Your First Night Shift: The First 180 Days in a SOC

What the queue, the tools and the people around you will ask of you, and how to answer well.

You got the job. Somewhere there is a queue of alerts with your name on the rota, a set of tools you have half used before, and a team that has done this for years. This book is for the gap between the interview and the day you feel at home in it.

It is ordered by time. Day 1 first, then the first month, then how to tell if you are doing well, then the paths that open up around month six. Each chapter starts with the questions people tend to keep to themselves, because those are usually the ones that matter.

Nothing here is a rule from your employer. Your team has its own runbooks, severity levels and on-call habits, and they win. Use this book to know which questions to ask them.

Every chapter ends with one thing to practise on PlayCISO. Reading about triage helps. Doing triage, where a mistake costs nothing, helps more.

Start reading Read it on one page

Day 1

The queue, the tools and the people. What to learn first, and what can wait.

The first 30 days

Triage, tickets and the fear of getting it wrong.

Triage: context before verdictWeeks 1–4
Writing a ticket someone else can act onWeeks 1–4
The missed alert: what if I screw up?Weeks 2–6

How am I doing?

Numbers that describe you, numbers that help you, and how to get real feedback.

Metrics that measure you and metrics that helpMonths 1–3
Feedback loops: how to get better on purposeMonths 1–3

Choose your path to 180 days

Around month four, most analysts start leaning towards one direction. Four common ones.

Looking after yourself

The work is a marathon run in shifts. Plan for that.

Shift work, alert fatigue and burnoutAll 180 days

Epilogue

What SOCs often get wrong, so you can notice it without becoming cynical.

What SOCs are not good atDay 180

Glossary

Access key: A long-lived credential used by programs to call a cloud API. A leaked key is a common cloud incident.
Alert: A notice created when a detection rule matches. It is a question to answer, not a verdict.
Alert fatigue: Reduced attention caused by seeing many repetitive or low-value alerts.
Audit log: A record of administrative actions in a system or cloud platform: who did what, when and from where.
Baseline: What normal activity looks like for a user, host or system, used to spot unusual behaviour.
BEC: Business email compromise. Fraud using a hijacked or impersonated business email account, often to redirect payments.
Benign true positive: An alert that correctly spotted real activity, which turned out to be allowed.
Blameless review: A review after an incident or miss that looks for causes in systems and process, not someone to punish.
Command and control (C2): The channel an attacker uses to send instructions to compromised systems.
Containment: Steps to stop an incident spreading, such as isolating a host or disabling an account.
Detection engineering: Designing, writing, testing and tuning the rules that create alerts.
EDR: Endpoint detection and response. Software on laptops and servers that records activity and can isolate a device.
Enrichment: Adding context to an alert, such as user role, asset owner or reputation of an IP address.
Eradication: Removing the attacker's tools and access from the environment.
Escalation: Handing an alert or decision to someone with more context, access or authority.
Event: Any recorded thing that happened in a system, such as a sign-in or a file change. Most events are normal.
Exfiltration: Moving data out of an organisation without permission.
False negative: Malicious activity that happened without any alert firing.
False positive: An alert that fired, but nothing bad happened.
Handover: The note and conversation that passes open work from one shift to the next.
Hypothesis: In hunting, a testable statement about what an attacker might be doing and what evidence it would leave.
Incident: A confirmed event that harms, or threatens to harm, systems, data or people, and needs a coordinated response.
IOA: Indicator of attack. A behaviour pattern that suggests an attack is happening, regardless of the exact tools used.
IOC: Indicator of compromise. A specific artefact such as a file hash, IP address or domain linked to malicious activity.
KQL: Kusto Query Language. A query language used in several Microsoft log and security products.
Lateral movement: An attacker moving from one system to another inside a network.
MITRE ATT&CK: A public knowledge base of attacker tactics and techniques, used to describe and map detections.
MTTD: Mean time to detect. Average time from when malicious activity began to when it was detected.
MTTR: Mean time to respond or resolve. Average time from detection to containment or closure; teams define the end point differently.
NDR: Network detection and response. Tools that watch network traffic for suspicious patterns.
On call: Being available outside normal hours to respond to escalations.
Persistence: Ways an attacker keeps access after a reboot or password change.
Phishing: Messages that trick people into revealing credentials, opening malware or making payments.
Playbook: A broader plan for a type of incident, often covering several teams and decisions.
Process tree: A view of which program started which other programs on a host.
Recovery: Restoring systems and services to normal operation after an incident.
Runbook: Step-by-step instructions for handling a specific alert or task.
SIEM: Security information and event management. A system that collects logs from many sources so you can search them and run detection rules.
Sigma: An open, vendor-neutral format for writing detection rules that can be converted for different SIEMs.
SOAR: Security orchestration, automation and response. Tools that run playbooks automatically, such as enriching an alert or blocking an address.
SOC: Security operations centre. The team that monitors for, investigates and responds to security events.
SPL: Search Processing Language. The query language used in Splunk.
Tabletop exercise: A discussion-based rehearsal of an incident, where a team talks through decisions without touching real systems.
Tactic: In ATT&CK, the attacker's goal at a step, such as gaining initial access or moving laterally.
Technique: In ATT&CK, a way an attacker achieves a tactic.
Threat hunting: Searching for signs of attacker activity that existing detections may have missed, starting from a hypothesis.
Threat intelligence: Information about attackers, their methods and their targets, used to guide detection and response.
Tier 1 / Tier 2 / Tier 3: A common way to split SOC work by depth, from first triage to deep investigation. Not every SOC uses tiers.
Triage: Deciding what an alert is and what should happen next.
True positive: An alert that fired on real malicious or unwanted activity.
TTP: Tactics, techniques and procedures. How an attacker operates, from goals down to specific methods.
Tuning: Changing a rule so it fires less on harmless activity without losing real detections.
XDR: Extended detection and response. A product that combines signals from endpoints, email, identity, cloud and network in one place.
YARA: A rule format for matching patterns in files, often used to find malware.

Frequently asked questions

What does a SOC analyst do on the first day?

Mostly watching and learning. Expect to shadow an experienced analyst, get access to the SIEM, EDR and case system, and learn who to escalate to. You are not expected to make big calls on day one.

How do I get better at alert triage?

Gather context before choosing a verdict: who, what, where, when and whether it is normal for them. Then build feedback loops, such as reviewing reopened tickets and asking a senior analyst to read a few of yours each week.

What is the difference between a false positive and a false negative?

A false positive is an alert that fired when nothing bad happened. A false negative is something bad that happened without any alert. False negatives never appear in the queue, which is why threat hunting exists.

What happens if I miss a real alert as a new SOC analyst?

In a healthy team it leads to a blameless review that looks at what made the wrong call look right, such as missing context or a vague rule. Clear ticket notes about what you checked are your best protection.

What can a SOC analyst move into after six months?

Common paths are detection engineering, threat hunting, incident response and cloud security monitoring. Most people move gradually by taking on small pieces of that work alongside the queue.

Other handbooks

Updated 2026-11-14. General guidance, not legal advice. Where a chapter states a law or standard, its sources are listed at the end of that chapter.