A public-health clinic SOC has one person working the notable queue and also building SOAR playbooks. How should the playbook-build work be classified?
Select an answer to reveal the explanation.
Short Explanation
One person wearing two hats does not merge the hats. Closing tickets is Analyst triage; designing playbooks is Engineer-side automation. Small clinic, same split — just fewer people to do both jobs.
Full Explanation
Even in a small municipal SOC, playbook and automation design is Engineer-side work, not the Analyst's core triage loop. Headcount does not rewrite role definitions: queue work remains Analyst consume-and-disposition; automation build remains content and workflow engineering. Architecture is multi-year program design, not a single playbook. Playbooks may be triggered from Enterprise Security; that does not make playbook authoring an Incident Review admin task.