Cybersecurity Analyst

Urban Institute

National (OA)

National Occupational Frameworks

Documents

Individual state requirements may vary. Please contact your local apprenticeship office to ensure this version is suitable to your state’s requirements.

Work Process Schedule

Work Process Content

On the Job Training

Anonymous

Monitors computer systems, networks, and cloud computing environments to identify threats and security incidents

Tracks reports of computer viruses or endpoint protection systems to ensure they are configured properly and proactively protect an organization’s systems
Monitors use of data files and regulates access to safeguard information in computer files
Uses company’s vulnerability management system and other technologies and tools to monitor computer systems and check for vulnerabilities
Works with team to continuously monitor and analyze the organization’s network, cloud computing, and endpoint traffic to identify threats or security breaches
Troubleshoots issues with computers, applications, systems, or networks
Recommends vulnerability remediation and risk mitigation strategies
Recommends strategies for strengthening networks, endpoints, and/or cloud computing environments against future attacks
Performs continuous monitoring of system activity
Identifies and analyzes network traffic anomalies
Determines causes of network alerts
Distinguishes between benign or potentially malicious cybersecurity attacks and intrusions
Identifies network device applications and operating systems

Implements security measures to protect organization against security incidents

Determines adequacy of access controls
Encrypts data transmissions and erects firewalls to conceal confidential information
Safeguards sensitive data and information
Uses current and most up to date software and technology to protect company data from malicious attacks (e.g., malware, phishing, DNS tunneling)
Complies with security protocols, incident response policies and procedures, playbooks, and best practices to respond to and mitigate a potential security incident
Participates in simulated cyberattacks or tabletop exercises
Documents computer security and emergency measures, including policies and procedures
Recommends strategies and modifications for strengthening networks, endpoints, and/or cloud computing environments against future attacks and vulnerabilities
Isolates and removes malware
Establishes intrusion set procedures
Routinely updates firewalls and other cybersecurity software

Tests systems for vulnerabilities and to assess risks

Provides risk assessments by checking for vulnerabilities in computer, network, endpoint, cloud computing environments, and data processing systems
Tests risk mitigation strategies prior to deployment
Determines effectiveness of system implementation and testing processes
Determines if security control technologies reduce identified risk to acceptable levels
Uses organization’s cybersecurity software to conduct threat modeling and analysis

Communicates effectively with team members and collaborates to resolve security issues and concerns

Discusses and remediates security violations
Collaborates with individuals across internal departments or other stakeholders to respond to and resolve security incidents
Notifies individuals across internal departments or other stakeholders about potential security concerns or threats
Assists with training computer users about new security products and procedures to promote security awareness
Develops constructive and cooperative working relationships with others, and maintains them over time
Advises stakeholders on disaster recovery, contingency, and continuity of operations plans
Communicates cybersecurity attacks and intrusions to team members and superiors
Advises stakeholders on vulnerability compliance
Fosters open communication through active listening and facilitates shared understanding across teams and clients
Offers and accepts feedback respectfully, meets others with empathy, and seeks additional feedback and perspectives
Abides by principles of inclusion and equity in communication with team members and superiors
Assists team with making recommendations for security upgrades and enhancements to management or senior IT staff

Identifies, investigates, and responds to cyberattacks and security incidents

Tracks cyberattacks or security incidents from detection through resolution
Initiates incident response processes
Under supervision, estimates impact of threats to company’s information and data
Drafts pre- and post-incident reports that document general metrics, attempted attacks, security incidents, and lessons learned
Assists with developing response or contingency plans to limit damage
Conducts post-incident analysis to identify root causes of security incidents
Determines the operational and safety impacts of cybersecurity lapses
Detects cybersecurity attacks and intrusions
Identifies anomalous network activity and potential threats to network resources
Assists with refining and strengthening incident response plans, procedures, or playbooks

Participates in ongoing professional development

Stays informed about current industry-specific technology developments, including emerging technologies (e.g. artificial intelligence)
Remains up-to-date about latest cybersecurity trends
Develops professional development goals and plans to accomplish goals
Participates in relevant seminars, workshops, conferences, and leadership programs

Related Instruction Outline

Cybersecurity Analyst

Work Process Content

Related Instruction Content

Similar Programs