Use the analyst projection only after naming the security function
Occupation 15-1212.00 includes 182,800 workers in the 2024 estimate and 16,000 projected openings per year through 2034. That outlook signals national expansion and replacement demand, not an employer's open incident-response seats. Security programs create their own workload through architecture, detection content, asset quality, control ownership, and service hours. Those facts must be measured before headcount is selected.
O*NET can help a security leader compare the posting with broadly reported analyst activities. It cannot show competence on a particular cloud, establish clearance eligibility, or decide whether an identity reviewer can cover a detection rotation. Assess the underlying reasoning with safe fictional evidence, then let an authorized reviewer judge it. Certifications and vendor names are context rather than substitutes for the work sample.
Compensation analysis should isolate specialty, access level, on-call duty, location, and accountability for high-impact systems. “Remote” is also an operating condition, not a universal labor market; residency, customer, or access rules may still apply. A dated national figure cannot resolve those distinctions.
The worked alert case below separates tuning, data ownership, incident linkage, and analyst review. Its purpose is to prevent a misleading backlog total from becoming an automatic hiring request. Retention review is similarly bounded: paging and sustained response are measurable exposures, while a person's reason for departure can have several contributors that the operational record never captures.
Reliability rule for the security evidence
Keep event evidence, candidate evidence, and employee outcomes in separate datasets. Record collection windows and missing asset context. Do not expose live weaknesses or production data during selection. National projections remain background; the approved control scope and observed queue determine what the organization needs.
Security analyst hiring starts with the control environment
The title covers markedly different jobs: security operations monitoring, cloud review, identity governance, vulnerability management, incident response, third-party risk, and compliance testing. A single requisition that combines all of them produces misleading supply estimates and inconsistent interviews. Inventory the systems, data sensitivity, alert sources, on-call rotation, decision rights, and controls the person will own. Then separate knowledge required at entry from platform details that can be learned.
Access is part of workforce design. State whether the analyst will receive production privileges, approve changes, collect evidence, or only recommend action. Separation-of-duties rules may prevent one person from both implementing and validating a control. The hiring manager and security owner must settle those boundaries before recruiters describe the role.
Test investigation habits, not tool-brand recall
A defensible exercise can provide a short timeline containing an identity alert, a successful login, an endpoint event, and an incomplete asset record. Ask the candidate to identify what is known, what needs verification, which evidence should be preserved, and when escalation is justified. A security reviewer scores reasoning and containment priorities. There need not be one perfect diagnosis; uncertainty management is part of the work.
For vulnerability work, present several findings with asset criticality, exploit information, exposure, and compensating controls. Ask for a prioritized queue and the questions needed before changing priority. This reveals risk communication better than asking for memorized severity definitions. Never use real credentials, live customer data, or an active undisclosed weakness in a hiring exercise.
Writing should also be assessed. An analyst often translates technical evidence for system owners and leadership. A brief task can ask for two versions of the same finding: an operational handoff and an executive summary. Score factual restraint, ownership, next action, and the difference between observation and inference.
Worked case: an alert backlog that does not equal headcount demand
Assume a security operations queue contains 9,000 open alerts. That number alone cannot justify hiring. Deduplicate recurring detections, identify alerts awaiting engineering fixes, distinguish unreviewed events from investigated cases, and measure arrival by source and severity. Suppose tuning one noisy rule removes 5,800 repeats, 1,900 are already linked to open incidents, and 700 lack asset ownership. The remaining analyst-review queue is materially smaller than the headline backlog.
The workforce response may combine detection engineering, asset-data repair, and analyst coverage. If nights and weekends have delayed first review while weekdays meet the target, the open role needs an explicit rotation. Candidates should receive the call frequency, severity mix, escalation support, and recovery time after incidents. Hiding those facts until offer stage creates avoidable withdrawal and early-tenure surprise.
Pipeline evidence should align with the defined specialty. A candidate who passed an identity-governance review is not automatically ready for independent incident response. Record which exercise was completed, who reviewed it, and any conditions on readiness. Security clearance, background review, or customer-access approval should be represented as separate contingencies when genuinely required.
Retention analysis must account for incident exposure
On-call work is episodic. Monthly averages can conceal a small group handling repeated overnight events. Track rotations assigned, pages received, hours of sustained response, rest practices, and post-incident follow-up by team. Also record tooling changes, unresolved control ownership, and time spent chasing missing asset context. These are operational exposures, not diagnoses of why someone left.
When analysts depart, compare their exposure with peers in the same function and period. An exit comment about burnout is important qualitative evidence, but it does not quantify the contribution of paging, management, pay, or career opportunity. Preserve contradictory evidence and avoid attributing causation from a small cohort.
O*NET and BLS aggregate specialties and do not measure a particular technology stack, clearance pool, or on-call tolerance. Posting data can overcount duplicated remote roles, while internal alerts depend heavily on detection design. Use federal benchmarks for national context and local control, queue, and rotation evidence for the actual staffing decision.
Data Sources and Methodology
The method first uses federal employment projections to establish national scale, then maps O*NET activities to the employer’s named control, investigation, and response functions. The alert-backlog example is a queue diagnostic, not a staffing forecast: duplicate, low-value, tuning, access, and genuinely investigative work are separated before capacity is inferred. Local severity rules, coverage hours, escalation rights, and control ownership must be documented independently.
Analytical limits and approval rule
The federal category aggregates specialties and cannot measure one stack, clearance pool, privilege model, or rotation tolerance. Alert totals change when rules and assets change. Approve an analyst search only after those dependencies are separated and the remaining function, schedule, access, and reviewer are named.
The cited material was reviewed October 5, 2026, with publication periods left intact. The conclusion is descriptive; it neither forecasts one employer's turnover nor treats a national opening as an active requisition.
Sources
- Work context for 15-1212.00, O*NET OnLine, 2026.
- O*NET occupation summary for 15-1212.00, O*NET OnLine, 2026.
- Occupation details for 15-1212.00, O*NET OnLine, 2026.
- Occupation tasks for 15-1212.00, O*NET OnLine, 2026.
- Employer in-demand skills for 15-1212.00, O*NET OnLine, 2026.
- Occupational Projections and Worker Characteristics, U.S. Bureau of Labor Statistics, 2025-08-28.
- Education and Training Assignments by Detailed Occupation, U.S. Bureau of Labor Statistics, 2025-08-28.
- Industry Occupation Matrix by Occupation, U.S. Bureau of Labor Statistics, 2025-08-28.
- Top Skills by Detailed Occupation, U.S. Bureau of Labor Statistics, 2025-08-28.
- Occupational Employment and Wage Statistics, U.S. Bureau of Labor Statistics, 2026-05-15.