Shift work, alert fatigue and burnout

A SOC asks you to stay alert to rare, important events inside a stream of common, unimportant ones, often at hours your body would rather sleep. That is hard for anyone. It is not a personal weakness if it wears on you.

Alert fatigue

Alert fatigue is what happens when you see the same harmless alert so often that you stop really looking. It is dangerous because it feels like efficiency. You close faster, and you check less.

• Notice when you close an alert without opening the raw event. That is the warning sign.
• Take a short break after a run of identical alerts, even five minutes.
• Turn repeated noise into a tuning request. It helps you and everyone after you.
• Rotate alert types with a colleague if your team allows it.

Shift work

1. Protect your sleep window like a meeting you cannot move. Dark room, phone away.
2. Keep the handover sacred. A clear handover means you can actually stop thinking about work.
3. Plan meals and exercise around the shift, not around everyone else's day.
4. Tell the people you live with your rota, so they can help protect your rest.

Signs of burnout

Burnout tends to creep in. Watch for dread before shifts, cynicism about the work, feeling that nothing you do matters, trouble switching off, and making careless mistakes you would not have made before. If several of these are true for weeks, talk to someone: your lead, a colleague you trust, or a health professional.

Look after the people around you too. If a colleague has had a hard incident or a run of nights, offer to take the next difficult alert or simply ask how they are doing. Teams that notice each other's tiredness catch problems earlier, in people and in the queue.

Rule of thumb:Rule of thumb: a tired analyst is a detection gap. Rest is not time away from security work. It is part of it.