SOC analyst Education & career guide

What is an SOC Analyst?

As defined by IBM, a security operations center (SOC) is a "team of IT security professionals who constantly monitor a company or organization's IT infrastructure to detect cyber security threats or events in real time and address them as quickly and effectively as possible." An SOC may also research and maintain the company's security technology program and find ways to improve the company's security and impenetrability on an ongoing basis.

The benefit of an SOC is that it consolidates security tools, best practices and response to incidents into one location. The goal is improved preventative measures and security policies, faster threat detection and a more effective and cost-efficient response to any external threats. An SOC can also improve customer relationships and strengthen a company's compliance with any national and global privacy regulations.

How a security operations center works

The SOC focuses on recovery and remediation. Once an incident is contained, the SOC first works to annihilate the threat then to restore the compromised assets to their prior state. In the event of a data breach or ransomware attack, recovery may also involve moving to backup systems and resetting passwords and credentials.

To prevent a breach recurrence, the SOC uses any new intelligence gained from the incident to better address vulnerabilities, update processes and policies, choose new cyber security tools or change its current response plan. At a higher level, the SOC team may also try to discover if an incident signifies a new or changing cyber security trend that the team needs to be aware of and prepare themselves.

It's also the SOC's job to ensure all applications, security systems and processes comply with data privacy regulations. Regulations and laws that require compliance may include:

• Global Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA)
• Payment Card Industry Data Security Standard (PCI DSS)
• Health Insurance Portability and Accountability Act (HIPAA)

If a breach or compliance violation does occur, the SOC makes sure that users, regulators, law enforcement and other parties are notified in accordance with regulations and that all incident data is preserved for evidence, auditing and future prevention.

What role do SOC analysts play?

SOC analysts are different from cyber security analysts and some other analysts in that a cyber security analyst may work alone or be the only person in a company in the role, while SOC analysts are normally part of a large, dedicated team that act as the last line of defense against cyber crime.

SOC analysts are normally part of a large, dedicated team that act as the last line of defense against cyber crime.

Without them, hackers may not be brought to justice. SOC analysts are also different from security investigators and incident responders, as these are usually the first line of defense against cyber security threats or incidents. SOC analysts detect, investigate and prioritize real or assumed threats, and they identify the impacted hosts, endpoints and users and take the appropriate action to mitigate and contain its impact.

A typical SOC analyst job description

Some of an SOC analyst's responsibilities may include:

• Monitoring and managing an organization's security systems and profile
• Sifting through false positives and detecting potential real threats
• Conducting routine maintenance and updates
• Developing and maintaining security policies and procedures
• Keeping a current asset inventory in and outside of the data center
• Providing security training to employees and incident response drills to SOC team
• Responding to security incidents and threats
• Analyzing logs, network traffic and data to identify potential threats and vulnerabilities
• Performing regular vulnerability assessments and tests
• Providing threat intelligence reports and manage log data
• Designing and implementing security solutions
• Staying current on industry trends, solutions and threats including usage of SIEM solutions and AI

Skills and qualifications

Despite a degree not always being mandatory for SOC analysts, there are skills and abilities that are needed to perform the duties of the job. While the technical skills can be learned in bootcamps and certification programs, the soft skills are basic inherent traits and abilities that align with the duties and sense of urgency on the job:

Education and SOC analyst certification

The most common way to enter the SOC analyst career field is to earn a bachelor's degree in computer science, computer engineering or another related area, such as cyber security. A bachelor's degree is generally desired, though you could become an SOC analyst in other ways that would allow you to gain the knowledge you need. 

Ways to enter the field without a degree

Tiers and progression

The SOC itself is comprised of different tiers, each contributing a specific service to the goal of securing systems, hardware, software and operations. Here is a look at the three different tiers you may work in:

One goal of the SOC is to spend less time on the due diligence required in Tier 3, so if Tier 1 and Tier 2 successfully execute their purpose and function, having to perform fewer Tier 3 fire drills will be the actual result.

Advancing your career

As an SOC analyst gains more experience, they may want to consider advancing into the following types of roles:

The SOC manager, who runs the team, oversees all security operations, and reports to the organization's CISO (chief information security officer).

Security engineer positions, who build out and manage the organization's security architecture. Much of their work involves evaluating, testing, recommending, implementing and maintaining security tools and technologies. Security engineers also work with development or operations teams to make sure the organization's security architecture is included in application development cycles.

Director of Incident Response is a leadership role responsible for communicating and coordinating incident response.

SOC Analyst salary and compensation

As an SOC analyst your salary will be dependent upon several factors: where you live, where you work, your education and the level of analyst you have attained. That said, ZipRecruiter also notes that SOC analysts may be open to receiving bonuses and profit sharing, depending upon the organization they work for. The U.S. Bureau of Labor Statistics does not specifically report salaries for SOC analysts, but they do maintain data on Information Security Analysts, who they say earn a median annual salary of .

ZipRecruiter says the top five states people search for SOC analyst jobs are New York, Washington, Florida, Connecticut and New Jersey. The BLS reports the following five states with the highest level of employment for security analysts are: Virginia, California, Texas, Florida and Maryland. Here are national salaries, including the lowest and highest 10% in the field by state, according to the BLS:

And here are median salaries for the top 10 metropolitan and city areas ranked by highest pay:

Challenges, rewards and the future

The challenges facing SOC analysts are great and singular: how do you stay one step ahead of the cyber criminal and keep data secure? As cyber crime advances and becomes more sophisticated, the SOC analyst must stay ahead of trends and technologies. As technology continues to advance, SOC analysts must understand how to best leverage its use to thwart threats and breaches.

The use of AI and machine learning in threat detection, cloud security and IoT (Internet of Things) security are just a few of the evolving areas within the field. Keeping abreast of these trends and continually learning relevant skills will ensure that SOC analysts remain effective in addressing and thwarting future cyber security threats.

Summing up

If you're certain that earning the education to become an SOC analyst is for you, you already know you have a huge responsibility ahead of you. No matter if you select certifications, bootcamps or full-fledged accredited degree programs to enter the field, by the time you complete your required learning the cyber universe will have already moved on, resulting in a never-ending challenge and quest.

You'll never stop learning as an SOC analyst, and you'll need to be ready to stay steps ahead of the cyber criminal mindset at all times. If you have the stamina and will to tackle what is sure to be a relentless yet rewarding career field, you'll perform a service that will keep individuals and organizational data safe from harm. All you need to do to get started is click Find Schools to begin researching bootcamps and education programs.

---

Published: November 8, 2023