What is an SOC analyst? Cybersecurity roles explained

Between 2021 and 2023, data breaches increased a whopping 72%, with those breaches costing organizations an average of $4.88 million. And with the increase in cybersecurity incidents comes a boost in demand for cybersecurity professionals, especially SOC analysts. These critical roles are the guards on an organization's watchtowers, the first responders to a cyber-cry for help.

Here’s everything you need to know about SOC analysts, and what to start learning to land this role.

1. What is an SOC analyst?
2. Types of SOC analysts
3. What do SOC analysts do?
4. What are the qualifications to become an SOC analyst?
5. How much do SOC analysts get paid?
6. Key skills and certifications for SOC analysts

Security Operations Center (SOC) analysts are an organization’s first line of defense against cybersecurity threats. They monitor IT infrastructure for those threats and respond to security incidents through a combination of investigation, analysis, and developing response strategies. It’s also up to SOC analysts to conduct regular risk assessments and offer recommendations to shore up an organization’s defenses and security best practices.

You may want to consider a career as an SOC analyst if you have an eye for detail, or if you were a master of those “spot the difference” puzzles (you know, for catching anomalous behavior). It also wouldn’t hurt to have a naturally skeptical or suspicious attitude. That may not have won you any friends playing Among Us, but in the cybersecurity world, it’s an excellent asset for an organization.

An SOC team typically consists of three tiers of analysts, each with specific skills and responsibilities:

Tier 1 SOC analysts—usually the least experienced of the three—focus on monitoring infrastructure for suspicious activity and potential security breaches, as well as reviewing alerts. They’ll also identify potential incidents and high-risk events. This is where the triage element comes in: triage specialists will prioritize alerts and potential incidents according to their criticality, then they’ll determine if they need to escalate the issue to the next tier for review.

Tier 2 SOC analysts assess the incidents escalated by triage specialists using threat intelligence. They dig into the problem, identifying the scope of an incident and its affected systems, gathering additional data, and then designing and implementing strategies to respond to the incident. If tier 2 analysts can’t resolve an issue, they’ll escalate it to tier 3.

Tier 3 SOC analysts are the most experienced of the three. In addition to tackling the major incidents that come to them from tier 2 analysts, tier 3 analysts actively identify threats and the vulnerabilities letting them in. They’ll frequently supervise penetration tests and vulnerability assessments, and then they’ll recommend ways to close security gaps and prevent future incidents.

Like any cybersecurity role, a day in the life of an SOC analyst will differ depending on the organization and across the various tiers of analysts. Broadly, here are the responsibilities you can expect an SOC analyst to engage in:

Generally the most common task an SOC analyst performs is monitoring IT infrastructure for suspicious activity that may indicate a possible breach. Things like sudden spikes in network traffic, intrusive behavior (malware, phishing), and the like. Once they identify potential threats, they may start investigating, or they’ll escalate the threat to an incident responder (tier 2 analyst).

Once they receive potential threats from tier 1 analysts, tier 2 analysts assess the scope of the threat and the risk to systems across the organization’s infrastructure. They supplement their own analysis with additional data and create a solution to mitigate the threat. Analysts will then collaborate with other teams to prevent similar vulnerabilities or attacks in the future.

Tier 3 analysts, on the other hand, conduct much more in-depth security assessments that identify vulnerabilities and strengthen defenses before threats become a problem. These assessments can include everything from audits and data review to active penetration testing.

Communicating across teams is a key responsibility of SOC analysts. All their monitoring and analysis does little if other teams don’t know what to do with their findings (or aren’t aware of them in the first place). In addition to updating and reinforcing security systems, SOC analysts will also recommend improvements to security procedures and will often educate teams on security best practices. Tier 3 analysts will also often enact these recommendations.

Cybersecurity threats evolve at the speed of technology (and that’s fast, really fast), so SOC analysts need to make sure they’re up-to-date on both emerging threats and trends and developments in security strategies. The most successful SOC analysts are continuous learners, and some organizations take continuing education so seriously that they require recertification and other development standards.

Here are some sources for keeping up on the latest cybersecurity trends:

• Dark Reading
• Hacker News
• CyberWire Daily
• Krebs on Security
• Hacking Humans

Many SOC analyst roles will require a degree, ideally in IT, cybersecurity, or an adjacent field. However, if going back to school isn’t an option for you, don’t let that be a deterrent. There are other ways to prove your proficiency, which we’ll get to in a moment.

Some analyst roles also require some experience in IT or a related field, and since you’ll be working in security, you may also have to go through background checks and other security clearances.

SOC analyst salary will vary depending on the organization and on the role’s tier, which means you’ll frequently see a wide range of pay. Talent.com reports an average SOC analyst salary of $97,500 in 2024. Entry-level roles tend to start around $72,000, with more experienced analysts making closer to $137,000.

Succeeding in a SOC analyst role requires a combination of hard and soft skills, and certifications are critical for improving your hireability.

• CompTIA Security+: This is a must-have certification across cybersecurity roles. It covers everything from assessing security posture to securing hybrid environments to responding to incidents. You’ll validate the foundational skills to succeed in cybersecurity.

Check out this Pluralsight learning path to prepare for the CompTIA Security+ certification.

• CompTIA Network+: This fundamental certification ensures you have the skills to establish, maintain, troubleshoot, and secure networks. 

Prep for the CompTIA Network+ certification with this learning path.

• CompTIA Cybsecurity Analyst (CySA+): This certification goes deeper into analyst-specific skills, validating your abilities in incident detection, prevention, and response.

This learning path will help you prepare for the CompTIA Cybersecurity Analyst certification.

• CompTIA Advanced Security Practitioner (CASP+): This is another advanced certification that dives into security architecture and engineering to improve organizations’ cybersecurity readiness.

We just published a learning path to help you ace the CASP+ certification.

Programming: SOC analyst work is frequently automated, and that requires basic programming skills to develop scripts that search system logs. Many SOC analysts also use programming skills for data visualization. Python, Golang, and C are great languages to start with.

Intrusion detection: A foundational skill for the monitoring of suspicious activity, intrusion detection includes everything from identifying malware infections to network breaches and more.

Security event triage: Understanding attack techniques, network analysis, anomaly detection, and more to be able to find, classify, escalate, and respond to security threats.

Digital forensics: A branch of forensic science, digital forensics is the investigation, collection, and analysis of data relevant to cybercrimes.

Security Information and Event Management (SIEM) tools: These are the Batman’s utility belt for SOC analysts. SIEM tools collect and analyze an organization’s data, enabling analysts to detect threats and generate alerts. Zeek, Elastic Stack, Security Onion, and Suricata are a few SIEM tools you’ll want to be familiar with.

Penetration testing: Sometimes also known as pen testing, vulnerability scanning, or ethical hacking, penetration testing is the ability to hack into systems while staying in the bounds of laws and regulations in order to test for vulnerabilities in IT infrastructure.

Incident response: Identifying attacks, determining their scope and affected systems, and formulating a response.

Risk management: The ability to identify, analyze, and mitigate risks. Different SOC analyst tiers will engage in risk management in different ways, with tier 1 analyzing vulnerabilities and identifying possible risks and tiers 2 and 3 developing the strategies to actually mitigate those risks and recover from incidents.

Communication: Especially in tier 2 and tier 3 SOC analyst roles, you need to be able to communicate security risks and recommendations to other teams in an organization, who may not be familiar with cybersecurity concepts and procedures. You have to distill complicated and unfamiliar ideas into accessible and actionable terms.

Problem-solving: Every cybersecurity role requires problem-solving on a daily basis, both in terms of actual security incidents and prevention, and in developing solutions across an organization.

Critical thinking: SOC analysts need to be able to look beyond the surface and extrapolate possibilities related to threats, vulnerabilities, procedures, and more. You also have to think about how decisions you make translate across your organization.

If you’re interested in standing at the first line of defense for your organization and putting your analytical and problem-solving skills to the test, SOC analyst may be the role for you. It’s also an excellent gateway into the cybersecurity field as a whole and will open up opportunities to move into other exciting roles. 

Good luck, and happy learning!

For more resources on cybersecurity, check out these articles:

• A day in the life of a SOC analyst
• How to get into cybersecurity with no prior experience
• Starting in cybersecurity: FAQs about how to get your first job
• Cybersecurity jobs: Key skills, certificates, and traits leaders want
• From Air Force pilot to CISO: How this security leader landed the top job
• 5 ways to get practical experience in tech (so you can land a job)