Brian Edminston
What actually gets you promoted as a cybersecurity analyst.
People ask me how someone moves up from analyst to something more senior, and the answer they expect is a certification list or a year count. My answer is that education counts, but it can only take you so far. I personally look mostly at attitude, how someone acts on the day everything breaks at once.
In this piece, I’ll teach you how to show, technically and behaviorally, that you’re ready.
Fast-tracking isn’t the norm… But it doesn’t mean you can’t do it
Published tier-progression data puts the typical tier one to tier two jump at one to three years, and reaching tier three usually takes three to six years of cumulative experience. But you shouldn’t sit back and wait for time to naturally move you up the ladder.
I joined OneAxiom in August 2024 as a tier one analyst. Eight months later, I was a tier three analyst. About six months after that, I took over the detection engineer role.
I’m not telling you this to brag about speed. I’m telling you this because if time in seat were actually the thing being measured, my own path wouldn’t make sense. While every practitioner comes from different starting points and follows diverse journeys, it doesn’t hurt to go about your career strategically.
Behaviors that are valued beyond your technical skills
Separate from everything else, if I had to describe what makes a good analyst in two words, even starting out as a tier one, it’s curiosity and interest.
Curiosity makes someone look into things they weren’t told to look into. Interest is what makes that stick, the personal investment of time that turns a task into something they actually enjoy.
My own path to red teaming started that way, with a second workstation I set up myself, running an operating system I configured myself, entirely separate from anything the job asked of me.
Beyond my own observations, I actually found this 2025 peer-reviewed study in Acthat ta Psychologica that looked at curiosity specifically in cybersecurity students and found that the kind of curiosity that actually predicts performance isn’t just general joyful exploration. It’s the kind that can’t tolerate an unresolved question, the itch to close a specific gap rather than just enjoying the search.
That’s a more precise way of saying what I mean by someone who digs into something before anyone asks them to.
Also, the 2025 ISC2 Cybersecurity Workforce Study asked hiring managers what they actually prioritize, and the top five answers were all nontechnical: problem-solving, collaboration, communication, willingness to learn, and strategic thinking, ranked ahead of any specific technical skill gap, AI and cloud security included.
Nobody’s ranking curiosity itself in that list, but every one of those five is downstream of it.
What actually proves the SOC analyst is ready for the next level
Past that entry-level signal, what I actually watch for in someone being considered for the next level is how they handle it when things don’t go their way.
How they act when an incident actually comes in. How they talk to a customer when they’re composed, or when they’re not. What it looks like when they’ve got ten alerts to work through, but one of them needs to be escalated right now, and it probably needs a phone call, not a ticket.
A named hiring manager put a finer point on this than I usually hear. Omer Malik, CEO of ORM Systems, was interviewed directly about what he actually tests for, and he treats staying methodical under alert-fatigue pressure as a specific, testable skill, not a personality trait someone either has or doesn’t.
That matches what I see. It’s not about whether someone is naturally calm, but whether they can stay methodical when the pressure is actively working against that.
And there’s a real reason why a quiet interview or a slow month doesn’t reveal any of this.
Psychologists have documented something called attentional narrowing since the 1950s: under real stress, the brain stops processing a wide range of information, and fixates on the immediate threat, filtering out everything peripheral.
Then, Robert Hockey’s compensatory control theory adds the part that matters most for this argument: experienced people under sustained pressure don’t suddenly get worse. They compensate, concentrating harder and narrowing focus to protect what matters most, so performance can look completely fine right up until it isn’t.
Put those two findings together and you get a plain explanation for why the bad day is the only honest test. Everything before it can look like readiness without actually being it.
Why composure under fire transfers directly to a SOC
Before becoming a cybersecurity analyst, I spent eight years in the Marine Corps and have a couple of deployments under my belt. What I bring from that is a standard of performing under pressure.
If you fold when things get hard, that’s the maturity gap, plainly. You have to develop the ability not to fold, and this job hands you real chances to find out whether you have it.
Another note here is that whatever previous experience you have, use it to your advantage.
While I personally have the endurance of combat experience, maybe you’ll have the charisma of customer service and will be able to connect and extract more from the customers, or perhaps the didactics of a teacher to teach and convince the customer exactly why they need to do X or Y.
Whatever your background is, use it in your favor.
If you want to move faster, here’s where to actually start
None of this is a mystery you have to wait around for someone to test. There are concrete things to start doing now, whether you’re a tier one trying to get noticed or a tier two trying to make the jump to a more senior role.
1. Start a project nobody assigned you.
Mine was a second workstation for red teaming, set up and configured on my own time. It doesn’t need to be that specific. It needs to be something you’re doing because you’re curious, not because it’s on a review.
2. Stop closing alerts on pattern-match alone.
Before you close something because “it’s the same as last time,” ask what else it could be. Moving from task-completer to problem-solver is a habit you can start on your very next ticket, not something that requires a promotion first.
3. Build a visible paper trail of initiative nobody asked for.
A one-line hypothesis on a closed ticket. A proposed tweak to a detection rule. A technique you looked into because it caught your attention, not because it was assigned.
None of these take long, and all of them are the kind of evidence a senior analyst or a team lead actually notices, even when nobody says they’re watching.
4. Get fluent in a shared vocabulary for attacker behavior.
Chandra Sekhar Muppala, a senior manager at Infosprint Technologies, names MITRE ATT&CK fluency as his own hiring X-factor because it gives someone a way to reason about what an attacker is actually doing instead of just operating a tool.
That’s a skill you can build on your own time, on alerts you’ve already closed.
5. Notice when you’re narrowing, not just pushing through.
If you can learn to recognize the feeling of tunneling in on one thing under pressure, that’s the moment to deliberately widen back out, ask what else is happening, what else this could connect to, before you act.
Luckily for all of us, that’s a trainable habit, not an innate trait.
6. Rehearse the hard conversation, not just the technical step.
Knowing how to escalate something is not the same as knowing how to tell a customer it’s happening.
Practice that phone call in your head before you’re on it for real. The technical judgment and the composure to deliver it calmly are two different skills, and only one of them gets taught in most training.
Quick answers
How do you move up as a cybersecurity analyst? Beyond time served, it’s also about showing curiosity and self-directed effort early on, then composure under real pressure, how someone handles an incident, an escalation, or a hard customer call, once they’re past the entry level.
What makes a senior SOC analyst? The ability to stay methodical when an incident is actively working against that, not just technical skill or years in the seat. Research on cognitive readiness backs this up: performance can look fine under pressure while capacity is quietly disappearing, which is why a calm interview doesn’t prove someone is ready.
Why does curiosity matter more early on? Because it predicts who invests personal time into learning before anyone tells them to, and that self-directed pattern is what turns into the judgment senior roles actually require. Research distinguishes this from general curiosity: it’s specifically the kind that can’t leave a question unresolved.
How fast is normal for tier one to tier three? Most sources put it at three to six years of cumulative experience.
Written by Brian Edminston, Principal Analyst at OneAxiom
Edited by Julia Araujo, Marketing Manager at OneAxiom
