The role of a security operations center (SOC) has always been a crucial one, but now that AI has made it easier, cheaper, and faster for cybercriminals to deceive users at scale, pressure on SOC teams is at an all time high.

The security analysts who thrive in this new fast-paced reality aren’t always the ones you’d expect. Some started their careers in teaching. Others were EMTs, retail managers, researchers, customer service reps, or even musicians. Many never planned to work in cybersecurity at all.

Yet these “non-traditional” analysts bring something essential to the modern SOC—a fundamentally different way of recognizing patterns, evaluating people, and interpreting behavior. And as socially-engineered attacks become more subtle and more frequent, these strengths aren’t just valuable, they’re indispensable.

The SOC Unlocked series has introduced us to professionals who took unexpected routes into security and proved that talent doesn’t follow a template. Across their stories, five strengths stood out as defining traits of analysts from non-traditional paths.

Many analysts built their pattern-recognition abilities long before they ever worked in security. Teachers, social workers, and customer-facing employees are trained—explicitly or implicitly—to read people. They notice tone shifts, inconsistencies, and subtle behavioral deviations.

Before becoming an incident commander, Joe Morrissey worked retail and help desk roles—jobs that trained him to spot subtle inconsistencies long before he ever analyzed a packet. He described spending hours tinkering and observing how things behaved, saying, “I spent a lot of time dabbling in whatever I could get my hands on.”

Analysts with backgrounds in emergency response, operations, logistics, or the military often rise fastest because they already know how to manage adrenaline, triage effectively, and communicate clearly.

Show host Mick Leach, an army cavalry veteran turned Field CISO, says his military background taught him how to assess risk quickly and lead during uncertainty. He emphasized the importance of decisiveness and calm in chaotic situations. “We don't want to let perfection be the enemy of good…continue to iterate, folks. Continue to do something a little bit better today.”

CISO Patricia Titus also brought a perspective shaped by years in military intelligence and crisis-heavy leadership roles. Her path into cybersecurity wasn’t traditional, but it taught her something essential about working in high-pressure environments. As she put it, “Everybody is working under pressure. When people are working under pressure, people make mistakes. I think the biggest challenge we have as security professionals is recognizing that humans are going to make mistakes.”

This is exactly why analysts with experience in pressure-heavy environments excel in the SOC. They understand that clarity is non-negotiable, especially when an identity compromise unfolds or multiple alerts cascade at once.

Curiosity showed up across episodes of SOC Unlocked as one of the strongest predictors of long-term success, especially for analysts who didn’t follow a traditional technical path.

Franklin County CISO Nikki Milburn, whose own path started in telemarketing, captured the spirit of effective analysts with one piece of advice: “Be curious. Always be curious about stuff and things that are going on. Keep an open mind and be curious about things."

And Steven Dumolt, who has spent years navigating complex enterprise environments, emphasized that curiosity fuels better investigations and stronger SOC teams: “We fight alert fatigue by giving analysts freedom to explore different areas.”

These analysts don’t treat incidents as checklists. They treat them as puzzles. They investigate the weird edge cases. They follow threads that don’t look promising at first, but often are.

Analysts who come from service-driven backgrounds understand how to meet people where they are, not where security wishes they were. And that empathy changes everything about how incidents unfold.

Before leading security at Acrisure, Anthony Coggins began on the help desk—resetting passwords, troubleshooting projectors, and supporting K–12 classrooms. Those early experiences shaped how he sees the role of the SOC today: “All of us are here to help folks get moving forward.”

The simple concept of helping people move forward becomes a strategic advantage in the SOC. It shapes how analysts guide anxious employees through phishing scares, how they ask for clarity during incidents, and how they reinforce security habits without blame.

Senior Vice President of Security Services at Arctic Wolf Lisa Tetrault emphasized that empathy isn’t merely interpersonal; it’s cultural. She reminded leaders that building a healthy SOC requires continual reinforcement: “Culture isn’t an Easy-Bake Oven. You can’t just do it once and you’re done—you have to lean in, every single day.”

In a Tier 3 analyst, empathy becomes a force multiplier that strengthens the entire security culture and reduces risk across the organization.

If there’s one shared trait among the SOC Unlocked guests who advanced the fastest, it wasn’t a specific certification or technical specialty—it was a commitment to continuous learning. The strongest analysts weren’t defined by where they started, but by how quickly they adapted as the role evolved.

FC, whose career was built on exploring how systems and people really work, described learning as an active, ongoing discipline, “Question everything. That’s where you find the answers.”

That mindset mirrors what successful analysts do daily: challenge assumptions, test hypotheses, and stay open to new signals and new ideas.

Head of App and Cloud Security at Options Clearing Corp. Eric Zielinski reinforced this need for continuous exploration, especially as new technologies and attack techniques emerge: “Be open to change, adapt to emerging technology, and continuously learn.”

Security leader and Managing Partner of InfoSec Innovations Mick Douglas captured the heart of relentless improvement when he challenged teams to reject complacency altogether, “Don’t settle for mediocrity. If things are too tough with your SOC or your SIEM, find somebody that can help make it a lot easier.”

Security leaders agree that adaptability is the engine of advancement. It’s what propels analysts from Tier 1 to Tier 3, enabling them to evolve faster than attackers, embrace new tools with confidence, and continually elevate the security function around them.

If SOC Unlocked revealed anything, it’s that the future of security doesn’t belong to people who memorize the most acronyms or collect the neatest row of certifications. It belongs to the analysts who think differently. The ones who are curious enough to question what doesn’t look right, empathetic enough to meet people where they are, calm enough to bring clarity into chaos, and adaptable enough to grow as fast as the threats evolve.

The analysts who thrive aren’t defined by where they started. They might have come from a classroom, an ambulance bay, a retail floor, a help desk, or a research lab. Their journeys don’t look the same, and that’s exactly why they work. Each brings a way of seeing the world that no tool can replicate. They notice patterns others overlook. They steady the room when tension spikes. They ask the questions no one else thinks to ask. They make security feel human.

AI doesn’t replace these strengths. It amplifies them. By clearing noise and removing manual barriers, it gives analysts room to think, interpret, and lead with the instincts shaped by their diverse experiences.

There is no one path to Tier 3 because there is no single mold for the analysts who get there. The SOCs that excel will be the ones built on human difference, empowered by AI to move faster, think deeper, and protect better. The SOC of the future is already emerging and it looks more human than ever.

Interested in learning more? Check out full episodes of SOC Unlocked below.