Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Before the Vicious Cycle Starts: Preventing Burnout Across SOC Roles Through Flow-Aligned Design

Kashyap Thimmaraju, Duc Anh Hoang, Souradip Nath, Jaron Mink, Gail-Joon Ahn

TL;DR

This paper investigates SOC burnout through flow theory and the Vicious Cycle, arguing that accurate, flow-aligned job descriptions at hiring can prevent skill-challenge misfit. By analyzing 106 public SOC postings across 11 countries with inductive content analysis, it identifies dominant communication requirements, diverse certification landscapes, and technology-specific patterns (notably Python and Splunk). The authors contribute a public dataset and a preliminary codebook, establishing a baseline for validating whether stated JD requirements align with actual on-the-job demands and how interviews can assess flow readiness. The work lays a foundation for flow-aligned hiring and outlines validation studies and AI-enabled workflows to sustain practitioner engagement and retention in SOCs.

Abstract

The sustainability of Security Operations Centers depends on their people, yet 71% of practitioners report burnout and 24% plan to exit cybersecurity entirely. Flow theory suggests that when job demands misalign with practitioner capabilities, work becomes overwhelming or tedious rather than engaging. Achieving challenge-skill balance begins at hiring: if job descriptions inaccurately portray requirements, organizations risk recruiting underskilled practitioners who face anxiety or overskilled ones who experience boredom. Yet we lack empirical understanding of what current SOC job descriptions actually specify. We analyzed 106 public SOC job postings from November to December 2024 across 35 organizations in 11 countries, covering Analysts (n=17), Incident Responders (n=38), Threat Hunters (n=39), and SOC Managers (n=12). Using Inductive Content Analysis, we coded certifications, technical skills, soft skills, tasks, and experience requirements. Three patterns emerged: (1) Communication skills dominate (50.9% of postings), exceeding SIEM tools (18.9%) or programming (30.2%), suggesting organizations prioritize collaboration over technical capabilities. (2) Certification expectations vary widely: CISSP leads (22.6%), but 43 distinct credentials appear with no universal standard. (3) Technical requirements show consensus: Python dominates programming (27.4%), Splunk leads SIEM platforms (14.2%), and ISO 27001 (13.2%) and NIST (10.4%) are most cited standards. These findings enable organizations to audit job descriptions against empirical baselines, help practitioners identify valued certifications and skills, and allow researchers to validate whether stated requirements align with actual demands. This establishes the foundation for flow-aligned interview protocols and investigation of how AI reshapes requirements. Dataset and codebook: https://git.tu-berlin.de/wosoc-2026/soc-jd-analysis.

Before the Vicious Cycle Starts: Preventing Burnout Across SOC Roles Through Flow-Aligned Design

TL;DR

This paper investigates SOC burnout through flow theory and the Vicious Cycle, arguing that accurate, flow-aligned job descriptions at hiring can prevent skill-challenge misfit. By analyzing 106 public SOC postings across 11 countries with inductive content analysis, it identifies dominant communication requirements, diverse certification landscapes, and technology-specific patterns (notably Python and Splunk). The authors contribute a public dataset and a preliminary codebook, establishing a baseline for validating whether stated JD requirements align with actual on-the-job demands and how interviews can assess flow readiness. The work lays a foundation for flow-aligned hiring and outlines validation studies and AI-enabled workflows to sustain practitioner engagement and retention in SOCs.

Abstract

The sustainability of Security Operations Centers depends on their people, yet 71% of practitioners report burnout and 24% plan to exit cybersecurity entirely. Flow theory suggests that when job demands misalign with practitioner capabilities, work becomes overwhelming or tedious rather than engaging. Achieving challenge-skill balance begins at hiring: if job descriptions inaccurately portray requirements, organizations risk recruiting underskilled practitioners who face anxiety or overskilled ones who experience boredom. Yet we lack empirical understanding of what current SOC job descriptions actually specify. We analyzed 106 public SOC job postings from November to December 2024 across 35 organizations in 11 countries, covering Analysts (n=17), Incident Responders (n=38), Threat Hunters (n=39), and SOC Managers (n=12). Using Inductive Content Analysis, we coded certifications, technical skills, soft skills, tasks, and experience requirements. Three patterns emerged: (1) Communication skills dominate (50.9% of postings), exceeding SIEM tools (18.9%) or programming (30.2%), suggesting organizations prioritize collaboration over technical capabilities. (2) Certification expectations vary widely: CISSP leads (22.6%), but 43 distinct credentials appear with no universal standard. (3) Technical requirements show consensus: Python dominates programming (27.4%), Splunk leads SIEM platforms (14.2%), and ISO 27001 (13.2%) and NIST (10.4%) are most cited standards. These findings enable organizations to audit job descriptions against empirical baselines, help practitioners identify valued certifications and skills, and allow researchers to validate whether stated requirements align with actual demands. This establishes the foundation for flow-aligned interview protocols and investigation of how AI reshapes requirements. Dataset and codebook: https://git.tu-berlin.de/wosoc-2026/soc-jd-analysis.
Paper Structure (19 sections, 1 figure, 8 tables)

This paper contains 19 sections, 1 figure, 8 tables.

Table of Contents

  1. Introduction
  2. SOC Organizational Structure and Roles
  3. Theoretical Frameworks for Understanding SOC Burnout
  4. The Challenge-Skill Balance and Its Implications for SOC Hiring
  5. SOC Job Description Analysis
  6. Data Collection
  7. Coding Methodology
  8. Data Quality Observations.
  9. Our Preliminary Findings
  10. Discussion
  11. Connecting Findings to the Flow Channel
  12. Connecting Findings to the Vicious Cycle Theory and Challenge-Skill Balance
  13. Follow-Up Validation Studies Needed
  14. Recommendations and Future Work
  15. Related Work
  16. ...and 4 more sections

Figures (1)

  • Figure 1: The Flow Channel: Challenge-Skill Balance. When skills match challenges, individuals enter the flow state. Skills below challenge level lead to anxiety (underskilled), while skills exceeding challenges result in boredom (overskilled).