Courses

Institutions

What Does a Cybersecurity Analyst Do?

Jeremiah Thooyavan

October 15, 2026

Discover what cybersecurity analysts do, how they investigate cyberattacks, respond to security threats and use AI to protect organisations in Malaysia.

Key Takeways

Cybersecurity analysts protect organisations by detecting, investigating and responding to digital threats. Their daily responsibilities include monitoring security alerts, examining suspicious activity, identifying system weaknesses and helping prevent cyberattacks from causing further damage.
Cybersecurity analysts investigate more than just hackers trying to break into systems. They handle threats such as phishing, malware, ransomware, unauthorised access and data breaches, using digital evidence to understand how attacks happen and what information or systems may be affected.
Real cybersecurity incidents in Malaysia show why rapid threat detection and response matter. During the October 2026 Tabung Haji incident, cybersecurity teams worked to contain suspicious activity, investigate the threat, strengthen security measures and restore affected services while protecting depositors.
AI is changing how cybersecurity analysts work, but human expertise remains important. Automated security systems can detect and contain certain threats within seconds, allowing analysts to focus on complex investigations, interpreting evidence and making important security decisions.

A cybersecurity analyst protects an organisation's computer systems and data by monitoring suspicious activity, investigating security threats and responding to cyberattacks. Their work involves identifying potential dangers, examining digital evidence and helping prevent further damage.

Interested in this career? Explore our article, [Internal link: How Do You Become a Cybersecurity Professional in Malaysia?] for the subjects, courses and qualifications to consider.

What Does a Cybersecurity Analyst Do on a Daily Basis?

Cybersecurity analysts spend much of their working day monitoring security systems, reviewing alerts and investigating suspicious activity. They also check for weaknesses in computer networks, prepare reports and work with IT teams to resolve security issues.

One example comes from Microsoft cybersecurity analyst Phoebe Rogers, who investigated a suspicious login to an employee's account. Although the login had passed multifactor authentication, an additional identity check, she noticed unusual activity and examined the device, browser, location and IP address.

Rogers explained what her investigation uncovered:

"An attacker had successfully gained access to the account and thereby internal corporate resources."

Further investigation revealed that a phishing email had led to multiple employee accounts being compromised. She documented her findings and recommended steps to secure the affected accounts.

Her experience shows how cybersecurity analysts investigate routine security alerts, uncover hidden threats and help organisations take action before further damage occurs.

What Do Cybersecurity Analysts Investigate?

Cybersecurity analysts investigate threats that could expose confidential information, damage systems or interrupt business operations.

Cyber threat	What analysts investigate
Phishing	Suspicious emails designed to steal login information.
Malware	Harmful software infecting computers or networks.
Ransomware	Attacks that lock files or systems and demand payment.
Unauthorised access	Suspicious logins and access to restricted systems.
Data breaches	Possible theft or exposure of confidential information.

Jurgen Kutscher, Vice-President of Mandiant Consulting at Google Cloud, has highlighted how attackers continue to exploit security weaknesses and find ways to avoid detection.

How Do Cybersecurity Analysts Respond to Cyberattacks?

When suspicious activity is detected, analysts investigate the warning signs, determine whether an attack has occurred and help prevent further damage.

The response generally involves four stages:

Investigate: Examine security alerts, activity records and affected systems.
Confirm: Determine whether a threat is genuine and assess its impact.
Contain: Help isolate affected devices or block suspicious access.
Recover: Support system restoration and recommend improvements.

These steps are consistent with the incident-response guidance published by the US National Institute of Standards and Technology (NIST).

How Have Cybersecurity Professionals Handled Real Cyberattacks in Malaysia?

In October 2026, the Malaysian Anti-Corruption Commission (MACC) reported detecting and blocking approximately 80,000 to 90,000 cyberattack attempts daily.

Cybersecurity consultant Fong Choong Fook highlighted the growing automation of cyberattacks and the need for organisations to respond quickly.

A recent example involved Tabung Haji, which detected suspicious activity on 7 October 2026. Its cybersecurity and technical teams responded through several measures:

Containing the threat: Services were temporarily suspended to protect depositors.
Investigating the incident: Internal teams worked with external cybersecurity experts and national authorities.
Strengthening security: Security checks were conducted and additional safeguards introduced.
Restoring operations: Main services resumed by 12 October, with continued monitoring.

According to Free Malaysia Today, depositors' savings remained safe, although three THiJARI functions still required recovery.

The incident shows how cybersecurity teams investigate threats, protect systems and help organisations recover from attacks.

Students can also explore Afterschool's guide to the fastest-growing technology careers to learn about related opportunities.

Will AI Replace Cybersecurity Analysts?

AI can detect certain cyberattacks and respond faster than humans, but cybersecurity analysts remain important for complex investigations and security decisions.

In August 2026, Microsoft security researchers David Shiran and Ayelet Artzi documented how Microsoft Defender automatically isolated a compromised device at QNET within 128 seconds of a high-severity alert, helping stop an attack before it spread.

The automated response allowed analysts to focus on investigating the incident rather than containing the immediate threat manually.

As AI takes over more routine tasks, analysts will continue to play an important role in understanding threats, examining evidence and making security decisions.

Explore Afterschool's Cybersecurity Specialist Career Guide to learn more about career opportunities and progression.

Frequently Asked Questions

1. Do Cybersecurity Analysts Investigate Online Scams?

Yes, particularly phishing, fraudulent websites and scams involving organisational accounts. Personal financial scams are generally handled by the relevant authorities.

2. Can Cybersecurity Analysts Identify Who Hacked a System?

Analysts can examine IP addresses, activity records and other evidence, but identifying the person responsible may require further investigation.

3. What Is a Security Operations Centre (SOC)?

A SOC is a team responsible for monitoring, investigating, and responding to cybersecurity threats affecting an organisation.

4. Do Cybersecurity Analysts Work With the Police?

Yes. They may assist law enforcement by preserving and providing technical evidence when incidents involve criminal activity.

5. Can AI Stop a Cyberattack Without Human Intervention?

Yes. Some automated security systems can detect threats and isolate affected devices without immediate human intervention, although further investigation may still be necessary.