SOC AI survey: entry-level analyst jobs getting harder

Security operations staff say AI has made their work more satisfying, but many of them expect the first step into the profession to become harder to reach, according to a new Swimlane survey.

The company polled 500 people working in security operations centers (SOCs), the teams that monitor an organization's systems and respond to security alerts. All respondents work at organizations that already use AI.

Nearly nine in ten said AI has made their jobs more satisfying. About a quarter said it has held back their ability to build security skills. Those analysts were just as happy as the rest: 91% reported higher satisfaction, compared with 92% among those who said AI helped them learn.

Repetitive work was also the training

Junior SOC analysts have traditionally learned through repetition. They work through the same phishing lures many times, chase familiar malware patterns and write similar case notes at the end of each shift. Over time this builds a sense of what normal activity looks like, and that is how they spot when something is off.

AI tools now take over much of that routine work, and analysts welcome the change. However, satisfaction numbers alone do not show whether someone is developing into a senior investigator or simply enjoying a lighter workload while the skills needed for promotion stall. The report advises SOC managers to measure skills separately, because junior staff have the most to lose if nobody does.

Few expect the career path to stay the same

Only 1% of respondents believe the analyst career path will remain unchanged. In a sample of 500, that is a handful of people.

The most common expectation is that new roles will emerge around overseeing, checking and coordinating AI systems. Nearly half expect entry-level positions to become harder to land, either because employers will ask for more knowledge and experience or because there will be fewer chances to gain that experience. Only a small share expect traditional roles to simply shrink.

Taken together, the answers point to a squeeze. The casework AI absorbs is the same work that used to teach newcomers the basics. If hiring requirements rise while that practice disappears, someone will have to build the training deliberately.

Reviewing AI output is now routine

Analysts say a growing part of their day goes to reviewing what the AI produced, and they are confident in that role. More than nine in ten said they could catch an incorrect or incomplete recommendation.

Respondents most often said they rely on their own judgment when the evidence in front of them conflicts with the AI's answer, or when following a recommendation could disrupt business operations or critical systems. Few said they go along with the AI unless it is clearly wrong.

Their top concern about expanding AI use is analysts relying too heavily on its recommendations, ranked just ahead of exposing sensitive data. An analyst who rarely needs to check the AI's reasoning gets less practice noticing when it is wrong.

Leaders see a more advanced rollout

Leaders and practitioners answered the same questions differently, with leaders consistently more positive. Three-quarters of leaders described AI as extensively deployed across multiple security functions, compared with about half of practitioners. Leaders also reported more role redesign, more capacity and more satisfaction.

The two groups came from different organizations, so the gap does not prove that managers misread their own teams. It does show that the people who usually set investment priorities describe a transition further along than the one practitioners report.

Company size played a role too. Respondents at firms with 10,000 or more employees were half as likely as those at midsize firms to report a big jump in satisfaction.

Formal role changes linked to happier analysts

About four in ten respondents said their organization formally rewrote analyst roles around higher-value work. A similar share said their duties drifted without any formal change.

Among those with a formal redesign, 71% said AI significantly raised their satisfaction. Without one, the figure dropped to 29%. The survey cannot show that the redesign caused the difference, and organizations that take the time to rewrite job descriptions may differ in other ways.

A written redesign defines what analysts now do, how they are evaluated and how they move up. It also gives managers a clear place to track whether staff are learning, separately from whether they are happy. The 91% figure among analysts who feel held back shows why that second measurement matters.

The Bigger Picture

The findings suggest that the SOC talent pipeline problem may become harder to see, not easier. High satisfaction scores can hide a skills gap that only surfaces years later, when organizations look for senior investigators and find fewer people who learned the fundamentals by hand.

That matters because the threat side is not slowing down. Recent reporting has shown vulnerability disclosures doubling as AI speeds exploitation and even an autonomous AI agent breaching DIVD. Defenders who can question an AI's conclusions are likely to be needed more, not less. Workforce wellbeing is getting attention elsewhere as well, with US Cyber Command ordered to act on operator mental health, but this survey indicates that wellbeing and skill growth need to be tracked as separate things.

It is worth watching whether employers start building structured training paths for AI-assisted SOCs, and whether the gap between how leaders and practitioners describe the rollout begins to narrow.