Most of this industry splits into two kinds of employer: the operation that buys its tools, and the vendor that builds tools it never has to run. We do both, and the people doing them sit together. The procedures our platform executes were written by our own analysts, and when an investigation needs tooling that does not exist for a customer estate, someone here writes it.
That is why AI developers are on shift in every SOC at every hour, alongside the senior analysts, the incident responders and the L3 analysts. It is an unusual way to staff a security operations centre and it is the thing most worth knowing about working here.
The analysts wrote the method. The engineers made it run. Neither team hands work over a wall.