SOC Analyst AI Skills Checklist

This checklist is for SOC managers, team leads, and analysts in security operations centers adopting AI copilots, automated triage, or agentic investigation tools. AI shifts analyst work from gathering evidence to verifying and judging it. The new skills gap is not prompting; it is knowing when an AI conclusion is wrong, how to prove it, and when to escalate.

Use it to baseline a team before an AI tool rollout, to shape individual development plans, and to reassess every six months or after a major tool change.

How to use this checklist

1. Rate each analyst on each item: 0 (not yet), 1 (aware), 2 (does it with support), 3 (does it independently and can teach it).
2. Aggregate by shift or tier to find team-level gaps rather than singling out individuals.
3. Map roles to the NICE Workforce Framework for Cybersecurity so development plans use a shared vocabulary.

Foundational skills (still required)

• □ Investigates an alert end to end from raw telemetry without AI help. Skills atrophy, and AI tools have outages and blind spots.
• □ Maps observed activity to MITRE ATT&CK techniques.
• □ Reads and writes detection queries in your SIEM and EDR query languages.

AI literacy

• □ Explains how each tool reaches a verdict (rules, a machine learning classifier, or LLM summarization) and what data it can see.
• □ Recognizes LLM failure modes: invented indicators, fabricated log lines, overconfident summaries, and missing context.
• □ Validates every AI claim that drives an action against the underlying source data.
• □ Understands that a confidence score is not a probability of maliciousness unless the vendor has calibrated it that way.
• □ Recognizes prompt injection risk: attacker-controlled content such as email bodies, file names, or user-agent strings can steer an LLM-based assistant.

Working with AI tools

• □ Writes scoped questions and asks the tool for supporting evidence, not just a verdict.
• □ Tunes thresholds and suppressions and documents the reason for each change.
• □ Gives structured feedback on false positives and false negatives so models and rules improve.
• □ Knows each tool's limits: which data sources it does not ingest and how far back it can see.
• □ Reviews automated response actions before approval and knows how to roll them back.

Judgment and escalation

• □ Knows when an AI-assisted finding must go to a senior analyst or the incident response team.
• □ Records in case notes which conclusions came from AI and which were verified, preserving an audit trail.
• □ Handles sensitive data correctly, including what may and may not be pasted into which AI tool.

Training plan guidance

Pair analysts on AI-assisted cases, and run tabletop exercises where the AI output is deliberately wrong so the team practises catching it. Purple team exercises are a good way to test whether AI-assisted triage catches realistic attacker behavior. Track how often analysts overturn AI verdicts, and why.

Common pitfalls

• Measuring only speed. Alerts closed per hour rewards rubber-stamping AI output.
• Training on the tool's interface instead of on verification habits.
• Automating away all junior work. It is how new analysts learn; redesign it rather than remove it.