In practice, the difference between a security analyst, a security engineer, and a security researcher is less about job titles and more about the output each role is hired to produce. Titles and boundaries also change by organization size.
flowchart LR A["Security Analyst<br/>Find what is happening"] E["Security Engineer<br/>Build the protection"] R["Security Researcher<br/>Discover what is possible"] R -->|"New vulnerabilities<br/>and techniques"| E E -->|"Security controls<br/>and telemetry"| A A -->|"Incidents and<br/>observed threats"| R classDef blue fill:#E8F3FF,stroke:#357AB8,color:#173A60 classDef green fill:#E7F6EE,stroke:#349668,color:#18543A classDef purple fill:#F2EBFF,stroke:#8261BD,color:#513783 class A blue class E green class R purple
Security Analyst
Typical output: an investigation report, triage notes, or incident timeline that answers what happened and what to do next.
Analysts monitor telemetry, investigate alerts, and coordinate response. Core skills include SIEM and log analysis, pattern recognition in noisy data, and risk assessment that prioritizes action.
Example: an analyst at a hospital notices unauthorized access to patient records and coordinates containment with IT.
Security Engineer
Typical output: a control that ships — firewall or WAF rules, identity configuration, hardening changes, or automation that reduces repeat work.
Engineers design and operate defenses. Skills often include network and application controls, scripting for automation, and mapping technical work to requirements from laws, regulations, and standards. GDPR and HIPAA are legal/regulatory frameworks; ISO 27001 is a management standard. They are related, but they are not the same kind of document.
Example: an engineer at a bank deploys a web application firewall and tunes rules for the applications in scope — which is web-attack defense, not a complete DDoS program by itself.
Security Researcher
Typical output: a finding — vulnerability report, malware analysis note, or technique write-up — often with responsible disclosure.
Researchers study what is possible: new weaknesses, novel malware behavior, or attack techniques. Reverse engineering and careful disclosure matter. Finding zero-days is real work for some researchers; it is not a routine weekly expectation for every research title.
Example: a researcher finds a flaw in a common IoT device and discloses it to the vendor before public discussion.
Where the roles overlap
flowchart TB
START{"What interests you most<br/>in cybersecurity?"}
START -->|"Analyzing threats"| A["SECURITY ANALYST<br/>Detect · Monitor · Respond"]
START -->|"Building defenses"| E["SECURITY ENGINEER<br/>Design · Implement · Protect"]
START -->|"Exploring vulnerabilities"| R["SECURITY RESEARCHER<br/>Discover · Investigate · Disclose"]
START -->|"All three"| G["SECURITY GENERALIST<br/>Combine multiple disciplines"]
A --> A1["Key Skills<br/>SIEM and log analysis<br/>Threat detection<br/>Risk assessment"]
A1 --> A2["Typical Activities<br/>Review security logs<br/>Investigate incidents<br/>Coordinate patches and audits"]
A2 --> A3["Example<br/>Detect unauthorized access<br/>to hospital patient records"]
E --> E1["Key Skills<br/>Firewall management<br/>Scripting and automation<br/>Security compliance"]
E1 --> E2["Typical Activities<br/>Deploy security tools<br/>Manage access controls<br/>Conduct security audits"]
E2 --> E3["Example<br/>Deploy a WAF to protect<br/>financial applications"]
R --> R1["Key Skills<br/>Vulnerability analysis<br/>Reverse engineering<br/>Responsible disclosure"]
R1 --> R2["Typical Activities<br/>Analyze malware<br/>Investigate vulnerabilities<br/>Publish findings"]
R2 --> R3["Example<br/>Discover and responsibly<br/>disclose an IoT vulnerability"]
G --> G1["Key Strengths<br/>Flexibility across roles<br/>Broader security perspective<br/>Continuous learning"]
G1 --> G2["Career Opportunities<br/>Cross-functional security work<br/>Security architecture<br/>Potential leadership paths"]
classDef start fill:#172C45,color:#FFFFFF,stroke:#172C45,stroke-width:2px
classDef analyst fill:#E8F3FF,color:#173A60,stroke:#357AB8
classDef engineer fill:#E7F6EE,color:#18543A,stroke:#349668
classDef researcher fill:#F2EBFF,color:#513783,stroke:#8261BD
classDef generalist fill:#FFF3D9,color:#765011,stroke:#CE9B30
class START start
class A,A1,A2,A3 analyst
class E,E1,E2,E3 engineer
class R,R1,R2,R3 researcher
class G,G1,G2 generalistSmaller teams often need one person to cover more than one of these outputs. That “generalist” path is useful. It is also not an automatic pipeline to a CISO role. Leadership roles need breadth plus organizational judgment, not only curiosity across specialties.
If you like investigating live incidents, start with analyst work. If you like building controls that stay up in production, lean engineer. If you like digging into unknowns and publishing careful findings, lean research. Many careers move between these over time.
