AI will not just automate the SOC. It will change who operates it.
The person responsible for the defensive outcome will spend less time working inside individual tools and more time directing, validating, and governing AI across the security operation. They will operate the defense through AI. That professional is the Threat Operator.
A Threat Operator is an AI-native security professional responsible for operationalizing business security risk into defensive operations. This role is already beginning to take shape. From working with security teams across multiple organizations, I see analysts gaining visibility across functions that were previously separated by tools, teams, and queues.
For security leaders, this raises two immediate questions. Who will give AI the context, intent, and boundaries required to defend the business? And if AI performs much of the work that once trained junior analysts, how will the next generation develop the judgment to take responsibility for the defense?
The technology is moving quickly. The profession now needs to catch up.
1. From Operating Tools to Operating the Defense
The SOC was built around specialized functions.
Threat intelligence teams studied adversaries. Threat hunters searched for activity that existing controls missed. Detection engineers wrote rules. Analysts investigated alerts. Incident responders contained confirmed threats.
Each function developed its own tools, processes, and queues. Even when the teams worked well together, the defensive lifecycle was often fragmented.
AI is beginning to connect it.
A new threat can generate a hypothesis. That hypothesis can become a hunt. The hunt can expose a detection gap. A new detection can identify activity that requires investigation. The investigation can lead to containment, with what was learned feeding back into the operation.
The Threat Operator works across this loop. Their starting point is not an alert or a tool. It is the risk to the organization. They determine what matters to the business, which threats could affect it, what defensive outcome is required, and what AI should do about it. They also decide how much autonomy AI should have and whether the resulting operation is reducing risk.
The relationship is straightforward: AI provides scale, reasoning, and execution. The Threat Operator provides context, intent, judgment, and governance. Together, they translate:
Business Security Risk → Threat → Defensive Intent → AI-Orchestrated Action → Measurable Risk Reduction
That is the fundamental shift. Human value moves above the mechanics of individual tools and toward responsibility for the operation as a whole.
2. The Risk Is Losing the Apprenticeship, Not the Queue
The traditional path into security operations has relied heavily on repetitive work. Junior analysts review alerts, gather evidence, follow playbooks, document findings, and escalate cases. That work can be tedious, but hidden inside it is an apprenticeship. Through repetition, analysts learn how systems behave, how attackers operate, and how experienced practitioners make decisions.
As AI absorbs more of those mechanics, the obvious concern is that the first rung of the career ladder will disappear. But preserving the queue is not the answer. Building a better apprenticeship is. Today, a junior analyst may spend months or years seeing only one narrow slice of the operation. They receive an alert after the detection has been created, investigate it inside a specific tool, and escalate it without seeing what happens next.
With AI, that same analyst can gain supervised exposure to the full defensive lifecycle much earlier. They can see how business risk becomes a threat scenario, how intelligence becomes a hunt, how a hunt exposes a detection gap, how an investigation reaches a conclusion, and how a response decision affects the business.
AI can perform time-consuming mechanics while making the evidence and reasoning available for the analyst to examine and challenge. That does not mean giving inexperienced people unlimited autonomy. Technical fundamentals, senior oversight, and real-world experience remain essential. What changes is how those capabilities are developed. Early-career progress should no longer be measured primarily by ticket volume. Better measures are whether someone understands the evidence, identifies missing context, connects technical activity to business impact, and recognizes when an AI-generated conclusion should not be trusted.
The entry-level role can become broader and more valuable, but only if we deliberately redesign it.
3. AI Fluency Is the New Query Fluency
The Threat Operator will need more than the ability to prompt a model. For the previous generation of SOC practitioners, query fluency was a defining skill. Analysts learned how to extract answers from SIEMs, endpoint tools, cloud platforms, and other security systems. The next generation must learn how to direct an intelligent system toward a defensible outcome.
That requires the ability to:
- Provide relevant business and environmental context
- Express defensive objectives, constraints, and escalation criteria
- Evaluate hypotheses, challenge reasoning, and validate evidence
- Distinguish confidence from fact and identify what is missing
- Determine when human approval is required
- Measure whether an action produced the intended security outcome
This is a different form of technical depth. The operator must understand enough about the underlying systems and defensive disciplines to recognize when the AI is wrong, incomplete, or pursuing the wrong objective. It also creates a powerful learning opportunity. When reasoning and evidence are visible, junior professionals can study more situations and understand more of the operation than a traditional queue would expose them to.
Experienced practitioners remain central to that process. Their job is not merely to approve AI output. They must make their own judgment visible, explain what the system missed, and teach less experienced operators how to question it.
The new apprenticeship combines AI-enabled breadth with human-developed judgment.
4. Build the Career Path Before the Old One Disappears
The Threat Operator should become a career path, not a single job description. An early-career Threat Operator might validate evidence, review AI-generated conclusions, add environmental context, and learn how decisions connect across the defensive lifecycle. As they develop, they can translate business risks and threats into defensive objectives, direct agent workflows, identify gaps, and determine when the operation should escalate or act. A senior Threat Operator can define autonomy boundaries, govern consequential actions, evaluate the quality of AI decisions, and measure whether the operation is reducing risk.
At every level, the role combines four areas of expertise:
- Business security risk
- Threat and adversary understanding
- Defensive operations
- AI orchestration and judgment
People will enter this path from different directions. Some will come from investigations, threat intelligence, detection engineering, or incident response. Others will come from security architecture or risk. The objective is to build breadth without losing the depth that made them effective.
Security leaders should not wait until AI has automated large portions of existing work before deciding how people fit into the new model. They should begin asking:
- Which decisions must remain with people?
- What evidence must an operator validate?
- How should autonomy expand as the technology and team earn trust?
- How will junior professionals learn the fundamentals?
- Which skills should determine career progression?
- How will defensive activity connect to measurable risk reduction?
Simply automating the existing queue may improve efficiency while preserving the same fragmented operating model. The larger opportunity is to redesign the work around the outcome.
The SOC Will Become Different, Not Simply Smaller
The Threat Operator is more than a new name for a SOC analyst. The role reflects a shift in where human value sits within security operations.
AI will increasingly handle work across functions that were historically separated. People will provide the business context, defensive intent, judgment, and governance needed to turn that capability into an effective defense.
The transition will be gradual. Job titles will not change overnight, and organizations will adopt different levels of autonomy at different speeds. But the direction is becoming clear. The old SOC trained people to operate tools. The AI-native SOC must train them to operate the defense.
For experienced practitioners, that creates an opportunity to apply their expertise across the entire operation. For junior professionals, it creates a faster path to understanding how the whole defense works. For security leaders, it creates the opportunity to organize around measurable risk reduction instead of activity.
AI is already changing the SOC. Now we need to build the profession that will operate it.