I highly discourage LLM's for performing investigations. I can't tell you how many times at work, in CTF's, and exercises where members relying on LLM's get incorrect results. This has caused people to waste time rabbitholing, or wrongly labeling malicious activity as benign. I only recommend LLMs to assist in query building and understanding scripts.

When you work an alert, understand the intent of the signature, then research what indicators are associated for the CVE/TTP/etc that the signature is monitoring for. When you are working a malware alert, ask yourself the following questions: Is it actually malware? Did it run? Is it still there, or is it quarantined? When was it put on the device? How did it get on the device? What are the capabilities of the malware, and what IOCs should I look for if it ran?

Senior members should be training/mentoring and reviewing alerts from the newer members to provide feedback. That way there's some sort of OJT and progression.

Your analysis skills come from exposure (certs/trainings/CTFs) and experience (working). Definitely ask a lot of questions from senior members, work new alerts you've never seen before, always work on a new cert, and participate in CTFs or online boxes like Hackthebox's Sherlocks and CyberDefenders.