SOC Analyst Career Guide: Skills, Tiers, Labs and Growth

The SOC analyst role is still the most common way into hands-on security, but the entry level is narrowing and the job is changing faster than most training material. In the UK, roles open to people with under a year's experience fell from 25% of core cyber job postings in 2022 to 16% in 2025, according to DSIT, while AI tools are taking over parts of first-line triage. This guide covers what SOC analysts actually do at each tier, a realistic shift, the skills that get people hired, entry routes, how to build a defensive home lab and portfolio, certifications described by awarding body, pay, progression into detection engineering, incident response, threat intelligence, cloud and identity security, and how to survive alert fatigue. It is written for people aiming at their first SOC job, analysts planning their next move, and the managers who hire and develop them.

Key takeaways

Triage is a judgement skill, not a click rate. The job is deciding quickly whether activity is benign or malicious and proving it from logs; speed comes from knowing systems, not from closing tickets.
Fundamentals beat tools. Windows and Linux internals, networking, log analysis, a query language and clear writing transfer across every SIEM, EDR and AI assistant.
Show evidence of defending. A home lab with telemetry, a few tested detections and written investigations is stronger proof than a list of course badges, especially as junior postings shrink.
Plan the exit from tier 1 early. Detection engineering, incident response, threat intelligence, cloud and identity security all start from SOC work; pick one by month 12 and build towards it.
AI changes the work, not the need for judgement. Analysts increasingly verify machine-generated triage and oversee automation, so investigation depth and scepticism matter more, not less.

What a SOC analyst does

NIST's NICE Framework describes the core defensive work in task statements such as "Detect cybersecurity attacks and intrusions" and "Distinguish between benign and potentially malicious cybersecurity attacks and intrusions", alongside "Analyze network traffic anomalies" and "Reconstruct malicious attacks". MITRE's guidance on SOCs compares alert handling to "triaging patients in an emergency" and reminds analysts that "Just because the SOC receives an alert, that does not necessarily mean something bad happened." Most SOCs split the work into tiers; SOC design is covered in the SOC Guide; this guide looks at it from the analyst's side.

Tier	Typical titles	Main work	Usual background
Tier 1	SOC analyst, junior or L1 analyst, security monitoring analyst	Triage alerts against runbooks, enrich with context, close false positives with reasons, escalate the rest, raise tickets	Service desk, apprenticeship, graduate, career changer with lab evidence
Tier 2	Senior analyst, L2 analyst, incident analyst	Investigate escalations across SIEM, EDR and identity logs, scope affected hosts and accounts, contain within agreed authority, tune noisy rules	One to three years in tier 1, or system administration
Tier 3	Lead analyst, threat hunter, incident responder	Major incidents, hypothesis-led hunting, malware and forensic triage, new detections, mentoring	Several years in SOC, IR or engineering
Shift lead	Shift manager, SOC team lead	Runs the queue and handover, decides when to declare an incident, coaches the shift	Senior analyst with people skills

At a managed security service provider (MSSP) or managed detection and response (MDR) provider you see many environments with less business context; in-house you see one estate in depth. Both are good first jobs. See the MDR Guide for how providers operate.

A day on shift

A shift starts with handover: open incidents, their owner and next step, anything the previous shift is unsure about, and changes such as new log sources or a vulnerability being exploited in the news. Then the queue. A typical tier 1 triage of a suspicious sign-in alert looks like this:

Read the alert logic: what rule fired, on what data, and what it is meant to catch, for example ATT&CK T1078 Valid Accounts.
Enrich: user role, manager, normal locations and devices, recent password or MFA changes, whether the source IP is a known VPN, hosting provider or anonymiser.
Pivot: other sign-ins from the same IP, other alerts on the same user or host in the last 24 hours, process activity after logon (Windows event 4688 or Sysmon event 1), for example encoded PowerShell (T1059.001).
Decide: benign with a stated reason, suspicious and escalated, or confirmed and handled under the incident process.
Write it up: what you checked, what you found, what you concluded and why, so another analyst can follow it without asking you.

A burst of push prompts the user denied is not noise: MFA fatigue was part of the Uber breach. Between alerts, analysts update runbooks, report noisy rules and join hunts.

Shifts: 24x7 SOCs run 8-hour or 12-hour patterns that include nights, weekends and public holidays, often with a shift allowance; business-hours SOCs use on-call rotas instead. The US Bureau of Labor Statistics notes that information security analysts "sometimes have to be on call outside of normal business hours in case of an emergency". Before accepting an offer, ask how often nights recur and whether rotation into project work is built in. The arithmetic behind shift staffing is in the SOC Guide.

Skills that get analysts hired

Skill	What good looks like	How to practise
Windows logs	Read 4624 (logon types 2, 3 and 10), 4625, 4672, 4688, 4720, 4732, 4768 and 4769, and know why 1102 (audit log cleared) matters	Generate each event in a lab VM and find it in your SIEM. See the Windows Event Log Guide and Sysmon Guide
Linux logs	Find SSH logons, sudo use, cron changes and new users in auth logs and the journal	Run a small Linux server in the lab and attack it with your own failed logons
Networking	TCP handshake, DNS resolution, HTTP and TLS basics; recognise ports 22, 53, 88, 389, 443, 445 and 3389 and what traffic on them should look like	Capture your own traffic with a packet analyser and explain every conversation
Query languages	Write and adapt searches in at least one SIEM language (KQL, SPL or Lucene/EQL) with joins, time windows and aggregation	Rebuild five vendor rules from scratch against lab data. See the SIEM Guide
Scripting	Python or PowerShell to parse logs, call an enrichment API, decode Base64 and automate a repetitive check	Automate one step of your own triage process
MITRE ATT&CK	Map an alert to a technique and know what usually comes before and after it	Map each lab detection to a technique ID and note its data source
Writing	Short, factual case notes and incident summaries a manager can act on	Publish write-ups of lab investigations
Identity	Read cloud sign-in logs, spot impossible travel, MFA fatigue, risky OAuth consent and service principal misuse	Use a free cloud tenant and review its sign-in and audit logs

Interviews test these directly: walk through a phishing alert, explain a 4624 type 3 logon, describe what happens when you browse to a website, or read a log extract and say what happened. Narrate your reasoning, say what you would check next and admit what you do not know.

Entry routes

IT service desk or system administration: the most common bridge. You already know the estate, Active Directory and ticketing; shadow the SOC, take on phishing mailbox triage and apply internally.
Apprenticeships and graduate schemes: structured, paid and often linked to a provider SOC. DSIT reports cyber-specific apprenticeship enrolments fell 15% between 2023/24 and 2024/25, so places are competitive.
Degrees: useful but not sufficient on their own. DSIT reports cyber security graduate unemployment of 11%, against 6% for all graduates, which is why lab evidence and part-time IT experience matter. The US BLS says information security analysts typically need a bachelor's degree in a computer science field.
MSSP and MDR providers: often hire more junior analysts and give fast exposure to many environments; expect metrics-driven queues.
Career changers: networking, development, fraud, audit, policing or military backgrounds bring useful habits; show them through a portfolio.

Broader routes, frameworks and role families are mapped in the Cybersecurity Careers Guide.

Portfolio and home lab

A home lab is where you generate the attacks you will later detect, safely. Keep it isolated from your home network and from any employer system, and only run tests against machines you own.

Build the base: a hypervisor with a Windows client, a Windows server running a small domain, and a Linux server. Take snapshots so you can roll back after each exercise.
Add telemetry: enable process creation with command-line logging and PowerShell script block logging, install Sysmon with a community configuration, and forward logs to a SIEM. Security Onion describes itself as "a free and open platform built by defenders for defenders" with network visibility, host visibility, log management and case management; free tiers of commercial SIEMs also work.
Generate activity: Atomic Red Team is "a library of tests mapped to the MITRE ATT&CK framework", designed to be quick, portable and reproducible. Run one test at a time and confirm what telemetry it produced.
Detect it: write a rule for each test. Sigma, "a generic and open signature format", lets you write a rule once and convert it with sigma-cli; its public repository holds more than 3,000 rules to learn from.
Test and tune: rerun the test to prove the rule fires, then run normal admin activity to see what false positives it raises, and record the tuning.
Write it up: one page per exercise: technique, data source, rule, test result, false positives and what an analyst should do when it fires.

Add defensive exercises: public blue team challenges and capture-the-flag events built on real incident datasets, where you investigate rather than attack. Five solid write-ups and a repository of tested rules outweigh any single certificate. See the Detection Engineering Guide for how professionals manage rules as code.

Certifications

Certifications help most with getting past CV screening and structuring self-study. They do not replace evidence of hands-on work. Check each body's current exam outline, price and renewal rules before committing; the table is descriptive, not a ranking.

Awarding body	Certification	Focus	Typical stage
ISC2	Certified in Cybersecurity (CC)	Security principles and terminology	Before or at entry
CompTIA	Security+	Broad security fundamentals	Entry
CompTIA	CySA+	Security operations, threat and vulnerability analysis	Tier 1 to tier 2
Security Blue Team	Blue Team Level 1 (BTL1)	Practical defensive investigation	Tier 1
Microsoft	SC-200 Security Operations Analyst	Investigation with Microsoft security tooling	Tier 1 to tier 2 in Microsoft estates
GIAC	GCIH (incident handling), GCIA (intrusion analysis)	Incident handling; packet and log analysis	Tier 2 and above

Once in a role, a certification in the SIEM or EDR your employer uses can be worth more than a general one; align funded study with your progression path.

Pay and demand

Pay varies widely by country, sector, shift pattern and provider versus in-house. Published figures are mostly for broader occupations, so treat them as context:

UK: DSIT's Cyber security skills in the UK labour market 2026 found Security Analyst roles made up 26% of core cyber job postings in 2025, and that the mean advertised salary across all core cyber roles was £60,800 (median £58,050). It gives no analyst-specific figure, and entry roles typically advertise well below that mean. Incident response skills appeared in 18% of postings.
US: the Bureau of Labor Statistics reports a median wage of $129,180 for information security analysts in May 2025, about 192,900 jobs, and projected employment growth of 21% from 2025 to 2035. The category covers more than SOC roles.
Entry squeeze: DSIT reports that postings requiring under two years' experience fell 53% between 2022 and 2025. Expect more competition for tier 1 roles and more weight on demonstrable skill.

Progression paths

MITRE's SOC guidance advises managers to keep staff "through career progression opportunities and great culture and operating environment" and to "Plan for turnover". As an analyst, plan your own: most people move on from tier 1 within two to three years.

Path	What changes	Skills to build in the SOC	Read next
Detection engineering	From answering alerts to writing, testing and tuning them as code	Query languages, Sigma, ATT&CK data sources, version control, test automation	Detection Engineering Guide
Incident response and DFIR	Leading containment and recovery; disk, memory and cloud evidence	Scoping, timelines, evidence handling, report writing	Incident Response Guide, Digital Forensics (DFIR) Guide
Threat intelligence and hunting	From single alerts to adversary behaviour across campaigns	ATT&CK, hypothesis-led searches, briefing writing	Threat Intelligence Guide
Cloud security	Securing cloud accounts, workloads and posture	Cloud audit logs, IAM policies, infrastructure as code	CNAPP Guide
Identity security	Detecting and preventing credential and token abuse for people, service accounts and AI agents	Sign-in and audit logs, MFA and Conditional Access, OAuth	ITDR Guide
Security automation	Building playbooks and integrations that remove repetitive triage	Scripting, APIs, SOAR workflows	SOAR and Security Automation Guide
SOC leadership	Shift lead, then SOC manager: people, metrics, budget	Coaching, handover discipline, reporting	SOC Guide

Choosing: if you enjoy the "why did that fire?" question, go towards detection engineering; if you like pressure and coordination, incident response; if you read reports on adversaries for fun, threat intelligence. In a large SOC, ask for a rotation into the team you want before applying to it.

Burnout and alert fatigue

Alert fatigue is when analysts see so many low-value alerts that real ones get the same quick dismissal. ISC2's 2025 Cybersecurity Workforce Study (16,029 respondents) found 47% "often feel overwhelmed by the workload they're expected to bear" and 48% reported "feeling exhausted from trying to stay current on the latest cybersecurity threats". Nights, repetitive queues and metrics that reward closure speed make it worse.

Report noise with data: for each rule you close repeatedly, record how often it fires, how often it is a true positive and what context would have let you close it faster. That is the input detection engineers need.
Automate your own toil: enrichment lookups, user and asset context and duplicate grouping are good first automations.
Protect recovery time: keep breaks on night shifts, avoid stacking overtime after a major incident, and use rotation weeks for project work.
Know the warning signs: closing alerts without reading the evidence or dreading every shift; raise it with your lead early.

For managers, useful measures are false positive rate per rule, alerts per analyst per shift, the share of alerts closed with a recorded reason, time to triage, and attrition. Targeting closure counts alone pushes analysts towards fast dismissal. See the SOAR and Security Automation Guide.

How AI is changing the role

DSIT reports that 70% of UK cyber security businesses now have staff using AI in their daily work (up from 53%), that AI skills were requested in 9% of core cyber postings (up from 4%) and automation skills in 15%. ISC2 found AI was respondents' most pressing skills need (41%) and that 28% had already integrated AI tools into operations. AI assistants and agents now draft alert summaries, suggest queries and run enrichment, removing some repetitive tier 1 work.

Verification becomes core: check every AI summary against the raw events before acting on it; a confident but wrong summary is worse than none.
Investigation depth matters more: MITRE notes that "Automation assists, but does not fully replace, the judgment of advanced human analysts". Analysts who can investigate without the assistant are the ones trusted to supervise it.
New things to monitor: SOC agents hold credentials and act on systems, so their actions need review like any privileged user's.

See the AI SOC Guide for how AI SOC tools work and where they fail.

Where identity fits

A large share of SOC alerts are identity alerts: suspicious sign-ins, MFA prompts, new authentication methods, privilege changes, OAuth consents and service accounts behaving oddly. Valid account abuse (T1078) is hard to detect from endpoint data alone because the attacker logs in rather than breaks in. Analysts who can read IdP sign-in and audit logs, explain Conditional Access results and spot an API key or service principal used from an unusual place are in demand, and identity security is a strong progression path. See the ITDR Guide.

Measuring your progress

Escalation quality: share of your escalations that tier 2 confirms as warranted, and share they send back for missing evidence.
Coverage of your knowledge: number of distinct alert types you can triage without a runbook.
Detections contributed: rules you proposed or tuned that went into production.
Time to triage on familiar alerts: falling without a rise in missed escalations.

Framework mapping

Framework	Where SOC analyst work sits
NICE Framework (NIST SP 800-181 Rev. 1)	Defensive Cybersecurity and Incident Response work roles; tasks such as detecting intrusions and separating benign from malicious activity
ENISA ECSF	Cyber Incident Responder profile
NIST CSF 2.0	Detect (DE.CM continuous monitoring, DE.AE adverse event analysis) and Respond (RS.MA incident management, RS.AN incident analysis)
CIS Controls v8.1	Control 8 Audit Log Management, Control 13 Network Monitoring and Defense, Control 17 Incident Response Management
ISO/IEC 27001:2022 Annex A	5.25 assessment and decision on information security events, 5.26 response to incidents, 8.15 logging, 8.16 monitoring activities
MITRE ATT&CK	The shared language for alerts, for example T1078 Valid Accounts and T1059.001 PowerShell

Common failure patterns

Collecting certificates instead of skills: candidates with several badges who cannot read a 4624 event or explain DNS struggle at interview.
Closing on pattern, not evidence: a rule that is "always a false positive" is closed without checking, until the day it is not; the repeated MFA push prompts in the Uber breach are the classic signal that looks like noise.
Write-ups nobody can follow: case notes that say "checked, benign" with no evidence force rework and erode trust in tier 1.
Staying in tier 1 too long without a plan: after two or three years of the same queue, skills plateau and burnout risk rises.
Labs on someone else's systems: running attack tools against an employer's or third party's systems without written authorisation can end a career before it starts.
Trusting the AI summary: acting on an assistant's conclusion without checking the underlying events.

Practitioner checklist

Pick a target first role (in-house SOC, MSSP or MDR) and read three real job adverts for it.
Build an isolated lab with Windows, Linux, Sysmon and a SIEM, with snapshots for rollback.
Learn the core Windows event IDs and one SIEM query language well enough to write searches from memory.
Run ATT&CK-mapped tests in the lab, write and tune a detection for each, and document the result.
Publish five investigation write-ups that show your reasoning.
Choose at most one or two certifications that match your target role and path.
Ask about rota, rotation and training budget before accepting an offer.
By month 12 in post, choose a progression path and ask for a rotation into it.
Track your escalation quality and detections contributed, not just alerts closed.
Verify every AI-generated triage summary against raw events.

Standards and references

Related NHI Mgmt Group resources: Cybersecurity Careers Guide · SOC Guide · AI SOC Guide · SIEM Guide · Incident Response Guide

SOC Analyst Career Guide