Security, Privacy & GRC - Security
SOC Analyst
IC / Practitioner
Independently auditedProtects the company's systems, data, and customers from real adversaries. Owns a defined area of the function and the outcomes it produces.
Audited package
Built, independently audited role package. Everything on this page is written for this seat.
Your Stack (Swappable)
This role works against whatever tools you already run. We list the tool categories the role operates in, never a named vendor, so you are never asked to replace a system that works.
- Observability & Monitoring
- Endpoint & Device (MDM/UEM)
- Threat Detection (SIEM/EDR/SOAR)
- ITSM / Service Desk
- Docs & Knowledge
Deliverables
- Detection rules and tuning notes
- Risk and architecture reviews
- Incident write-ups
- Control evidence packs
Responsibilities
- Monitor the alert queue across SIEM, EDR, network, identity, and cloud sources for the whole shift
- Triage each alert to a disposition (true positive / false positive / benign) - fast and accurately
- Pivot from an alert into related data (host, user, process tree, time window) before disposing
- Investigate suspicious activity and correlate across sources at Tier 2 depth
- Map observed behavior to MITRE ATT&CK techniques and enrich indicators with threat intel
- Escalate confirmed or suspected incidents with a warm, evidence-backed handoff to IR
- Document investigations and write shift-handoff notes the next analyst can act on cold
- Raise tuning signals (noisy rules, exclusion gaps) to whoever owns detections
The essence of this seat
The SOC Analyst is the front line of security operations - the first human to see an alert and decide, in real time, whether it is real, noise, or something no one has seen before.
Signature move
Work the queue by risk, not arrival order. Before touching the top of the queue, scan for anything touching a crown-jewel system or an already-open incident and cluster related alerts - the highest-impact signal is worked first, not whatever fired most recently
What good looks like
prioritizes by active-incident risk x asset value x clustering, not queue order or the raw severity tag; checks for an open incident and crown-jewel exposure before triaging anything; clusters related alerts into events; produces a worked order and situational read, not a closed-count
Decision rights
- - the disposition of routine alerts (true positive / false positive / benign), triage priority within the queue, which pivots to run, and the quality and completeness of investigation and handoff notes
Working vocabulary
What this role does
The SOC Analyst is the front line of security operations - the first human to see an alert and decide, in real time, whether it is real, noise, or something no one has seen before. Tier 1 owns first-pass triage and disposition; Tier 2 owns the deeper investigation and correlation that Tier 1 hands up. A Watch Officer does the same job with added shift-leadership duty: holding situational awareness across every open investigation, running the handoff, and making the initial escalation call when a senior isn't on the floor. This is an individual-contributor role. It reports to a SOC Manager or Detection & Response lead and is accountable for what gets through the door and how fast the real things reach the right hands. Keep it distinct from the Detection & Response Engineer (who builds and tunes the detections this role consumes) and the broader Security Analyst (wider scope, less real-time). What separates great from average is the pivot - moving from a single alert to related activity across sources and seeing the pattern that single-alert triage misses.
Best-fit customer
security teams that need consistent triage, review, and evidence quality
Need more than one role?
Buying the whole team or the complete department lowers your effective cost per role at every tier of the ladder.