What is a SOC Analyst?

A SOC analyst works in a security operations center (SOC), watching an organization’s security alerts, deciding which ones are real attacks, and escalating or containing the real ones. Most people reach the job from an IT role: in ISC2’s 2025 Cybersecurity Workforce Study, 56% of respondents said IT experience was their way in, and 6% said earning certifications.

That study covers every cybersecurity role worldwide, but SOC hiring looks the same up close. KORE1, a staffing firm, describes a hospital’s Tier 2 SOC posting that drew 41 applications: “Most were help desk technicians with a new Security+ and no incident work behind it.” A certificate gets you past a filter. What gets you a Tier 1 interview is investigation work you really did, in an IT job or a home lab, written so a hiring manager can follow your reasoning.

In short:

• The job: triage alerts from security tools, close the false alarms, document what you found, and escalate or contain the real threats, usually on a schedule that covers nights and weekends.
• The usual first job before it: help desk, IT support, network operations (NOC) or systems administration.
• Pay: about $58,000 base for a new Tier 1 hire, by one staffing firm’s count. Job postings average close to $107,000, but that figure mixes every level.
• What gets Tier 1 interviews: documented investigations, written in the job post’s own terms.

What Does a SOC Analyst Do?

A SOC analyst decides, alert by alert, whether something on the network is normal activity or an attack, and then acts on that decision. The US government’s NICE Framework, which defines cybersecurity work roles, files this job under Defensive Cybersecurity: “Responsible for analyzing data collected from various cybersecurity defense tools to mitigate risks.” Its task list reads like a Tier 1 shift: “Validate network alerts,” “Distinguish between benign and potentially malicious cybersecurity attacks and intrusions,” and “Escalate incidents that may cause ongoing and immediate impact to the environment.”

The alert-to-ticket loop

Most of a Tier 1 shift repeats one loop:

1. An alert fires. A rule in the SIEM (security information and event management, the system that collects logs from across the company) or a detection on an endpoint tool flags something: a login from an unusual country, a script launched from a Word document, a user reporting a strange email.
2. You triage it. You pull context: which user, which machine, what happened just before and after, and whether this alert has fired before.
3. You reach a verdict. It is a false positive (the rule misfired), a benign true positive (real activity, but allowed, such as an IT admin running a scan), or something malicious.
4. You document it. Every alert ends in a ticket that records the checks you ran, what they showed and the reason for your verdict. The next analyst, or an auditor, reads that note.
5. You escalate or contain. A confirmed threat goes to Tier 2 or the incident response team. Depending on your SOC’s runbook (its written procedures), you may also contain it yourself, for example by isolating a laptop from the network or disabling a compromised account.
6. You feed back. If a rule produces the same false positive every day, you flag it for tuning so the next shift sees fewer of them.

A phishing report, start to finish

A user forwards an email that asks them to “confirm your payroll details.” You check the sender’s domain and the email headers, open the link in a sandbox or look it up in a reputation service, and search the mail logs for everyone else who received the same message. If the link harvests passwords and two people clicked it, you escalate with the list of recipients, the clickers and the time of each click, and you follow the runbook for resetting those accounts. If the email is a real (if clumsy) message from the payroll vendor, you close the ticket and note why.

That is the whole job in miniature: evidence, a verdict and a written trail.

In-house SOC or managed security provider

SOC analysts work in one of two settings. An in-house SOC protects one organization, so you learn its systems, its users and its normal patterns in depth. A managed security service provider (MSSP) or managed detection and response (MDR) company runs a SOC for many client organizations at once, so you see more environments and more types of attack, but each client less deeply.

What a shift looks like

Security does not stop at 5 p.m., so most SOCs run around the clock. The SANS 2025 SOC Survey, a global survey of SOC professionals, found that “79% of SOCs are operational 24/7” and that 73% allow remote work. That means rotating shifts. Huntress, a managed security company, describes shifts that “may be non-traditional work hours or weekends”, including “ten-hour shifts over four work days or twelve-hour shifts over three days.” The Bureau of Labor Statistics (BLS) adds that analysts in the broader occupation “sometimes have to be on call outside of normal business hours in case of an emergency.”

The other constant is alert volume. A busy queue with many false positives wears people down, a problem SOC teams call alert fatigue.

How to Become a SOC Analyst

The most common route into a SOC runs through an IT job, then a Tier 1 analyst role. Beyond the 56% figure above, ISC2 found that 36% of respondents “took on cybersecurity responsibilities while in an IT role before moving into a cyber-focused role.” BLS says that “many analysts have experience in an information technology department, often as a network and computer systems administrator.” Huntress’s own Senior Security Operations Analyst, Tim Kasper, started on the company’s support team and moved to the SOC as a junior Tier 1 analyst.

Education

BLS has no SOC analyst category. For the closest one, information security analysts, it lists a bachelor’s degree as the typical entry level, usually in a computer-related field, and notes that “some workers enter the occupation with a high school diploma and relevant industry training and certifications.” Huntress goes further for Tier 1 specifically: “no specific certifications, academic degrees, or previous career path is required to become a Tier 1 SOC analyst.” In practice, a degree helps you pass resume filters at larger employers, and documented hands-on work helps you everywhere.

Start in an IT job that sees security tickets

Help desk, IT support, NOC and systems administration jobs all touch security work. Ask for it. Volunteer for phishing reports, account lockouts, endpoint alerts and access reviews. Each one is a small investigation you can later describe on a resume, and each one teaches you what normal activity looks like in a real company, which is exactly what Tier 1 triage depends on.

Learn the fundamentals SOC work runs on

Tier 1 interviews and day-one tasks lean on a short list of basics:

• Networking: TCP/IP, DNS, HTTP and what normal traffic looks like
• Operating system logs: Windows Security event logs and Linux system and authentication logs
• How attacks unfold: the MITRE ATT&CK framework, a public catalog of attacker techniques that SOCs use to label what they see
• One SIEM query language: Splunk’s SPL or Microsoft Sentinel’s KQL

Build a home lab and write up what you find

A home lab lets you practice the alert-to-ticket loop before anyone pays you to. A typical setup is a Windows virtual machine, a Linux virtual machine and a free or trial SIEM collecting logs from both. Run a simulated attack, find it in the logs, write a detection for it, and document the result the way you would write a ticket. Guided platforms such as TryHackMe, Hack The Box and Blue Team Labs Online offer defensive exercises if you want structure. The write-up matters more than the lab itself: it is the proof a hiring manager can read.

Rewrite help desk and lab work into Tier 1 resume bullets

Most IT resumes describe tickets closed. A SOC resume describes investigations: what you noticed, what you checked, what you decided and who you told. The pairs below are examples to show the shape. Use only work you really did, and if you do not remember an exact metric, do not invent one. A concrete action and outcome are still stronger than a made-up figure.

Phishing reports

• Weaker: “Handled help desk tickets and password resets.”
• Stronger: “Reviewed phishing emails that employees reported, checked headers and links against reputation services, and escalated confirmed phishing to the security team with a list of everyone who received the message.”

Why it works: the whole Tier 1 loop (report, check, verdict, escalation) fits in a single line.

Account lockouts

• Weaker: “Resolved account lockout issues.”
• Stronger: “Traced repeated account lockouts to their source machine using Windows Security event logs, and flagged a pattern of failed logins from one host to the security team for review.”

Why it works: it proves you can read logs and spot a pattern, which is the skill a SIEM query depends on.

Home lab detection

• Weaker: “Built a home lab to learn cybersecurity.”
• Stronger: “Built a home lab with Windows and Linux virtual machines feeding a SIEM; wrote a detection for suspicious PowerShell activity and documented the alerts it produced, the false positives, and the tuning that reduced them from [number] a week to [number].”

Why it works: naming the tools, the detection and the tuning gives an interviewer something specific to ask about. Fill in the brackets only with counts you recorded, or drop the numbers.

Network operations

• Weaker: “Monitored the network for issues.”
• Stronger: “Monitored network alerts on a 24/7 NOC rotation, separated outages from suspicious traffic, and handed security-relevant events to the SOC with timestamps, affected hosts and the steps already taken.”

Why it works: shift work, triage judgment and clean handoffs are three things every SOC needs, and this bullet shows all three.

Draft these in Teal’s AI Resume Builder. You can import your current resume, your LinkedIn profile or pasted text, then keep a separate version for each SOC posting you apply to.

Read the SOC job post

SOC postings with similar titles can describe different jobs. Before you tailor anything, read each post for five things:

• Years asked, not just the title. A title alone does not tell you the tier. Huntress’s Security Operations Analyst - West Coast Shift posting asks for “4+ years of experience in a SOC or Digital Forensics (DFIR) role,” so it is a mid-level job, not a Tier 1 one. Look for “SOC Analyst I,” “Tier 1” or “Associate” when you are starting out.
• The shift pattern. The same Huntress posting says the schedule “may include weekend or a 4x10 shift.” Look for nights, weekends, rotations, on-call duty and whether a shift differential is paid.
• Provider or in-house. KORE1 reports that “an MSSP seat pays $5,000 to $10,000 less than the same tier at an in-house corporate SOC.” For a first SOC job, the wider mix of cases can be worth that gap.
• The tools named. Note which SIEM and endpoint tools the post lists, and which of them you have used for real or in a lab.
• Clearance. KORE1 says an active TS/SCI clearance adds $15,000 to $30,000 to a SOC offer around Washington. Check whether the post asks for one.

Save each posting in Teal’s Job Tracker, which is free, and note its shift, setting, years and tools. When you have ten saved, you can see which ones are really Tier 1 jobs and which ones you should apply to first.

Match your resume to one SOC posting

Pick the posting you want most and compare your resume against it. Paste it into Teal’s Job Description Match to see which of its keywords your resume does not yet include. The free version shows the top 5 keywords; Teal+ shows all of them and lets you add custom ones.

Then decide which terms honestly describe your work. Use standard terms from the job description when they describe your experience, such as “alert triage” or “phishing analysis.” Do not copy full sentences, add skills you do not have, or repeat keywords unnaturally. If the post asks for something you have not done, show your closest relevant experience and let the employer decide whether the gap is acceptable.

SOC Analyst Skills

A SOC analyst needs enough technical depth to read the evidence and enough judgment to act on it under time pressure. Here is how each skill shows up on shift and how you can show it before you have the title.

Technical skills

Tier 1 work is mostly reading: logs, alerts, email headers and process trees. Most Tier 1 roles do not require you to be a programmer, but basic scripting helps you automate the lookups you repeat every shift, and it matters more as you move toward Tier 2 and detection work.

Working skills

Much of the job is writing. A Tier 1 analyst who writes “checked it, looks fine” creates work for everyone after them. One who writes what was checked, what was found and why it was closed saves the next analyst an hour. Escalation judgment matters just as much: escalating everything floods Tier 2, and escalating too little lets a real incident sit. On a resume, show both with examples, not adjectives. “Detail-oriented” says little. A bullet about the lockout pattern you traced says a lot.

SOC Analyst Tools & Software

SOC analysts spend their shifts in a small set of tool categories. The specific products change by employer, but the categories stay the same.

Which tools to learn first

Learn one SIEM well before you sample many. Splunk and Microsoft Sentinel both appear often in postings, and each has its own query language (SPL and KQL). Once you can write searches in one, the second takes far less time. For endpoint tools, the concepts carry over between products: process trees, parent and child processes, and what isolation does.

On your resume, list only the tools you have used, and say where. “Splunk (home lab)” is honest and still useful to a recruiter scanning for the name.

SOC Analyst Job Titles & Career Progression

The SOC career ladder runs from triage to investigation to proactive hunting, then to leading a team. OffSec, which trains SOC analysts, describes Tier 1 as “daily monitoring and alert triage,” Tier 2 as the analysts who “assess the extent of any attacks that have been escalated from Tier 1,” and Tier 3 as “proactive threat hunting.”

Title variants to search

Employers name the same work in different ways, so search for all of these:

• SOC Analyst I, II, III (or Tier 1, 2, 3 SOC Analyst): the most common pattern
• Associate SOC Analyst or Junior SOC Analyst: usually entry level
• Security Operations Analyst: can be any level, so check the years asked
• Cyber Defense Analyst: the NICE Framework’s earlier name for its Defensive Cybersecurity role
• Security Analyst: a broad title that often includes SOC monitoring

SOC tiers at a glance

The experience bands below are typical, not rules. Employers set their own.

Where the role leads

OffSec names SOC manager and incident responder among the next steps. Other common moves are threat hunting, threat intelligence, detection engineering (writing and maintaining the rules the SOC runs on) and digital forensics. The path you pick usually follows the part of the job you liked best: investigation, research, building detections or leading people.

For a model resume, see Teal’s information security analyst resume examples, which include a SOC analyst sample.

SOC Analyst Salary & Work-Life Balance

Plan on about $58,000 base for a first Tier 1 job, by one staffing firm’s count, with pay climbing at each tier after that. The six-figure numbers you see quoted for “SOC analyst” are real, but they measure something else: a posting average across every level, or a government median for a broader occupation. Read the “What it measures” column before comparing any two rows.

SOC analyst pay by source

Why the figures disagree

• The government figure covers more than SOC work. KORE1 points out that the information security analyst occupation also holds security architects and policy writers, so its median sits well above what a new Tier 1 analyst earns.
• The posting average mixes every level. Indeed’s figure blends postings at every level from the past three years, and it comes only from postings that list a salary.
• The staffing firm sees offers by tier. KORE1’s bands blend salary-site data, BLS percentiles and offers its recruiters saw over the past year, so they are one firm’s view of the market, but they are the only source here with a figure for each tier.
• One employer is one employer. The Huntress and Expel rows show what specific posted roles pay. They are useful as anchors for a level, not as a market average.

Treat the posting average and the government median as where the career can go, not where it starts. Location moves the number too: Indeed lists Denver ($128,786) and Raleigh ($119,119) among its highest-paying cities for the title.

Shift pay and how offers move

Nights and weekends can add pay, but not always. KORE1 says a night differential “usually runs $5,000 to $8,000 a year. Plenty pay nothing,” and puts a night-shift Tier 1 offer at “$62,000 to $70,000 base in a mid-cost metro.” The hospital whose $78,000 Tier 2 posting drew those 41 applications reposted the role at $94,000 plus a $6,000 overnight differential, and hired at $97,000. Ask about differential pay before you accept a night rotation.

What the job market looks like

The long-term outlook is strong, and the short-term market is tight. BLS projects employment of information security analysts to grow 21% from 2025 to 2035, with about 14,100 openings each year. ISC2’s 2025 study of cybersecurity workers worldwide, meanwhile, found that 24% of respondents reported layoffs in 2025, that “nearly half (49%) of enterprise organizations are still implementing cybersecurity hiring freezes,” and that 20% received no salary increase over the past year. The door is open, but expect a longer search than the growth figure suggests.

Work-life balance

Shift work is the biggest factor. Rotating nights and weekends, a long alert queue and the pressure of not missing the one real attack can wear people down. In the SANS 2025 survey, 62% of SOC professionals said their organization “isn’t doing enough to retain top staff.” The most common tenure was three to five years (31%), with “very few staying 10-plus years (4%).”

Short tenures are not only a sign of burnout. Many analysts move up or across within that window, into incident response, engineering or management. The SOCs people stay in tend to tune their alerts, rotate shifts fairly and give Tier 1 a clear path to Tier 2. In interviews, ask how the team handles noisy alerts and how analysts move between tiers.

SOC Analyst Professional Development Goals

The goals that move a SOC analyst forward are the ones that turn triage into investigation and investigation into better detections.

Write and tune one detection rule

Pick a noisy alert in your SOC or your lab, find out why it misfires, and propose a better rule. Why: tuning shows you understand what the rule is looking for, and it is the first step toward detection engineering.

Finish one incident write-up from alert to closure

Take one real case (or a lab simulation) and write it up completely: the first alert, each thing you checked, the verdict, the containment and what changed afterward. Why: a clean write-up is the strongest proof of Tier 2 readiness, and it gives you a story for every interview.

Learn one SIEM query language in depth

Go past copy-and-paste searches in SPL or KQL until you can build a query from scratch to answer a new question. Why: query fluency is what lets you investigate instead of waiting for someone else to.

Take escalations, not just alerts

Ask to shadow Tier 2 on escalated cases, or to own the follow-up on the incidents you escalate. Why: seeing what happens after your escalation teaches you what Tier 2 needs from your notes and shows your manager you are ready for the next tier.

Map your cases to MITRE ATT&CK

Label each confirmed incident with the techniques the attacker used. Why: it builds the shared vocabulary that Tier 2, Tier 3 and threat intelligence teams work in.

How AI triage changes the job

AI tools are arriving in SOCs, and the evidence so far points in more than one direction. Gartner’s research summary on the topic says “people will always contribute key capabilities to the SOC,” and that security and risk management leaders “should focus the utility of AI and automation toward augmentation, not replacement.” Microsoft researchers studied their own Security Copilot Phishing Triage Agent in a randomized trial with 167 outside security analysts, published as a preprint that has not been peer reviewed. On phishing triage only, analysts working with the agent showed a 77% improvement in verdict accuracy, and the authors report that analysts “were not prone to rubber-stamping the agent’s malicious verdicts.” In the SANS 2025 survey, by contrast, “AI/ML is at the bottom of the satisfaction list” of SOC tools. Employers are building in this direction anyway: a Huntress engineering posting says the company “is building an Agentic SOC,” where an AI agent investigates a signal end to end, and describes the team working closely with SOC analysts.

For your goals, this means the skills above still matter when an agent drafts the first verdict. Someone still has to judge whether the verdict is right, write the escalation, contain the threat and fix the rule that fired. Practice checking a tool’s conclusion against the raw evidence, and say on your resume when you have done it.

SOC Analyst LinkedIn Profile Tips

Recruiters search LinkedIn by title and tool names, so use the terms SOC postings use where they truthfully describe your work. If you have not held a SOC title, do not claim one. A headline such as “IT Support Specialist | Phishing triage, Windows log analysis | Security+” tells a recruiter exactly what you bring.

In your About section, describe the investigations you have done, in two or three sentences each: the alert or report, the evidence you gathered and the call you made. Add your best lab write-ups to the Featured section, so a recruiter can read your work without asking for it. In your experience entries, reuse the investigation-first bullets from your resume.

SOC Analyst Certifications

Treat Security+ as the entry ticket, not the thing that sets you apart. KORE1 puts it bluntly: “Security+? Table stakes,” and “it earns no premium.” It adds that GCIH, GCIA and Microsoft’s SC-200 “are worth something from Tier 2 up, typically $5,000 to $10,000 in a negotiation.”

If you are studying for Security+ or CySA+ now, check which version you will sit before you buy materials. KORE1 also notes that Security+ counts toward Department of Defense (DoD) 8140 qualification for defense work, which matters if you are targeting government contractors.

For a fuller comparison, see Teal’s guides to cybersecurity analyst certifications and information security analyst certifications.

SOC Analyst Interview Prep

Tier 1 SOC interviews usually test how you think through an alert more than what you have memorized. Expect some combination of these: walking through how you would triage a phishing report or a suspicious login, reading and explaining a log line or alert, and saying when you would escalate and what you would include. Behavioral questions often cover shift work, a mistake you caught (or made) and how you hand work to the next person.

Prepare two or three investigation stories from your IT job or lab, each with the alert, your checks, your verdict and the outcome. For practice questions, use Teal’s cybersecurity analyst interview questions, and for a model application letter, see the cybersecurity cover letter examples.

Related Career Paths

Each of these careers shares part of the SOC analyst’s work or sits one step away from it.

Cybersecurity Analyst

Cybersecurity analysts cover a wider range of security work, from monitoring and incident response to vulnerability assessments and security controls. SOC analyst is one of the most common entry points into that broader title.

Information Security Analyst

Information security analysts protect an organization’s data and systems, which includes monitoring but also policy, risk assessment and access controls.

Threat Intelligence Analyst

Threat intelligence analysts research attackers and their methods so the SOC knows what to look for. It suits SOC analysts who enjoy the research side of an investigation more than the queue.

Security Operations Manager

Security operations managers run the SOC: staffing, shift schedules, tools and reporting to security leadership. It is the management step at the top of the SOC ladder.

Penetration Tester

Penetration testers attack systems with permission to find weaknesses before real attackers do. It is the offensive counterpart to SOC work, and SOC experience helps testers understand what defenders can see.

IT Support Specialist

IT support specialists resolve technical problems for employees and keep systems running. It is a common starting point for SOC analysts, and a good place to begin collecting investigation work for your first SOC resume.

Your first SOC resume is your IT resume rewritten as a record of investigations. Build it in Teal’s AI Resume Builder, one version for each posting. Create and download unlimited resumes for free, with no credit card required. Teal+ unlocks additional templates, settings, and advanced features.