SOC Analyst
BoomingMonitoring security alerts and triaging threats inside a Security Operations Centre
SOC Analyst Salary
United Kingdom
£25,000 – £45,000
United States
$45,000 – $80,000
Varies by location, sector, and experience. Last updated: 2025.
What Is a SOC Analyst?
A SOC Analyst works within a Security Operations Centre — the team responsible for monitoring an organisation's systems around the clock for signs of attack, compromise, or unusual activity. They are typically the first line of defence when a security alert fires, responsible for triaging it quickly, determining whether it represents a real threat, and escalating or containing it accordingly.
SOC Analysts work in tiered structures. Tier 1 analysts handle high volumes of alerts and focus on triage and initial investigation. Tier 2 analysts take on more complex incidents and begin developing threat hunting skills. The role is one of the most accessible entry points into a technical cybersecurity career — it builds the investigative instincts, tool familiarity, and threat knowledge that underpin almost every other security specialism. Many of the most experienced security engineers, incident responders, and pen testers started their careers in a SOC.
What Does a SOC Analyst Do?
- Monitor SIEM dashboards and triage security alerts across endpoint, network, and cloud environments against defined use cases
- Investigate alerts to determine whether activity represents a genuine threat, benign anomaly, or tunable false positive
- Escalate confirmed or suspected incidents to Tier 2 analysts or the incident response team with full investigation context
- Contain immediate threats by isolating compromised endpoints or blocking malicious network traffic through available security controls
- Analyse phishing emails and end-user-reported suspicious activity to identify credential harvesting attempts or malware delivery
- Contribute to detection rule improvement and alert tuning by documenting false positive patterns and recommending threshold adjustments
SOC Analyst Skills
Hard Skills
- Incident Management
- Threat Intelligence
- Log Management
- SIEM Platform Engineering
- Network Security
- Malware Analysis
- Vulnerability Management
- Detection Rule Development
- Scripting
- Reporting and Visualisation
Soft Skills
- Analytical ThinkingDetermining whether alerts represent real threats
- Attention to DetailIdentifying subtle indicators of compromise
- PrioritisationTriaging high alert volumes under time pressure
- CommunicationEscalating incidents clearly to senior analysts
- Methodical ApproachStructured investigation and containment steps
- ResilienceSustaining focus during high-volume, shift-based work
SOC Analyst Tools & Software
How to Become a SOC Analyst
Typical Route
SOC Analyst is one of the few cybersecurity roles where a four-year degree is genuinely optional, though a bachelor's in Cybersecurity, Computer Science, or Information Technology provides a structured foundation. Programs at NSA/DHS-designated National Centers of Academic Excellence — including Western Governors University, Champlain College, and community colleges offering two-year associate degrees — provide accessible entry routes. Graduates typically enter at Tier 1, working triage and monitoring before advancing through the SOC tier structure as experience accumulates.
Alternative Route
CompTIA Security+ is the most widely held entry credential for SOC roles in the US. CompTIA CySA+ is specifically aligned to the analyst function and supports Tier 2 progression; Microsoft SC-200 is valued in Microsoft-stack environments. TryHackMe and Blue Team Labs Online provide structured practical learning recognised by US hiring managers as meaningful evidence of hands-on ability. Infosec Institute and SANS Institute deliver Security+ and CySA+ preparation programs. Veterans may apply GI Bill funding toward eligible certification training.
A Day in the Life of a SOC Analyst
Morning
Afternoon
SOC Analyst Career Path
IT Support / Helpdesk
0–1 yr
SOC Analyst Tier 1
1–3 yrs
SOC Analyst Tier 2
3–5 yrs
IR Analyst / Threat Hunter
5–7 yrs
Security Engineer / Architect
7+ yrs
SOC Analyst Job Outlook
SOC Analyst is one of the highest-volume entry-level hiring areas in cybersecurity, with demand driven by the expansion of managed security service providers, regulatory requirements for continuous monitoring, and a persistent global shortage of security professionals across financial services, healthcare, and critical infrastructure. The role is also one of the clearest on-ramps into a high-growth field for career switchers without a technical degree. Progression into threat intelligence, incident response, and cloud security is well-established, making it a durable entry point with strong long-term trajectory.