A county SOC manager is filling a night-shift opening. The job poster lists triaging notables on Incident Review, assigning dispositions, and opening investigations. Which SOC role owns that work?
Select an answer to reveal the explanation.
Short Explanation
Think of the night shift like a 911 dispatcher: take the call, label what it is, and open a case. That person is not rewriting the phone system or drawing next year's org chart. Triage, disposition, and investigations on Incident Review are Analyst work.
Full Explanation
In a typical SOC, Analysts consume detections: they triage notables on Incident Review or the Analyst Queue, assign dispositions, and open investigations. Engineers own detection content, CIM mappings, and tuning; Architects own program design and coverage strategy. Treating queue work as engineering or architecture misplaces the role the SPLK-5001 blueprint assigns to first-line cyber defense. Administering the Enterprise Security app is a different job from working the queue.