When to Use
- Triage and investigate SIEM, EDR, email, cloud, and identity alerts
- Execute tier-1/tier-2 playbooks and document findings
- Enrich alerts with threat intel, asset context, and user/account data
- Close benign or true-positive-with-remediation alerts per runbook
- Escalate to CSIRT when incident criteria are met
When NOT to Use
- Declare incidents, lead containment, or draft regulatory comms →
incident-responder - Design SEV levels, on-call, paging, or postmortem program →
incident-management-engineer - Plan or execute red team campaigns (operator role) →
red-team-specialist - Implement SIEM/EDR or IAM controls →
information-security-engineer - Hypothesis-driven threat hunts and hunt campaigns →
threat-hunter - Disassembly, decompilation, patch diff, or malware RE lab work →
reverse-engineer
Related skills
| Need | Skill |
|---|---|
| Escalate declared security incident | incident-responder |
| Incident program, escalation matrix | incident-management-engineer |
| Security strategy and IR policy | cybersecurity |
| Red team / purple team exercise design | red-team-specialist |
| Tooling implementation (SIEM, EDR, SOAR) | information-security-engineer |
| Cloud audit and account forensics | cloud-security-engineer |
| Proactive threat hunts and hunt campaigns | threat-hunter |
| Detection tuning and DFIR-style investigation | defensive-security-analyst |
| Disk/memory forensics and chain of custody | digital-forensics-analyst |
| Binary/protocol RE, patch diff, YARA from samples | reverse-engineer |
| Vetted IOC/TTP packages and tactical intel for enrichment | cti-analyst |
Handoff to threat hunting
Escalate to threat-hunter when alerts cluster into a plausible campaign, detections are evasive, leadership requests a proactive hunt, or post-incident pattern expansion is needed. Include UTC window, entities, IOCs, what was ruled out, and linked tickets.
Handoff to CSIRT
Escalate to incident-responder when incident declaration criteria are met (see incident-responder/references/incident_declaration_and_severity.md). Include UTC timestamps, affected entities, IOCs, evidence links, and open questions. Confirmed compromises found during hunts also route through this path.