The Named Roles

Secure60 maintains eight standard agent templates covering the most common security operations roles. Each role is designed to handle a specific set of tasks using the data, rules and context already in the platform.

Work with Secure60 to determine which roles make sense for your environment and to configure them for your specific needs.

Role 01 — L1 Triage Analyst

Performs initial assessment of incoming threats. Reads the signal, gathers context from related events and entities, and produces a structured triage summary with a recommended priority.

What it does:

• Reads incoming threats and related signals
• Gathers context from entity history and related events
• Produces a structured triage summary
• Recommends priority and next steps

Best suited for: Organisations with high alert volumes who want consistent, fast initial triage across all incoming threats.

Role 02 — SOC L2 / L3 Analyst

Deeper investigation of escalated threats. Correlates across data sources, builds a timeline of activity, identifies scope of impact, and produces detailed investigation notes.

What it does:

• Correlates events across multiple data sources
• Builds activity timelines
• Identifies lateral movement and scope of impact
• Produces detailed investigation findings

Best suited for: Teams that need deeper analysis after initial triage, or where L2/L3 analyst time is the bottleneck.

Role 03 — Threat Hunter

Proactive searching for indicators and attack patterns across historical data. Runs hunts based on threat intelligence, known TTPs, or hypotheses about attacker behaviour.

What it does:

• Searches historical data for indicators of compromise
• Correlates findings against threat intelligence feeds
• Identifies patterns and anomalies that detection rules may miss
• Documents findings as new threats or knowledge

Best suited for: Organisations that want proactive threat hunting capability without dedicating full-time analyst resources.

Role 04 — Detection Engineer

Reviews detection rule coverage, identifies gaps, and recommends improvements. Analyses false positive rates and suggests tuning adjustments.

What it does:

• Reviews existing detection rule effectiveness
• Identifies coverage gaps based on threat landscape
• Recommends rule tuning to reduce false positives
• Suggests new detection logic based on observed patterns

Best suited for: Teams that want to continuously improve detection quality without dedicating permanent detection engineering resource.

Role 05 — Vulnerability Manager

Monitors vulnerability scan results, prioritises based on environment context, and tracks remediation progress. Cross-references with threat intelligence to highlight actively exploited vulnerabilities.

What it does:

• Reviews vulnerability scan findings
• Prioritises based on environment context and threat intelligence
• Tracks remediation timelines and escalates overdue items
• Produces vulnerability posture summaries

Best suited for: Organisations running Secure60 vulnerability management who need consistent prioritisation and tracking.

Role 06 — Governance & Compliance Tracker

Monitors control review schedules, evidence collection status, and compliance posture. Produces regular compliance summaries and flags overdue items.

What it does:

• Tracks control review schedules and deadlines
• Monitors evidence collection status
• Flags overdue reviews and missing evidence
• Produces compliance posture summaries

Best suited for: Regulated organisations that need continuous visibility of their compliance posture across frameworks (PCI DSS, ISO 27001, NIST CSF, ASD Essential 8, AI governance frameworks).

Role 07 — Incident Responder

Coordinates response activity during active incidents. Gathers relevant evidence, tracks containment actions, and maintains an incident timeline.

What it does:

• Gathers and correlates evidence relevant to an incident
• Tracks containment and remediation actions
• Maintains a structured incident timeline
• Produces incident summary documentation

Best suited for: Teams that need structured incident response coordination, particularly during after-hours or when response capacity is limited.

Role 08 — Risk & Audit Reporter

Produces executive-level risk and audit reports. Aggregates findings across pillars into structured summaries suitable for board reporting and audit evidence.

What it does:

• Aggregates threat, vulnerability and compliance data
• Produces structured risk summaries
• Generates board-ready reporting content
• Creates audit evidence packages

Best suited for: CISOs and risk teams who need regular executive reporting without manual data aggregation.

Custom Roles

The eight named roles cover the most common needs, but every organisation is different. Secure60 can scope and build custom workers tailored to your specific operational requirements. See Custom Workers for details on the process.