engineering Technical Skills

Electronics Engineering Technical Skills

Chemical Engineering Technical Skills

Industrial Engineering Technical Skills

Manufacturing Technical Skills

Automotive Engineering Technical Skills

Robotics Technical Skills

Automation Technical Skills

Similar Examples