L1 Analyst (Tier 1 Analyst)

L1 analysts are typically the first responders to security alerts. They review incoming alerts, perform basic enrichment, apply initial triage logic, and either dismiss alerts as false positives or escalate them to L2 analysts for deeper investigation. L1 analysts often work in high-volume environments and are most exposed to alert fatigue. A large proportion of L1 work consists of repetitive, manual tasks that are strong candidates for automation.