SOC Analyst
SOC analysts work in a security operations center (SOC), where they triage alerts from security sensors and monitoring tools and decide whether the activity points to a real incident. Many SOCs organize analysts in tiers, with tier 1 analysts handling front-line alert triage and tier 2 and higher analysts handling in-depth investigation, analysis, and response.
Related job titles
- Security operations center analyst
- Intrusion detection analyst
- Tier 1 SOC analyst
- Triage analyst
- Alert analyst
What They Do
10 tasks- Monitor near-real-time security alert feeds and perform triage and short-turn analysis of potential security incidents.
- Evaluate the disposition of each alert, drilling down to raw data to decide whether it reflects a confirmed incident or benign activity.
- Validate network and intrusion detection system alerts and determine their causes.
- Receive and process reports of potential security incidents from users, the IT help desk, other SOCs, and third parties.
- Escalate incidents that may cause ongoing and immediate impact, following the SOC's escalation procedures.
- Notify designated managers, incident responders, and service provider team members of suspected incidents.
- Document incidents and pass open cases and anomalous activity that needs further analysis or escalation to the incoming shift.
- Analyze network traffic anomalies and examine host activity on disk, in memory, and on attached devices.
- Use cyber threat intelligence and indicator analysis to connect related adversary activity, incidents, indicators, and artifacts.
- Communicate daily reports on network events and activity.
Knowledge and Skills
- Intrusion detection tools and techniques
- Incident response and incident handling tools and techniques
- Computer networking protocols and network communications
- Cybersecurity threats, vulnerabilities, and threat characteristics
- Cyber defense tools and techniques, including SIEM, SOAR, and EDR platforms
- Operating systems and server administration
- Structured analytic techniques such as indicator analysis
- The monitored organization's systems, users, and normal activity
How to Become a SOC Analyst
MITRE describes tier 1 alert triage as a growth position and notes that most SOC professionals started as junior analysts. People moving into SOC work often come from the IT help desk, other areas of cybersecurity, software and systems development, or system administration. Candidates with a system administration or penetration testing background can usually pick up the SOC specifics within weeks or months.
MITRE does not consider a formal degree or five years of IT experience a necessary requirement for incoming analysts, and notes that many SOC staff have no college degree or a degree in an unrelated field. Factors that make a candidate stand out include capture-the-flag events, open-source security projects, previous IT and cloud experience, and internships in cyber operations.
According to CompTIA, most companies hiring SOC analysts seek a bachelor's degree in computer science, cybersecurity, or a related field, and many SOC analysts previously worked as network or systems administrators.
SANS describes three analyst tiers: tier 1 analysts (triage specialists) pass suspicious activity to tier 2 analysts (incident responders), and tier 3 analysts (threat hunters) sit at the top of the hierarchy. SANS lists SOC team lead, SOC manager, security architect, and chief information security officer (CISO) as later leadership roles.
Certifications
1 certificationsThese are certifications that the sources on this page name for the role, as described in the FAQ.
| Certification | Issuer |
|---|---|
| CySA+ CompTIA Cybersecurity Analyst · CompTIA | CompTIA |
Frequently Asked Questions
What does a SOC analyst do?→
A SOC analyst monitors security alert feeds in a security operations center, triages potential incidents, and decides whether an alert reflects a confirmed incident. Analysts validate alerts, take in reports from users and other teams, document incidents, and escalate them to incident responders and managers.
What are the tiers of SOC analysts?→
In SOCs that use tiers, tier 1 analysts handle front-line alert triage and tier 2 and higher analysts handle in-depth investigation, analysis, and response. MITRE notes that not all SOCs are arranged this way. SANS describes tier 1 analysts as triage specialists, tier 2 analysts as incident responders, and tier 3 analysts as threat hunters.
Is SOC analyst an entry-level job?→
MITRE describes tier 1 as a growth position and notes that most SOC professionals started as junior analysts. It recommends that candidates switching from other careers also be considered for entry-level positions when they show passion for the role and good analytical skills.
What is the difference between a SOC analyst and a cybersecurity analyst?→
CompTIA notes that a cybersecurity analyst may be the only cybersecurity professional in an organization, while SOC analysts are generally part of a large security operations team.
What certifications does a SOC analyst need?→
CompTIA states that a certification like CompTIA Cybersecurity Analyst (CySA+) can help candidates gain the skills to become a SOC analyst. MITRE lists SANS GIAC, Offensive Security, and product-specific training among external training options for SOC staff.
What tools does a SOC analyst use?→
SOC analysts work with SIEM, SOAR, and big data analytic platforms that collect, store, correlate, and display security data feeds for triage, analysis, escalation, and response. MITRE also names EDR among the tools analysts may know in depth.
Role descriptions follow the sources listed above: U.S. government workforce data first, then standards bodies and, where named in the text, certification issuers. This site is not affiliated with CISA, the Department of Labor, or the Department of Defense. Last verified Oct 28, 2026.