Inside the University of South Florida’s Student Operations Center Apprenticeship Program (SOCAP), students are gaining hands-on experience in cybersecurity while also contributing to research on the use of artificial intelligence in the field.
Faayed Al Faisal, a doctoral student in computer science at USF, highlighted the challenge facing the industry: “Surveys show about 70% of cybersecurity professionals in security operations centers are disgruntled or worn out.” As cyber threats continue to rise, Al Faisal and fellow student Kritan Banstola are examining how AI can help reduce the burden on analysts without replacing them.
“AI is something you can’t get away from in today’s world, right?” Al Faisal said. “So why not learn how to best implement it? This research is not looking for ways to replace workers, but for ways to enhance their work. You need to learn how to embrace AI or you may get left behind.”
SOCAP offers a paid apprenticeship where students from any academic background train as cybersecurity analysts, working inside the Cyber Florida Security Operations Center (SOC). Here, they detect and respond to real threats affecting USF and its public-sector partners.
Ryan Irving, SOCAP manager, explained the program’s approach: “We have MOUs with, and have worked with, the 12th Judicial Circuit of Pinellas County, the Orange County Comptroller and others. Our main goal is to hire students with little to no experience, really from any degree program, and give them practical, hands-on experience that bridges the gap between academia and industry. They accelerate their learning well past their peers, and the proof is in the pudding. We’ve had students go on to work for the university all the way up to Google.”
To prevent burnout—a common issue in security operations centers—Cyber Florida’s SOC limits hours and workload for students. Irving noted: “It’s a little softer here because it is still a learning environment. There is a bit more leeway here.”
Al Faisal described one of the challenges in SOC work: “A lot of times, you’re stuck at a desk all day, triaging alerts that take very little creativity. The tickets aren’t interesting.” This monotony can prevent analysts from focusing on higher-level threats.
Simon Ou, professor in USF’s Bellini College of Artificial Intelligence, Cybersecurity and Computing, posed an important question: “When one step becomes low-creativity, the brain checks out. So, how can AI help?”
To address this question, Ou encouraged Al Faisal and Banstola to immerse themselves in SOCAP as regular interns. Duy Dao, SOCAP assistant manager, explained: “They need to build a pathway to their research, and for them to do that efficiently, they need domain experience. They must understand what cybersecurity analysts are going through and they must understand the workflow. The only way to know that is to do that.”
The researchers are focusing on using AI tools not as replacements but as aids. Irving said: “I don’t want AI to take over. We don’t want people to say, ‘Well, this is what AI said to do, so that must be right.’ AI is not always accurate or accurate enough. So instead, the tools should be used as a starting point that humans can validate or use to validate.”
The team hopes their findings will serve as guidance for industry adoption of AI in security operations centers. Ou stated: “Our research aims at discovering effective approaches of integrating AI into SOC operations. Findings from the research can inform industry where companies need scientifically verified guidance on how to build AI solutions for cybersecurity.”
Early analysis suggests that using AI could help filter irrelevant alerts before they reach analysts and combine related alerts into single case files—allowing analysts more time for complex tasks.
“Level 1 triage is a good candidate for AI,” Al Faisal said. “It’s not about replacing the analyst — it’s about letting them focus on the work that matters.”
Ou added that current SOC software relies heavily on rigid rules that cannot keep pace with evolving threats: “With traditional tools, you have to write very precise instructions. They become unwieldy and break easily. Hackers change tactics all the time, and your tool becomes stale.” By contrast, he explained that AI systems can learn from previous data and adapt accordingly: “It can learn the nuances. Once again, AI is not replacing analysts. It’s the opposite — AI needs the creativity of the human analysts in order to improve.”
The university encourages those interested in cybersecurity innovation to attend CyberBay 2025—a conference supported by USF—which brings together experts and provides opportunities for networking and hands-on experience with emerging solutions.
For more information or tickets visit cyberbay.org.
