Security Analysts

SOC analyst burnout: how to decide what to change

Endless alerts, night shifts and the feeling that one missed ticket could be the breach wear people down. You are not alone in it: in ISC2's 2025 workforce study, 47% of respondents said they often feel overwhelmed by their workload.

Burnout does not always mean leaving security. Sometimes the fix is the queue, the shift or the team. Below are the options analysts weigh, so you can talk through which one fits. If you are in crisis or thinking about harming yourself, in the US you can call or text 988 to reach the 988 Suicide & Crisis Lifeline.

Talk to Carmen

Your AI career coach

Say it the way you’d say it to a friend. Carmen will ask what she needs to know.

Free, no sign-up to start.

47%

Said they often feel overwhelmed by their workload (ISC2, 16,029 respondents, July and August 2025)

ISC2

48%

Reported feeling exhausted from trying to stay current on threats and technologies (same study)

ISC2

Ways to decide what to change

  • Fix the alert fatigue first

    If most of the stress comes from noisy, low-value alerts, the problem may be the rules more than the job. Tracking which alerts waste the most time gives you a concrete case to bring to your lead.

    First step
    For one week, tally every alert you close as a false positive by rule name, then share the top three with your lead.
  • Change your shift pattern

    Rotating nights and weekends affect sleep and life outside work. Some teams let analysts move to a fixed shift or swap rotations. Ask what is possible before assuming the answer is no.

    First step
    Write down which shifts drain you most and ask your manager whether a fixed or different rotation is an option.
  • Move to a different team or employer type

    An MSSP usually means many clients, high volume and tight service levels. An in-house SOC means one environment you get to know deeply. Some analysts burn out in one and do well in the other.

    First step
    List what wears you down most (volume, context switching, clients, isolation) and check which of those an in-house or MSSP role would change.
  • Ask for automation and tuning time

    Protected time to tune rules or build automation reduces the load for the whole team and gives you work that is not the queue. Framing it as a fix for the team makes it easier for a manager to approve.

    First step
    Propose a few hours a week to fix one specific noisy rule, with a way to measure the alerts it removes.
  • Take leave

    Sometimes the first step is rest. Check your employer's leave options and your benefits, and talk to your doctor if the exhaustion is affecting your health or sleep.

    First step
    Look up your leave balance and your employer's leave policy this week, so the option is real when you need it.
  • Build the exit

    If the SOC itself is the problem, plan a move into GRC, detection engineering, security engineering or a role outside security, on your own timeline. Having a plan often lowers the pressure before you ever hand in notice.

    First step
    Write down the parts of your work you would keep and the parts you would drop, and use that list to shortlist two roles to explore.

Sample conversation

How a conversation with Carmen starts

Carmen asks before she suggests. An illustrative example, not a real person.

Three years of nights in an MSSP. I dread every shift and I'm starting to hate security.

Three years of nights is a lot to carry. When you picture the dread, is it the security work itself or the volume and the hours?

Honestly the volume. The investigations I get to finish are the only good part.

That matters. It points at the setting more than the field. Want to compare what an in-house SOC or a detection role would change for you?

Work it out with Carmen, free

30 free minutes with Carmen and the team. No card needed.

Questions & answers

Is burnout common for SOC analysts?
Workload stress is widely reported across security. In ISC2's 2025 workforce study, 47% of respondents said they often feel overwhelmed by their workload and 48% reported feeling exhausted from trying to stay current.
Should I leave cybersecurity because of SOC burnout?
Not necessarily. Many analysts recover by changing the queue, the shift, the team or the kind of employer. Leaving the field is one option among several, and it helps to know which part of the job is draining you before you decide.
How do I talk to my manager about alert fatigue?
Bring evidence and a proposal: which rules create the most false positives, how much time they take, and what you would change. That turns a complaint into a fix your manager can support.
What if I need to talk to someone right now?
If you are in crisis or thinking about harming yourself, in the US you can call or text 988 to reach the 988 Suicide & Crisis Lifeline, which is free and confidential. Carmen is a career coach and is no substitute for crisis support or medical care.

More for security analysts

Just talk something through