Career Guide: How to Become a SOC Analyst

SOC analysts are the first line of defence in today’s technology-driven world; from detecting threats to responding, they play a critical role in the cyber defence of enterprises. Today’s article will explore the exciting world of SOC analysts.

This article was made possible with the help of industry experts with real-world experience in SOC, and I would like to give a special thanks to Matthew Owens, Robert Whetstine, Joshua Speshock, and Matthew Nguyen.

What is a SOC?

SOC stands for Security Operations Centre, the mission control or command centre for resolving cybersecurity issues. There are plenty of roles in the SOC that make it possible, with one goal in mind: prevention, detection, and response; the SOC primarily focuses on the last two goals.

A security operations center (SOC) is a command center for monitoring the information systems that an enterprise uses for its IT infrastructure. This may include everything from the business’s websites, databases, servers, applications, networks, desktops, data centers, and a variety of endpoints.

A SOC cybersecurity setup monitors each element of the infrastructure, assesses its current health, including potential and existing threats, and responds to threats. The SOC also sets up information security measures and protocols designed to prevent future threats.

The SOC team consists of SOC managers, engineers, analysts with different tiers, threat hunters, and much more. They all work together to ensure the cyber front of the company is secure and operational. A SOC can be managed in-house or outsourced to an MSSP (Managed Security Service Provider), depending on the company’s size and budget.

They utilize multiple tools to do their jobs; a lot of these tools are proprietary, and exposure to them often comes when working in a SOC environment. The tools used in everyday SOC include SIEM (Security Information and Event Management), UEBA (User and Entity Behaviour Analytics), EDR (Endpoint Detection and Response), XDR (Extended Detection and Response), and SOAR (Security Orchestration, Automation, and Response).

What does a SOC do?

SOC often operates 24/7 to proactively defend organizations against cyber threats worldwide. Its responsibilities include threat detection, incident response, continuous monitoring, and compliance. It often collaborates with the NOC (Network Operations Centre) to ensure the network is up and the critical infrastructure is operational.

• Threat detection: Threat detection involves monitoring endpoints, servers, and the cloud for anomalies and abnormal activities that may require investigation. It relies on advanced tools such as SIEMs and XDR, which aggregate large amounts of logs, prioritize them, and help detect security incidents.
• Incident response: Once a security incident has been identified, it’s important to stop it from spreading to other parts of the network. In such scenarios, the team has to follow standard procedures to analyze, contain, isolate, eradicate, recover, and learn lessons; this is also referred to as the incident response cycle. The main purpose is to limit the damage by containing the incident, removing the threat, restoring the services, and preventing recurrence.
• Continuous monitoring: One of the goals of continuous monitoring is to establish a baseline by looking at the normal behaviour of the network and the endpoints, which makes it easier to detect any behaviour that deviates from the baseline, aka normal activities. Alongside that, it also involves monitoring for security events, vulnerabilities, configurations, network traffic, identities, endpoint activity, and other telemetry. They use threat intelligence to get context about threats, indicators, tactics, techniques, procedures, and campaigns, which in turn helps in understanding the adversary’s behaviour.
• Compliance: It’s the SOC’s responsibility to support the organization in ensuring that its applications, systems, security tools, and processes comply with applicable regulations and industry standards such as GDPR, NIST, and ISO 27001.

These are some of the core responsibilities of the SOC: The SOC employs people, processes, and technology to improve the security posture of organizations; they ensure that the organization stays protected while adapting to new and more sophisticated threats.

Where SOC analysts fit in

SOC analysts work at the frontline of cyberattacks; they are often the first to investigate a security incident and respond to it. SOC analysts are divided into different tiers based on their expertise and experience; these tiers can vary because they also depend on the organization’s size and how it categorizes its SOC staff.

• Tier 1 SOC Analyst: The Tier 1 analyst has to perform alert triage and assign the proper severity level based on the criticality of the alert. Not only that, they deal with raw data and have to enrich their findings; after a proper investigation, an evidence-backed decision is made on whether to escalate the alert to the Tier 2 analyst or report it as a false positive.
• Tier 2 SOC Analyst: After the alert has been escalated, Tier 2 analysts have to perform an in-depth investigation and use threat intelligence to gather more information about the threat, assess the risk it poses, and determine whether it is a genuine security incident. Then, Tier 2 analysts have to take the appropriate response actions. They are capable of performing more complex investigations, and if they can’t handle the case, they will escalate the alert to a Tier 3 analyst.
• Tier 3 SOC Analyst: Tier 3 analysts are among the most experienced SOC analysts, and they handle the most advanced and complex incidents. Their work may involve reverse engineering, understanding custom tooling, performing advanced threat hunting, and analyzing new or sophisticated tactics and techniques used by threat actors.

With the above interactive exercise, you can see how the incidents are handled by each tier and how they work together to defend organizations against cyberattacks.

Becoming a SOC Analyst

Before diving into the skills you need to become an analyst, I would like to talk about the bootcamps, courses, and guides you will find online and offline that tell you how you can become an analyst in six months and promise you a high-paying job. Let’s be clear: all of them are selling you a product, nothing else. There is no single perfect path to get into cybersecurity or become an analyst, so to keep this career guide authentic and real, I will include the skill set you need, recommendations from industry experts, and the certifications they would recommend.

Skills you need

I will divide this section into two categories: hard skills and soft skills. Cybersecurity is one of those fields that requires expertise in both; being technically skilled is not enough, and it’s really important to have both. After talking to people in the industry, I found that some hiring managers actually care more about soft skills and whether you are a good fit than your current level of hard skills, as they believe technical skills can be taught later on.

1. Soft Skills:
   • Communication: Communication is the most important skill set in cybersecurity. It’s about being able to communicate verbally and in writing and explain a security incident or a technical concept to non-technical personnel. It may seem fairly simple, but it’s crucial for the job. You may wonder why, but writing reports is an essential part of the job.
   • Documentation: When you are working as an analyst, you must maintain reports of all the incidents and keep your work properly documented to trace your steps in case it’s needed. It’s also used to showcase how well you can share your findings with others. It’s one of those skills that will help you in the long run.
   • Presentation: Being able to present what you did and the reasoning behind your decisions is a must-have skill. It also ties in very well with communication, but presentation is all about presenting your work to stakeholders or sometimes to a hiring manager looking at your resume. Being able to present your work properly can help you get the role you want.
   • Comfortable being wrong: Cybersecurity is a field where you have to deal with an enormous amount of information, and sometimes you can be wrong about something or have a lapse in your understanding. In those situations, you should be comfortable with being wrong and asking questions or getting help from your seniors. That’s part of the process.
   • Open to learning: Every day, there is a new tool to learn, a new technology being introduced, or a change in the technology stack, and you should be open to learning. This is one of those fields where you have to continuously learn to stay ahead of threat actors.
   • Knowing your limits: It is an essential skill to know your limits to avoid burnout. The cybersecurity field has a serious problem with burnout, and burnout can be tricky to handle when your job requires a lot of attention to detail. It’s one of the skills you must have to know when to take a break or when to say no.
2. Hard Skills:
   • OS fundamentals: Operating systems are critical parts of any system or organization, and they play a major role in how we use technology. Everything from servers to mobile devices utilizes an OS, and being able to work efficiently with operating systems is critical to the job. Linux and Windows are the primary operating systems you should be familiar with.
   • Network fundamentals: The internet and how we share resources and information online are only made possible through networking. Without understanding networking, it’s not possible to properly protect a system. Being familiar with various networking concepts such as the OSI model, TCP/IP, subnetting, VLANs, switches, and routers is critical for the role.
   • Command line proficiency: A working understanding of Bash, Command Prompt, and PowerShell is also absolutely necessary for being an analyst. You have to know what kinds of commands and scripts are routine and harmless and what could be potentially harmful.
   • Cryptography: As an analyst, you will regularly work with hashes, and they play a crucial role in checking file integrity and identifying known files. Hashes can also be used to check whether a file matches a known malicious or benign sample, although a hash alone cannot determine whether an unknown file is malicious.
   • Knowing “how to Google” effectively: While working as a cybersecurity professional, you will have to face many challenges, and sometimes the answer will be one search away, so it’s really important to know how to use Google effectively.
   • SIEM/EDR knowledge: SIEM and EDR tools will provide pivotal information for filtering through the noise and correlating logs and other telemetry to gather more information about the alert you have been assigned. Knowing how to use these tools is very important for an analyst role.
   • Windows and Linux log analysis: One of the main sources of information will come from logs. Whether a new account was created or an unknown file was launched, being able to read, filter, and correlate logs effectively will be critical for the role of a SOC analyst.
   • Windows forensic artifact knowledge: Since Windows has a large market share around the world, knowing how to analyze Windows forensic artifacts is very useful for a SOC analyst.
   • Foundational malware analysis knowledge: Being familiar with malware analysis is also useful for the job, as you may be tasked with performing basic static analysis on suspicious files or artifacts to determine whether they are malicious and gather more information about them. You can read more here: A Beginner’s Guide to Malware Analysis.
   • Familiarity with MITRE ATT &CK and the Cyber Kill Chain: These frameworks help you understand how different stages of an attack work and how adversaries operate. Being familiar with them will help you better analyze incidents and understand the techniques being used by threat actors.

Recommendations

The recommendation part is where you will get direct insights from industry experts about how you can gain these skills and actually break into the role. These are for improving your soft skills.

1. Start Building a Network from Day One: One of the unfortunate yet important aspects of the field is that knowing the right people can make a big difference when trying to get in. Even today, a lot of hiring is influenced by connections and trust, and that comes from building relationships with people. Provide value before you ask for anything. My primary suggestion is to connect with people on LinkedIn, Discord, and X. Discord servers are a good way to talk to people in cybersecurity. Here you can join our server to connect with people in the industry: https://discord.gg/QH8mRSCdW9. You will be able to find people who think alike and eventually build relationships that could open up doors in the future.
2. Look Backward & Forward to Keep Learning: When you are learning new technology, tools, or skills, you have to look forward to what you are learning, but also look back at what you have already learned. For example, when you are learning EDR, you will want to associate how it works with what you previously learned; in our scenario, a SIEM tool. Both technologies collect and provide security telemetry, but they serve different purposes. This is one of the best ways to solidify what you have already learned and keep building on your understanding, because learning never stops. If you can’t remember the foundation, then you can’t progress in this field.
3. Be Communicative: One of the constant recommendations I get from people in cyber is to be communicative. A lot of people like to stay in their comfort zone and not talk about what they are working on, or even try to network with someone. You can build quality connections if you talk to people rather than just dropping a message on LinkedIn. This is where you are likely to find most of the opportunities, so be communicative.
4. Practice Public Speaking: This one comes from a person who has tested this before, but being able to speak at public events such as conferences or virtual conferences is a great way to develop communication skills. Being comfortable communicating with a crowd can also give you more exposure than many other forms of practice.
5. Attend Conferences: This goes without saying, but the best way to kill multiple birds with one stone is to attend a conference, and if you can, then apply to be a speaker. Now you are not only actively demonstrating your communication skills, but you are also showing that you are willing to take initiative. This kind of exposure can help you build a strong network, which is a very important part of cybersecurity.
6. Good Time Management: After talking to a person who has over 20 years of experience working in security roles, one thing they said is that if you can manage to study while doing a part-time or full-time job and still manage your time to upskill yourself, it gives you a huge advantage. It shows the drive and passion you have, which is where most candidates would fail. Never wait; keep learning, keep growing.
7. Do Volunteering: Volunteering for cybersecurity events or NGOs is a great way to connect with people who are industry veterans. One perk is that you not only get to talk to people who are working in the industry, but they may also be more willing to help you as a good gesture for volunteering.
8. Take on Leadership Roles: This also falls under the umbrella of volunteering or any project work. If you get the opportunity to lead, you should always seize it, because showing leadership skills can give you an advantage over the competition in the cybersecurity field. Being able to lead a group to complete a project or task on time also shows that you are good at working and cooperating with others.
9. Do Write-Ups: This will force you to write organic content, which is only possible with a deep understanding of the topic. I would highly recommend participating in CTFs and doing a write-up of your solution. This will show gaps in your understanding and force you to research and get better at what you are writing, which in turn improves your writing and communication. DO NOT USE AI.
10. Make Time to Practice: It’s essential to make time to practice your hard skills on a regular basis. There are multiple platforms such as SkillBit, Hack The Box, TryHackMe, CyberDefenders, and Blue Team Labs. All of them have content that can help you stay sharp and prevent skill decay. Skill decay is a real problem. If you don’t continuously practice, you can lose a substantial amount of knowledge, so it’s highly recommended to continue training and practicing.

Certifications & Courses

Certifications and courses can be useful, but their value depends heavily on what you are trying to achieve. This section is about developing hard skills and actually becoming technically apt for the analyst role. FYI, these are not sponsored but are shared by people working in the SOC world and their recommendations.

1. Certifications
   • CompTIA Security+ / EC-Council Certified Ethical Hacker (CEH): These two certifications often compete for entry-level roles, depending on where you are and what the employer is looking for. I have personally taken Security+ and would recommend it to people starting out as an ATS-friendly certification. As for the value they provide, I don’t think it goes much beyond remembering a few acronyms and understanding the basics of cybersecurity, but they are still valued by HR and can help you get past the initial screening. The real value is not in the certificate itself, but in the people who value it, the hiring managers. More information here: https://www.comptia.org/en/certifications/security, and https://www.eccouncil.org/train-certify/certified-ethical-hacker-ceh.
   • Blue Team Level 1 (BTL1): The Blue Team Level 1 certificate is not mentioned as often in job applications, but from the personal experiences of people in cyber, they do regard it as a good starting point. It’s not a must-have; it’s one of those certifications or training programs you can pursue after the first two. Keep in mind that BTL1 is a practical exam with solid training content, and it is generally more appreciated by technical people because it actually tests your ability to perform defensive security tasks. More information here: https://www.centri.org/certifications/blue-team-level-1.
2. Courses
   • Self-paced Splunk Training: Splunk provides free and paid self-paced courses and training material that you can use to learn about SIEMs and how to utilize Splunk. A lot of enterprises use Splunk as part of their security stack, alongside Elastic. You will gain a ton of information by going through the courses, and you can use TryHackMe or CyberDefenders to practice what you learned. More information here: https://www.splunk.com/en_us/training/free-courses/overview.html.
   • TCM Security’s SOC 101: TCM Security has a comprehensive course for beginners, with a primary focus on bite-sized videos, quizzes, and practical simulations for hands-on practice. It’s suited for people who would prefer a course with video content. More information here: https://tcm-sec.com/academy/security-operations-soc-101.
   • SOC Level 1 Learning Path: TryHackMe offers this pathway, which consists of different modules and multiple rooms. Every piece of content has a practical exercise associated with it. There are no videos, though. It’s written content, geared towards complete beginners, but it doesn’t hold your hand throughout the practical. If you get stuck, you can always look for walkthroughs online. More information here: https://tryhackme.com/path/outline/soclevel1.
   • SOC Analyst Job-Role Path: The HackTheBox platform is always a little geared towards intermediate learners and more real-world simulations. They have plenty of labs you can use to train while learning, but there is not much hand-holding here as well. You will have to figure some things out on your own, and it’s “gain through pain.” More information here: https://academy.hackthebox.com/path/preview/soc-analyst.

This section was made from my personal experience as well as the experiences of people working as SOC analysts. I will always look at any roadmap to becoming a SOC analyst with a grain of salt, because it’s an egg-and-chicken conundrum. To become an analyst, you need real-world experience, but to land a job, you need real-world experience. The disconnect here is real.

Downsides

It’s not all rainbows and sunshine; there are a few drawbacks when it comes to an analyst role, and I would recommend reading this and genuinely thinking deeply about whether, even with this knowledge, you would still want to choose this role.

1. It’s not actually entry-level: SOC analyst is often marketed as an entry-level cybersecurity role, but many job postings still require prior IT or security experience. Even Tier 1 roles can expect you to already have experience with networking, operating systems, or security tools. DO NOT FALL FOR IT, NEW GRADUATES.
2. You will be working graveyard shifts: A lot of SOCs operate 24/7, which means someone has to be watching the environment at night. Depending on the organization, you may end up working night shifts, weekends, or rotating shifts. This can mess up your sleep schedule and make it harder to maintain a normal routine.
3. It’s a repetitive task: A large part of the job can involve looking at alerts, investigating similar types of activity, checking logs, and following the same procedures again and again. You will see a lot of the same things, especially when working in a mature SOC with well-established processes.
4. It’s tedious and mind-numbing: Not every alert is going to be some sophisticated attack. A lot of the time, you will be dealing with false positives, routine activity, and alerts that turn out to be harmless. After spending hours doing the same type of investigation, it can get mentally exhausting.
5. It’s stressful: When there is a genuine security incident, you may have to make decisions quickly while dealing with a large amount of information. There can also be pressure from management, other teams, or the customer to contain the incident and restore normal operations. On top of that, constantly staying alert can take a toll over time.

Closing Remarks

Last words of advice: it’s not gonna be an easy journey, but if you have the passion for cybersecurity and genuinely want to carry on and grind, then this journey will be a rewarding one. Cybersecurity is one of those dynamic fields with a lot of opportunities and learning. If you can carry that passion into the work you do, you will go a very long way, and as they say, the sky is the limit.

Keep learning, and good luck.