What is SOC Analyst?

SOC analysts are organized into tiers that reflect depth of investigation, not just seniority. L1 owns the alert queue: triage incoming SIEM and XDR alerts against a runbook, close obvious false positives (a vulnerability scanner hitting a web server, a user mistyping a password five times), and escalate anything ambiguous with context attached. L2 picks up escalations, pivots across log sources to build a timeline, pulls process trees from EDR, checks DNS and proxy logs for command-and-control patterns, and decides whether to declare an incident. L3 and detection engineers handle the alerts nobody has seen before: novel malware, living-off-the-land techniques that evade existing rules, and the work of writing new correlation logic so the next occurrence triggers automatically.

A typical shift starts with a handoff read: what happened overnight, what's still open, what the outgoing analyst flagged as worth watching. Then the queue: working alerts by priority, not by arrival time, because a medium-severity alert on a domain controller outranks a dozen low-severity alerts on workstations. Tools in daily use include a SIEM console for log search and correlation (Splunk, Sentinel, QRadar), an EDR/XDR console for endpoint telemetry and process trees (CrowdStrike, Defender, SentinelOne), a firewall or NDR console for network traffic, and a ticketing system for case documentation. The job runs on artifacts most people never see: process command lines, parent-child relationships, registry modification events, authentication logs with source IP and geolocation.

The soft-skill half is just as load-bearing as the technical half: writing case notes clear enough that the next shift doesn't have to re-investigate from scratch, staying calm when the queue triples during a widespread phishing campaign, and knowing when 'I'm not sure' is the honest answer that should trigger escalation rather than a guess.

Performance is usually measured against a handful of metrics: mean time to detect, mean time to respond, alert-to-ticket ratio, and the false-positive rate on rules the analyst helped tune. Entry into the role commonly comes through a help desk or IT support background plus an entry-level certification (Security+, or a SIEM-vendor-specific credential), since most SOCs weight demonstrated log-reading ability and calm decision-making over a degree. Progression from L1 to L2 typically hinges on consistently accurate escalation calls and the ability to independently build a timeline across multiple log sources rather than time served.