SOC Analyst Career Guide: Duties, Skills, Pay
A SOC analyst works in a security operations centre: they watch alerts from security tools, decide which are real threats, investigate the real ones and escalate or contain them. It is the most common first job in cybersecurity, and BLS counts it inside Information Security Analysts, whose median pay was $129,180 a year in May 2025.
This guide covers what each tier does, what a shift looks like, the tools and skills you need, and how to get the first job. You can try the core skill, alert triage, in your browser right now (below).
Updated 3 November 2026
Tier 1, Tier 2 and Tier 3
Not every SOC uses tiers, and titles differ, but this is the common shape.
| Level | Main job | Typical output |
|---|---|---|
| Tier 1 (triage) | Work the alert queue, validate, enrich, close or escalate. | Closed tickets with notes; escalations. |
| Tier 2 (investigation) | Investigate escalations, scope the incident, start containment. | Incident timelines, containment actions. |
| Tier 3 (hunt and engineering) | Threat hunting, detection tuning, forensics on complex cases. | New detections, hunt reports, playbooks. |
Most analysts reach Tier 2 in a couple of years and then branch to incident response, detection engineering, threat hunting or security engineering.
What a shift looks like
An illustrative Tier 1 shift (yours will differ by employer):
- Handover. Read the previous shift's notes: open incidents, noisy rules, planned maintenance.
- Queue work. Pick the highest-severity alert first. Read the rule, pull the raw events, check whether the activity is expected for that user and host.
- Enrich. Look up the IP, domain or file hash; check who owns the asset; check the account's recent sign-ins.
- Decide. Close with a reason, or escalate with the evidence attached. Method: How to triage a SOC alert.
- Reported phishing. Check mails staff forwarded, block the sender or link, tell the reporter the outcome.
- Tuning requests and handover. Log rules that fire on benign activity, write the next handover.
Try five real alerts now
The fastest way to know whether the job suits you is to do it. The SOC Log Triage Trainer gives you realistic alerts to validate, scope and decide, and the SOC arcade game does the same as a game. Note, for each, what you checked and why you escalated or closed. Those notes become interview answers.
Open the SOC Log Triage TrainerSkills and tools
- Networking and logs: IP, DNS, HTTP, ports; reading Windows event logs, Linux auth logs and proxy or firewall logs.
- Attack knowledge: phishing, credential theft, malware execution and lateral movement, mapped to a framework such as MITRE ATT&CK.
- Query skills: searching a SIEM, pivoting from one indicator to related events. Practice: log triage and the Detection Lab.
- Tool categories: SIEM, EDR, ticketing, threat intelligence, email security, sometimes SOAR. Learn the concept, not one brand.
- Writing: a clear note beats a clever hunch. Practice writing the reason for every decision.
To see how mature a SOC is and where analysts spend time, try the SOC maturity assessment. For incident handling steps beyond triage, NIST SP 800-61 Rev. 3 is the primary reference.
Certifications and pay
Entry certifications such as CompTIA Security+ appear most in job ads, with CySA+, Cisco CyberOps, Blue Team Level 1 and Microsoft SC-200 as SOC-focused next steps. Prices and details: cybersecurity certifications guide, or build a plan in the certification roadmap.
Pay: BLS does not separate SOC analysts. For information security analysts the May 2025 median was $129,180, the lowest-paid tenth earned under $75,090 and the highest-paid tenth over $199,850; employment was projected to grow 21 percent from 2025 to 2035. See where your pay or offer sits in the Cybersecurity Salary Explorer.
Getting your first SOC analyst job
- Learn networking and log reading until you can explain a failed login from the logs.
- Sit one entry certification named in the ads you want.
- Practise triage and keep notes; turn them into CV bullets with Resume Review.
- Apply to Tier 1, SOC intern and help desk roles at employers with a SOC; also see the entry level jobs guide and prepare with interview prep.
Frequently asked questions
What is a SOC analyst?
A SOC analyst works in a security operations centre. They monitor alerts from security tools, decide which are real threats, investigate the real ones and escalate or contain them. The job is the front line of detection and response for an organisation, and it is the most common first role in security.
What does a SOC analyst do all day?
Most of a shift is working the alert queue: reading an alert, pulling the logs behind it, checking whether the activity is expected, deciding severity, and writing a note that either closes it or hands it to the next tier. Time also goes on tuning noisy detections, shift handover, and responding to phishing reports from staff.
What is the difference between a SOC analyst and a cybersecurity analyst?
Cybersecurity analyst is a broad title. SOC analyst is a specific job within it, focused on monitoring and incident triage. Other "analyst" roles do vulnerability management, threat intelligence or compliance. The US BLS counts SOC analysts inside the occupation Information Security Analysts.
How much does a SOC analyst make?
BLS does not publish SOC analyst pay separately. For information security analysts, the group SOC analysts belong to, the median was $129,180 a year in May 2025, the lowest-paid tenth earned under $75,090 and the highest-paid tenth over $199,850. Tier 1 roles sit toward the lower end. Use the salary explorer to see the range.
How do I become a SOC analyst with no experience?
Build a base in networking and logs, take one recognised entry certification, and practise triage until you can explain your decisions. Then apply to Tier 1 and SOC intern roles and to adjacent IT roles in parallel. Written proof of triage practice is the single most useful thing to bring to an interview.
Is SOC analyst a good entry level job?
It is a common and good first security job because it exposes you to many tools and attack types quickly. The trade-offs are shift work in some 24/7 SOCs, repetitive alert volume, and burnout if the SOC is badly tuned. Many analysts move to incident response, detection engineering, threat hunting or security engineering after two to three years.
Which certifications help for SOC analyst jobs?
Entry certifications such as CompTIA Security+ are named most often in job ads, with CySA+, Cisco CyberOps and Microsoft SC-200 as next steps for SOC work. Costs and details are in the certifications guide, which pulls prices from the certification roadmap.
What tools do SOC analysts use?
The usual set is a SIEM for log search and alerting, an EDR for endpoints, a ticketing or case system, threat intelligence lookups, email security tools and sometimes a SOAR platform for automation. Products vary by employer, so learn the concepts (query, pivot, enrich, document) rather than one vendor.