AI is reshaping security operations and creating a new role

Security experts are witnessing a shift in how security operations are run as AI begins to handle increasing portions of the work traditionally done by analysts. The Hacker News reports that AI-driven systems can investigate alerts, collect evidence, correlate activity across tools, and even execute response actions. The trend is driving changes in organisation-wide security governance, decision-making, and the expectations placed on staff in security operations centres (SOCs).

The piece introduces the new role of the Threat Operator, an AI-native security professional who translates business risk into defensive priorities, directs AI-led operations, and exercises human judgment over AI-made decisions.

The Threat Operator is described as overseeing the defensive lifecycle, balancing how much autonomy AI should have with the need for human oversight, and determining when human intervention is required. The role would require blending four areas of expertise: business security risk, threat and adversary understanding, defensive operations across detection to response, and AI orchestration and judgment.

The article uses a banking example to illustrate how a Threat Operator would assess exposure, guide AI hunting and detection improvements, and specify which actions require authorisation. It also highlights a shift from human-in-the-loop to human-on-the-loop supervision, with accountability remaining with humans regardless of AI maturity.

In addition, the piece notes implications for career development, suggesting junior analysts could gain experience across a broader security spectrum under structured mentorship, and cites Conifers[.]ai’s CognitiveSOC platform as an example of an AI-enabled, evidence-backed approach to coordinating and governing AI-driven defence across the SOC lifecycle.