>> Junior Security Analyst: What I Learned from the TryHackMe Lab :-

## Introduction :

Cybersecurity is not just about finding vulnerabilities. It is also about understanding how security teams detect suspicious activity, investigate potential attacks, and protect systems from threats.

As someone focusing on Vulnerability Assessment and Penetration Testing (VAPT), I believe understanding the defensive side of cybersecurity is equally important.

Recently, I completed the Junior Security Analyst Intro room on TryHackMe. This experience encouraged me to explore the role of a security analyst and understand how defensive security contributes to protecting an organization's digital assets.

In this article, I'll discuss the role of a junior security analyst, the importance of security monitoring, and how defensive security knowledge can complement penetration testing skills.

## What Is a Junior Security Analyst?

A junior security analyst helps an organization monitor its systems, investigate suspicious activities, and identify potential security incidents.

Security analysts work to understand what is happening across an organization's network, endpoints, applications, and other digital assets.

Their responsibilities may include:

• Monitoring security alerts and system logs.
• Investigating suspicious network or user activity.
• Identifying indicators of compromise.
• Assisting with incident response.
• Documenting findings and escalating potential threats.
• Supporting security teams in improving an organization's defenses.

Junior analysts often work under the guidance of experienced security professionals while developing their technical knowledge and investigation skills.

## How Does a Security Analyst Detect Threats?

Organizations generate large amounts of data through their systems, applications, networks, and security tools. Analyzing this information can help security teams identify unusual behavior.

Here are some important concepts related to defensive security.

1. Security Monitoring

Security monitoring involves observing systems and network activity to identify suspicious behavior.

For example, repeated failed login attempts, unexpected administrative activity, or unusual connections to external systems may require further investigation.

However, a single alert does not automatically mean an attack has occurred. Analysts need to examine the surrounding evidence before reaching a conclusion.

2. Log Analysis

Logs record events occurring across systems and applications.

Depending on the source, they may contain information about authentication attempts, application errors, administrative actions, and network connections.

By examining relevant logs, analysts can reconstruct events and identify patterns that may indicate a security issue.

Key lesson: Logs are valuable only when analysts know how to interpret the information and correlate related events.

3. Indicators of Compromise

Indicators of Compromise (IoCs) are artifacts or observations that may suggest a system has been compromised.

Examples include:

• Known malicious file hashes.
• Suspicious IP addresses or domains.
• Unexpected changes to important system files.
• Unusual processes or persistence mechanisms.

IoCs should be evaluated in context because an individual indicator may have a legitimate explanation.

4. Incident Investigation

When a security alert appears, analysts investigate to determine whether it represents a genuine threat.

A basic investigation may involve reviewing the alert, checking related logs, examining affected systems, determining the potential impact, and documenting the evidence.

If the incident is confirmed or requires additional expertise, it may be escalated to the appropriate security team.

## What Is the Difference Between a Security Analyst and a Penetration Tester?

Both roles contribute to organizational security, but their primary objectives differ.

A security analyst focuses on detection and investigation. The goal is to identify suspicious activity, assess potential incidents, and help protect systems.

A penetration tester focuses on identifying and validating security weaknesses. The goal is to assess whether vulnerabilities can be exploited within an authorized testing scope and explain their potential impact.

For example, consider a web application with a weak authentication mechanism.

A penetration tester might investigate whether the weakness allows unauthorized access and document the evidence.

A security analyst might investigate suspicious authentication patterns in application logs and determine whether an account has been targeted or compromised.

These activities address different parts of the security process, but both help an organization manage risk.

## Why Defensive Security Matters for VAPT Professionals :

My primary learning goal is VAPT, so why spend time understanding security analysis?

Because understanding how attacks are detected and investigated can provide useful context for offensive security assessments.

Here are three important connections.

1. Understanding the Impact of Vulnerabilities

A vulnerability report should explain more than the existence of a weakness. It should also describe the potential consequences for the organization.

Understanding security monitoring and incident investigation can help penetration testers communicate how a vulnerability might affect confidentiality, integrity, or availability.

2. Learning How Attacks Appear in Logs

Certain activities during an attack or security assessment may generate events in application, operating system, or network logs.

Understanding these records helps security professionals appreciate how attacks may be detected and investigated.

Testing should always be performed within an authorized scope and in accordance with the organization's rules.

3. Developing a Broader Security Mindset

Cybersecurity is a continuous process involving prevention, detection, response, and recovery.

Penetration testers help identify weaknesses before attackers exploit them. Security analysts help organizations identify and respond to suspicious activity.

Understanding both perspectives can improve communication between offensive and defensive security teams.

## My Key Takeaways from the TryHackMe Lab :-

Completing the Junior Security Analyst Intro room was another step in my cybersecurity learning journey.

The main lessons I took from this experience were:

• Security analysis involves more than simply looking at alerts; it requires investigation and evidence.
• Logs and monitoring help organizations understand events occurring across their systems.
• Indicators of compromise must be interpreted in context.
• Security analysts and penetration testers have different but complementary responsibilities.
• Learning defensive security concepts can provide additional perspective for someone pursuing VAPT.

Hands-on labs provide an opportunity to explore these concepts in a controlled environment and build a stronger technical foundation.

## Conclusion :-

Cybersecurity requires both an understanding of how systems can be attacked and an understanding of how organizations detect and respond to threats.

Completing the TryHackMe Junior Security Analyst Intro room gave me another opportunity to explore the defensive side of security while continuing to focus on my long-term goal of developing practical VAPT skills.

I plan to continue learning through hands-on labs, documenting my progress, and writing about the security concepts I discover along the way.

Learn how weaknesses are found. Understand how threats are detected. Keep improving one step at a time.

#Cybersecurity #TryHackMe #SecurityAnalyst #VAPT #EthicalHacking