An analyst closes the same kind of alert for the hundredth time this week. Many are benign, a few need a second look, and the tool does not say which. By Friday the work feels like clearing a queue, and when a real incident arrives, the person handling it has little attention left. This is an illustration, not a case study, but anyone who has run a security operations center will recognize it.
This guide explains why security operations center analysts leave and how to keep them. It covers what makes the work wearing, what research shows about burnout, alert validation and the gap between managers and analysts, a way to take repetitive work off the analyst’s desk, a four-step plan and a table of warning signs. For the wider retention picture, see our guide on how to retain mid-level engineers.
Why SOC Work Wears People Down
A security operations center, or SOC, is the team that watches an organization’s systems for attacks. Analysts review alerts, decide which ones are real and escalate incidents. The job mixes two very different kinds of work. One is repetitive: checking an alert against the same few sources, writing up the same kind of case, validating a signal that turns out to be harmless. The other is high stakes: deciding that an unusual pattern is an intrusion and acting before it spreads.
Each kind is manageable alone. The strain comes from doing the first for long stretches and being expected to do the second well at any moment. That is the pattern to look for in your own team before you look at pay or perks.
A simple way to see it is to shadow an analyst for a shift and note each task as it arrives. Count how many are repeat checks and how many call for a decision. The ratio shows where the day goes, and it gives you a baseline for the plan below.
What Research Says About SOC Burnout
Sundaramurthy and colleagues carried out an anthropological study of a corporate SOC over six months and presented it at SOUPS 2015. They frame burnout as a human capital management problem that arises from interacting human, technical and managerial factors. Their findings include that burnout leads to poorer analyst judgment and frequent turnover, and that common responses such as career progression deal only with symptoms. They also identify multiple vicious cycles connecting the factors that affect analyst morale, and they validated the model against fieldnotes from a SOC at a higher education institution.
Alahmadi and colleagues studied the alerts themselves in a USENIX Security 2022 paper. They surveyed 20 security practitioners who work in SOCs and then ran a broader qualitative investigation with 21 practitioners. Practitioners confirmed that the tools they use have high false-positive rates that require manual validation, and most false positives came from benign triggers, meaning real activity that was legitimate. Alarm validation is tedious, the authors write, and it can cause alarm burnout and eventually desensitization. Both studies are qualitative and small, so they describe how analysts experience the work and not how many leave for each reason.
The two papers point the same way. Repetitive validation wears people down, worn-down people judge worse and leave, and a promotion path alone does not fix it. For how sleep and breaks affect attention over a long day, see our guide to focus in long workdays.
What Research Says About Managers, Analysts and Hiring
Kokulu and colleagues interviewed 18 SOC analysts and managers across six sectors for a CCS 2019 paper. The largest disagreements between managers and analysts concerned response speed and automation, evaluation metrics and tool functionality. Analysts often viewed quantitative metrics as a way for managers to show improvement, and managers pushed for more automation. The authors recommend that managers explain the metrics they use and why, and talk with analysts about automation, metrics and tooling. With 18 interviews, the results may not generalize.
Replacing analysts is hard in the current market. The 2025 ISC2 Cybersecurity Workforce Study surveyed more than 16,000 cybersecurity professionals and decision-makers. In a SecurityInfoWatch report of the study, 59% described skills gaps in their teams as critical or significant, up from 44% in 2024, and 33% said they lack the budget to staff security operations effectively. Those are survey responses and not estimates for the whole industry. For a manager the point is practical: an open seat may stay open for a while, and keeping the analysts you have is the more reliable path.
Take Repetitive Work Off the Analyst’s Desk
Start by sorting the work. List what an analyst does in a typical shift and mark each task as repetitive or as needing judgment. Enriching an alert with context, building a case timeline, mapping activity to a framework and checking whether security tools are healthy are repetitive. Deciding whether an incident is real and what to do about it needs judgment. The first group is where automation helps, and the second is where people should stay in charge.
Keep a person in the approval path for any action that changes a system or an account. Ask analysts which repetitive tasks they dislike most and start there, with low-risk jobs such as summaries and enrichment. That speaks to the gap Kokulu and colleagues found, because analysts help decide what gets automated and see the result.
CyberProof’s Agentic SOC uses AI agents for defined security tasks such as alert enrichment, case timelines, MITRE ATT&CK mapping and EDR health checks. Analysts validate outcomes, handle complex incidents and approve response actions such as endpoint isolation.
Whatever tool you choose, write down which tasks it takes over and which decisions stay with people, and review the split with the team after 90 days. If analysts spend less time on repeat validation and more on complex incidents, the work has shifted toward the part of the job that uses their skills.
A Four-Step Plan to Keep SOC Analysts
Use this four-step plan for your SOC.
- Ask. Hold a stay interview with each analyst about which tasks drain them and what would make them stay.
- Sort. Split the shift’s tasks into repetitive work and judgment work.
- Automate with approval. Start with low-risk tasks, and keep analysts in the approval path for response actions.
- Review. At 90 days, compare time on repeat tasks and analyst feedback with the baseline.
A stay interview is short and specific. Ask which part of the job each analyst would keep, which part they would hand off and what a better offer elsewhere would need to include. Our guide to stay interview questions has a list to start from. Write down the answers and act on at least one within a month.
The order matters. Asking first stops you from automating a task nobody minded while the one analysts dread stays on their desk.
Measure Whether It Works
Track the hours each analyst spends on repeat tasks, the time to handle an alert, voluntary exits, open roles and the time to fill them. Compare each figure with the baseline you recorded before you made changes. With a small team the numbers are small, so use them to start a conversation and not to grade anyone. Ask each analyst the same three questions once a quarter, so the figures have a voice behind them. Keep a short log of every task you automate, with the date and the analyst who asked for it, so the team can see its own requests turn into changes.
Warning Signs Your SOC Analysts May Leave, and What to Do About Each
Check this table each quarter. One sign means fix one thing. Three or more mean act soon.
Fix the Work, Then Keep the People
Research on SOCs points to the same causes: repetitive validation that wears analysts down, burnout that degrades judgment and drives turnover, and a gap between what managers measure and what analysts experience. Ask analysts what drains them, sort repetitive work from judgment work, automate the first with analysts in the approval path and check the result at 90 days. Each step replaces a guess about why people leave with something you can see. If your analysts spend more of their shift on complex incidents and less on repeat validation, you have given them a reason to stay. For the wider picture, see our guide to employee retention rate.
