How to become a SOC analyst: tier 1 to tier 3, read from 262 open security operations postings

What a security operations center analyst does all shift, what open postings demand at each tier, and the routes that lead from no security job to a seat in the alert queue.

A SOC analyst works inside a security operations center, reading the alerts an organization's monitoring tools raise and deciding, one by one, whether each is an attack: a false alarm gets closed with a written reason, a real intrusion gets contained and handed to the people who finish the response. The realistic way into that seat is rarely a course followed by an application. It usually runs through a technical job next door (IT support, network operations, systems work) or a night-shift tier 1 seat at a provider that monitors many companies at once, backed by one entry certification and a few investigations you can show. Reading 262 open SOC, detection and incident response postings in full on 11 November 2026, this board found that only 10 of them were pitched at interns or first-rung juniors, while the typical posting that named a minimum asked for five years. This guide is about what those postings reveal, tier by tier, and how to close the distance between those two numbers.

How the figures were gathered. The sample starts from every open role CyberJobs.cc classed as security operations and incident response on 11 November 2026 (308 at the time), plus 37 roles filed under other specialties whose titles named SOC, detection, incident response, threat hunting or cyber defense. Chip-design "SoC" jobs, engineers who build SIEM products, sales and support seats, physical-security operations centers (guards, cameras, badge readers), compliance analysts and vulnerability-scanning roles were then taken out, which left 262 postings from 119 employers. Each posting was read whole and counted for what it says: the tier it names, the hours it describes, the tools, frameworks, languages and certifications it mentions, the years and degrees it asks for, and the pay it prints. Nine of the 262 are written in French, Portuguese, Japanese or Korean, so word counts slightly undercount them. Pay comes only from ranges employers published. Where the board can count something live, the figure below is recounted when you open the page: at this moment the board holds 309 open roles in security operations and incident response. Outside figures carry a link to the page that states them and its date.

Contents

1. What a SOC analyst does, one alert at a time
2. Tier 1, tier 2, tier 3, and teams with no tiers at all
3. What 262 open SOC postings ask for
4. Skills to learn, in the order they pay off
5. SOC analyst certifications: what the postings name
6. Becoming a SOC analyst with no experience
7. SOC analyst salary by tier, employer and workplace
8. Shifts, on-call, burnout and remote work
9. What AI agents are doing to tier 1
10. Where the SOC leads after two or three years
11. Your first year in the seat: earning tier 2
12. SOC analyst questions, answered

1. What a SOC analyst does, one alert at a time

The US government's workforce taxonomy splits the SOC seat across two work roles. Its Defensive Cybersecurity role (PD-WRL-001) is "responsible for analyzing data collected from various cybersecurity defense tools to mitigate risks" - NICCS, NICE Framework 2.2.0. Its Incident Response role (PD-WRL-003) is "responsible for investigating, analyzing, and responding to network cybersecurity incidents" - NICCS. A tier 1 analyst lives mostly in the first definition and borrows from the second; by tier 3 the balance has flipped.

Underneath the definitions sits a simple piece of economics. Detection tools are cheap to run and generate far more signals than people can act on, while a wrong decision is expensive in both directions: a dismissed intrusion can run for weeks, and a laptop isolated by mistake can stop a payroll run. The analyst exists to turn a cheap signal into a decision that holds up later, so the product of the job is not the click that closes an alert but the reasoning recorded next to it. AlphaSense's posting for a Security Operations Analyst II says it plainly: each alert should be classed as a true positive, a false positive or benign activity "with documented rationale, not just a verdict".

A single alert, followed from start to finish

Take a medium-severity alert that lands at 23:40. The endpoint detection and response (EDR) agent on a laptop in the finance team reports that a new scheduled task was created, and the task launches an executable stored inside the user's AppData folder. Here is how a careful analyst works it.

Read the rule before reading the data. What does this detection look for, and how often does it fire? A rule that trips two hundred times a week, almost always on the company's own software updaters, earns a different starting suspicion than one that has fired twice this year. Knowing the rule's history is part of the evidence.

Establish what the file is. Look at its hash, whether it is signed and by whom, and how many machines in the company have run it before. A signed binary present on three thousand laptops is a different story from an unsigned one seen on a single device for the first time tonight.

Walk backwards to the cause. Which process created the task, and which process started that one? A browser download, a mail attachment opened from Outlook, or a remote-management tool each tell you something different. Sysmon, the system monitor in Microsoft's Sysinternals suite, records process creation with the full command line of both the new process and its parent - Microsoft Learn, Sysmon. Windows' own process-creation event, 4688, leaves the command line empty unless an administrator switches on a specific group policy setting - Microsoft Learn, event 4688, which is one reason so many SOCs lean on Sysmon or an EDR agent rather than default Windows logging.

Walk forwards to the consequences. Did the executable open network connections or resolve unusual domains? Sysmon logs connections as event 3 (switched off by default) and DNS queries as event 22. A beacon to a domain registered last week, every sixty seconds, settles most debates.

Decide, then act within your authority. If the IT team pushed a new tool that afternoon and the ticket matches, the alert is benign and the note says so. If the rule matched something it should never have matched, it is a false positive, and the right follow-up is a tuning request to whoever owns the rule. If the evidence points to an intrusion, the playbook decides the next steps: isolate the host from the EDR console, disable or reset the account, and escalate.

Write it so a stranger could repeat it. The case note records the trigger, every check you ran and its result, the conclusion, and each action taken. AlphaSense asks its analysts to escalate with "a complete investigation package - context, evidence, timeline, and a hypothesis", and most tier 2 analysts would sign that sentence.

That one alert might take ten minutes or two hours. The rest of a shift mixes the same pattern across other sources: phishing reports forwarded by employees, identity alerts from the sign-in provider (a burst of push requests a user did not expect, an unfamiliar device enrolling for multi-factor authentication), cloud alerts (an access key suddenly used from a network the company has never seen), and plenty of noise. The shift ends with a handover, in writing, of every case still open.

The postings confirm this mix. Among the 57 postings with analyst titles in the sample, 82% mention investigation, 70% triage, 53% escalation, 46% containment actions such as isolating hosts or disabling accounts, 46% documentation, case notes or written reports, and 39% playbooks or runbooks.

Who employs SOC analysts

The title tells you a lot about the employer. Of the 57 analyst-titled postings, 22 came from security vendors and managed detection and response (MDR) providers, where one analyst's queue holds alerts from dozens or hundreds of customer environments; the rest were spread across software, cloud, defense and finance companies. Software, cloud and finance companies building their own teams mostly title the same work differently: 73 of the 107 "detection and response engineer" or "security operations engineer" postings came from those three groups. The difference is more than a word. An MDR analyst sees many networks shallowly and learns fast from volume; an in-house engineer sees one network deeply and is expected to fix its gaps in code. Both are SOC careers, and section 10 explains how people move between them.

2. Tier 1, tier 2, tier 3, and teams with no tiers at all

The classic SOC sorts its analysts into three tiers, each catching what the one below cannot finish. Tier 1 watches the queue, triages, enriches and escalates. Tier 2 takes the escalations, investigates them end to end, contains what is real and runs the smaller incidents. Tier 3 handles the hardest cases, hunts for attackers no alert caught, analyzes malware and forensic images, writes and improves detections, and coaches the other two tiers. Above them sit shift leads and SOC managers. The model persists because it routes scarce senior attention to where it matters and gives juniors a structure in which mistakes get caught before they cost much.

Twenty-two of the 262 postings use tier or level vocabulary to describe the seat or the team around it, including 12 of the 57 analyst titles. The language shows how employers draw the lines. Nebius was hiring a Tier 2 and a Tier 3 security analyst, and its Tier 3 seat is expected to mentor Tier 1 and Tier 2 analysts through case reviews and coaching. AlphaSense describes its Analyst II as sitting "at Tier 1-2 in our operating model", someone already past the stage of learning what alerts look like. Wrike's L2 analyst works behind an MDR partner that absorbs the initial noise, so the in-house analyst spends the shift on what the partner escalates and on complex investigations. Thales was recruiting an L1 SOC analyst in Lisbon, and Saviynt an L3 analyst acting as the senior technical escalation point. One incident response posting, at TENEX.AI, made two years as a tier 3 analyst part of its minimum.

The years behind each tier

The years asked rise in a clear staircase, which the chart shows using the smallest number of years each posting named.

Two readings matter for a newcomer. First, a title without a level word is not an entry seat: those 82 postings asked for a median of three years, and only 6 of the 59 that named a figure asked for a year or less. Second, the step from tier 2 to tier 3 is where the requirement jumps, from two or three years to five. That is the move most analysts spend their second and third years earning, and section 11 is about how.

Teams that have stopped using tiers

The tier model is no longer universal. Three postings from Flexport stated flatly that the team has "no MSSP and no tier-1 queue", because its detection and response engineers own every detection end to end. Nscale described a three-person regional rotation in which each engineer holds the operational slot roughly one week in three and spends the other two weeks on detection engineering, while "in-house security agents hold level 0 and level 1 around the clock". Legora's detection and response posting said that "agents handle first-pass triage and routine investigation".

Those teams have not removed tier 1 work. They have handed it to automation or to an outside provider, and kept people for the decisions above it. For someone trying to get in, the consequence is double. Such teams almost never hire beginners, because there is no tier 1 seat to fill; and the tier 1 work that still employs people is concentrated at MDR providers, large enterprises and government contractors. Section 9 looks at what that shift means for the first rung.

What separates the tiers on paper

Setting the 57 analyst-titled postings beside the 107 engineer-titled detection and response postings shows what employers add to the job, and pay more for, as people climb.

Escalation is twice as common in analyst postings, and writing detections, automation and Python are roughly twice as common in engineering ones. That is the career in one picture: the junior seat passes problems upward with good notes, and the senior seat makes sure the same problem never needs a person again.

3. What 262 open SOC postings ask for

The table gathers the counts that most shape a plan. A posting counts once for an item whether it names it as required or as a bonus, because few postings separate the two cleanly.

The SIEM is a concept before it is a product

More than two postings in three name a SIEM, the system that collects logs from across the company and runs the searches and rules that raise alerts. Far fewer name a brand: Splunk in 54 (21%), the Elastic stack in 27 (10%, not counting Elastic's own postings), Microsoft Sentinel in 21 (8%), Google's Chronicle or Security Operations in 11, Panther in 9 and QRadar in 7. The same pattern holds for endpoint tools: 115 postings mention EDR or XDR, yet CrowdStrike appears in only 17 postings from other employers, SentinelOne in 8 and Microsoft Defender in 7.

The lesson is that employers hire for the skill of searching logs and reading endpoint telemetry, and expect any competent analyst to learn their particular console in weeks. Hiring managers say the same in surveys: in the SANS 2025 SOC Survey, 43% of respondents named the SIEM as the top technical skill they look for when hiring, more than double the next answer - SANS 2025 SOC Survey. Learn one SIEM's query language properly and you can read any of them.

Searching and scripting

Python appears in 140 postings (53%), well ahead of PowerShell (45), Go (46, three quarters of them engineering seats) and Bash (33). Query languages are named less often than they are used: SQL in 47 postings, Microsoft's KQL in 37 and Splunk's SPL in 22. Most postings assume search skill under the word "SIEM" rather than naming a language, which is why interviews test it with a live query far more often than the postings suggest.

Frameworks: ATT&CK first, everything else far behind

MITRE ATT&CK, the public catalogue of attacker tactics and techniques, is named in 99 postings (38%), and in 28 of the 57 analyst titles. No other framework comes close. NIST is named in 29 postings, about half of them for its Cybersecurity Framework, and only 2 cite NIST's incident handling guide by its number. That guide changed in April 2025, when SP 800-61 Revision 3 replaced the 2012 Revision 2 and recast incident response as a Community Profile of the NIST Cybersecurity Framework 2.0 - NIST CSRC. Worth reading for the vocabulary; rarely worth putting on a résumé.

Cloud and identity are part of the job now

AWS appears in 119 postings (45%), Google Cloud in 83 and Azure in 81, and containers or Kubernetes in 57. Identity platforms ( Okta, Microsoft Entra ID, Active Directory) are named outright in 39. A SOC analyst in 2026 investigates sign-ins, cloud API calls and software-as-a-service audit logs as routinely as laptops. AlphaSense's analyst posting lists the cloud patterns it expects analysts to recognise: credential abuse through the metadata service, privilege escalation through IAM role assumption, and access to misconfigured storage.

Experience, degrees and clearances

Of the 262 postings, 194 state a minimum number of years. Their median is five, 101 ask for five or more, and 47 ask for two or fewer. Analyst titles sit lower than the rest: their median minimum is three years, and 16 of the 36 that state a number ask for two or fewer.

Degrees matter less than the job's reputation suggests. Of the 253 postings written in English, 91 mention a degree at all. Of those, 68 accept experience, certifications or another route in its place, 9 call it a preference or an advantage, 2 are internships for students, and 12 make it a firm requirement, which is under 5% of the English-language sample. Among analyst titles, just 3 postings insisted on a degree with no alternative.

A clearance appeared in 17 postings (6%): at defense technology companies such as Anduril Industries, Apex, Palantir and Second Front, at vendors serving US government customers ( Databricks, GuidePoint Security and Esri among them), and in three UK roles at KnowBe4 and Saviynt that require Security Check vetting. Thirty-six postings mention citizenship. The cleared roles page lists every cleared security role on the board by the level it names.

Language and geography

The SOC market is international. Of the 262 postings, 139 were for jobs outside the United States, 105 inside it and 18 could not be placed from the posting. Nine postings required Japanese, and others asked for German ( Coalition and Dragos), Dutch or German ( Eye Security) or several languages ( Darktrace) alongside English. A second language is a genuine advantage for follow-the-sun teams and for MDR providers serving customers in several countries; Darktrace, for one, had a multilingual cyber defense specialist seat open in the US.

4. Skills to learn, in the order they pay off

A study plan is easier to keep when each step makes the next one usable. The order below follows the alert walk-through in section 1: first understand what the evidence is, then learn to find it, then learn to explain it, then learn to stop needing to look for it by hand.

Step 1: how Windows and Linux behave, and where they write it down

Start with the operating systems, because every alert ends up as a question about one. On Windows, learn processes and their parents, services, scheduled tasks, the run keys in the registry, local and domain accounts, and which events record each. Install Sysmon on a virtual machine and read its output until event 1 (process creation), event 3 (network connection) and event 22 (DNS query) feel familiar; the documentation describes every event type it writes - Microsoft Learn, Sysmon. On Linux, learn users and sudo, cron and systemd, shell history and where authentication logs live. Linux was named in 98 postings and Windows in 86, so neither can be skipped.

Step 2: enough networking to read a connection log

You do not need a network engineer's depth. You need to know what DNS, HTTP and TLS look like in a log, what proxies and firewalls each log, what network address translation hides, and why a steady connection every sixty seconds to a new domain looks like command and control. Seventy-four postings mention networking knowledge in so many words, and nearly all the rest assume it.

Step 3: one query language, learned deeply

Pick KQL if you expect to work in Microsoft environments or SPL if you expect Splunk, and practise until you can turn an investigative question into a query without looking anything up. KQL pipes a table through operators, each step filtering or reshaping what the last produced - Microsoft Learn, KQL overview. SPL works the same way on Splunk's indexes, and its full command reference is public - Splunk SPL reference.

A good first exercise is stacking: counting how widespread something is, because rare things deserve attention first. This KQL query, written for Microsoft Defender's advanced hunting, lists executables that ran on exactly one device in the past week:

// Executables seen on a single device in the last 7 days, newest first
DeviceProcessEvents
| where Timestamp > ago(7d)
| where isnotempty(SHA1)
| summarize Devices = dcount(DeviceName), FirstSeen = min(Timestamp),
    SampleCommand = take_any(ProcessCommandLine) by SHA1, FileName
| where Devices == 1
| order by FirstSeen desc

The query groups on SHA-1 rather than SHA-256 because Microsoft's schema notes that the SHA-256 column of that table is usually empty - Microsoft Learn, DeviceProcessEvents. The same idea in SPL over Sysmon data looks like this (field names depend on how your Sysmon logs are parsed):

index=sysmon EventCode=1 earliest=-7d
| stats dc(host) AS devices, min(_time) AS first_seen, values(CommandLine) AS commands BY Hashes, Image
| where devices=1
| sort - first_seen

Practise queries like these until you can write and explain them on the spot: SOC interview loops often include a live query, as the interview questions guide shows.

Step 4: identity, email and cloud logs

Identity runs through so many investigations that 39 postings name identity platforms outright and nearly half name a cloud provider. Learn how an identity provider logs sign-ins, multi-factor prompts, new device registrations and app consents, and how a cloud provider's audit trail records API calls. Practise reading one suspicious sign-in all the way through: where it came from, which factor it passed, which session it created, and what that session did next.

Step 5: ATT&CK as a shared vocabulary

Learn to describe what you see in ATT&CK's terms, because 38% of postings ask for it and because it makes your notes legible to every other team. The framework is updated twice a year; version 20.1, released on 13 October 2026, organizes the Enterprise matrix into 15 tactics, including two named Stealth and Defense Impairment - MITRE ATT&CK versions, MITRE ATT&CK Enterprise matrix. Study material written before that release may describe the matrix differently, so check which version a resource follows.

Step 6: Python for the work you repeat

Use Python to automate what you do more than three times a week: enriching an indicator against several sources, parsing an odd log format, pulling every sign-in for one account from an API. You are not aiming to become a developer at this stage. You are aiming to show, as 44% of analyst postings and 79% of engineering postings ask, that you can make a computer do the dull part.

Step 7: write detections, not only investigations

The bridge from analyst to engineer is writing the rule that would have caught what you just investigated. Sigma, a vendor-neutral format for detection rules, lets you write one rule and convert it for different SIEMs, and its public repository holds more than 3,000 rules to learn from - SigmaHQ on GitHub. Forty-six postings asked for "detection as code", meaning rules kept in version control, reviewed and tested like software.

Step 8: writing for people who were not there

Communication skills appeared in 201 postings (77%), more than any tool. In a SOC that means case notes another analyst can pick up at 4 a.m., escalations a manager can act on in two minutes, and incident summaries a lawyer can read without a glossary. Practise by writing up every lab investigation as if it were a real case.

5. SOC analyst certifications: what the postings name

Certifications are where the gap between advice and postings is widest. Of the 262 postings, 167 (64%) name no certification at all. Among those that do, the ranking looks quite different from the usual beginner's list.

GIAC's incident handler certification, the GCIH, is the single most-named credential in SOC work: 57 postings (22%) from 36 different employers. GIAC certifications as a family appear in 78 (30%), with the forensics-focused GCFA in 41 and the intrusion-analysis GCIA in 20. The CISSP follows with 39 postings, but who asks for it matters: 16 were incident response consultant postings and 12 were management seats, against only 4 analyst titles.

The picture changes again when you look only at the 57 analyst-titled postings. There, GIAC certifications appear in 22, Security+ in 16 (28%) and CySA+ in 11 (19%), while the CISSP drops to 4. Security+ is close to invisible in senior detection work (3 of 107 engineering postings name it), yet it is the most common baseline credential in exactly the seats beginners apply for. Blue-team practitioner certifications such as BTL1 appeared in 3 postings, CEH in 8 and Microsoft's SC-200 in 2.

Across the whole board, the specialty that names Security+ most often is security operations and incident response, with 26 of the 89 postings that name it, according to the Security+ page; CySA+ was named in 23 postings, 14 of them in security operations; and GIAC certifications in 218, of which 78 were security operations roles (all figures read 11 November 2026).

What each one costs you in time and experience

CompTIA Security+ is changing this month. The V8 exam, code SY0-801, is scheduled to go live around 17 November 2026, with up to 90 questions in 90 minutes and a pass mark of 750 (the scale runs from 100 to 900); CompTIA recommends two years of hands-on work as a security administrator but does not require it - CompTIA Security+ V8. Make sure any study material matches the version you will sit.

CompTIA CySA+ moved to V4 (exam CS0-004) on 23 June 2026: up to 85 questions in 165 minutes, the same 750 passing score, and a recommendation of about four years in a SOC analyst or vulnerability analyst role. Its domains weigh security operations at 34%, vulnerability management at 26%, incident response and management at 24% and reporting and communication at 16% - CompTIA CySA+ V4. The English V3 exam retires on 22 December 2026 - CompTIA CySA+. Given that four-year recommendation, CySA+ fits better as a second certification, taken a year or two into the job, than as a first.

GIAC GCIH is a 106-question, four-hour exam; for exam versions released on or after 10 May 2025 the minimum passing score is 69% - GIAC GCIH. It covers incident handling alongside the attacker techniques and tools a handler needs to recognise. The GIAC page lists the exam format but no price, so work out the full cost before paying for it yourself; the practical sequence is to earn the job first and then ask the employer's training budget to cover it.

The CISSP requires at least five years of cumulative full-time experience in two or more of its eight domains; someone who passes the exam earlier becomes an Associate of ISC2 and has six years to earn the experience - ISC2. That rule is why it clusters in senior and management postings; the CISSP page shows where it is named today.

A sensible order

For someone with no security job yet, Security+ is still the most useful single exam, because it is the one analyst-titled postings name most often (16 of 57, just ahead of the GCIH's 14). Someone already working in IT who targets an MDR provider or a tech company can sometimes skip it and put the time into a lab and written investigations instead, since 64% of postings name nothing at all. After a year in a SOC, aim for the GCIH (ideally employer-funded) or CySA+. Leave the CISSP until the years exist. The certifications page recounts every certification across all open security postings each hour.

6. Becoming a SOC analyst with no experience

Start with the honest arithmetic. Only 10 of the 262 postings (4%) carried an intern, co-op, junior, associate, "I" or L1 level in the title, another 5 were titled tier 2 or "II", and only 47 of the 194 that stated a minimum asked for two years or less. That evening the entry-level roles page showed 16 junior seats in security operations and incident response, out of 59 junior security roles across all specialties. So the entry door exists, but it is narrow, and the people who get through it usually arrive with something already in hand.

What they arrive with follows from section 1: the job is judging whether activity is normal, and that judgment comes from having run systems. Hence the routes below, roughly in order of how reliably they lead to a SOC seat.

Route 1: the service desk or IT support

A year on a service desk teaches what normal looks like at a level of detail no course reaches: why accounts lock out, how laptops are imaged, which software every department installs, what a real user's day leaves in the logs. Ask to handle the tickets that touch security (reported phishing, suspicious sign-in notifications, endpoint agent problems, access requests), learn the security team's names, and ask to shadow an incident. An internal candidate brings something no outsider can: a hiring manager who already knows how they work.

Route 2: the network operations center

A network operations center (NOC) is the SOC's closest cousin: a monitored queue of alarms, shift work, ticket discipline, escalation paths and handovers, aimed at outages instead of attackers. NOC staff learn packet captures, routing and firewall logs under time pressure, and the move to a SOC is mostly a change of question, from "is it down" to "is it hostile".

Route 3: tier 1 at an MDR provider or a large SOC

Managed detection and response providers run around the clock, see enormous alert volumes and therefore need people on every shift, which gives them a reason to train beginners that a small in-house team lacks. Expel's Associate SOC Analyst posting is a clear example: it prefers one to two years of IT or security experience but adds that "if you've got passion, potential, and a compelling story, we want to hear it", asks for participation in 24x7 rotational coverage, and states a base of $85,000 to $90,000 plus a 20% bonus. Not every provider is that open. Huntress's West Coast shift analyst seat asked for four or more years in a SOC or forensics role, and listed previous MSP, MSSP or MDR experience as a plus, which shows how much one provider's tier 1 years are worth at the next.

Route 4: internships, co-ops and graduate programs

Students have doors nobody else has. Lila Sciences had an IT/OT security analyst co-op open on 11 November 2026, and Agoda a security analyst internship for 2027. The internships page lists the current ones, and some, like Agoda's, were already recruiting for a start date a year away.

Route 5: military and government service

Veterans of cyber and signals units bring operational experience and, often, a clearance, which defense employers value highly: Apex's SOC analyst seat in Los Angeles, which named a Top Secret clearance in its title, stated $88,000 to $121,000. Esri's Security Operations Analyst posting required US citizenship and the ability to obtain a clearance. The cleared roles page gathers these postings.

The proof that replaces experience

Whatever the route, the gap to close is evidence that you can do the work. Four kinds persuade SOC hiring managers.

1. A small lab with real telemetry. Two or three virtual machines, Sysmon on the Windows one, logs shipped into a free SIEM, and a few well-documented attack techniques run against them so you can see what each leaves behind.
2. Three written investigations. Pick public datasets or your own lab, and write each up as a case: the trigger, the checks you ran, the conclusion you reached and the detection or process change you would propose. Short, specific and honest about uncertainty.
3. A handful of detection rules. Two or three Sigma rules in a public repository, each mapped to the ATT&CK technique it catches and with a note on its expected false positives.
4. Competitions. Defensive capture-the-flag events and the Collegiate Cyber Defense Competition count: Huntress lists CCDC participation among its preferred qualifications for analysts.

Then make the application match. The cybersecurity résumé guide shows how to write SOC experience (including lab work) so screeners can see it, and the interview questions guide works through the triage questions SOC loops ask. You can rehearse those rounds with written feedback in interview practice. If you are still choosing between security specialties rather than aiming at the SOC already, start with how to get into cybersecurity, which compares the doors into every kind of security work.

7. SOC analyst salary by tier, employer and workplace

Pay in the SOC depends on four things: the tier, whether the seat is titled analyst or engineer, the kind of employer, and the country. The economy-wide benchmark comes from the US government. For information security analysts, a category broader than SOC work, the median annual wage was $129,180 in May 2025; the lowest-paid 10% earned under $75,090 and the highest-paid 10% over $199,850 - BLS Occupational Outlook Handbook.

This board reads employers who publish ranges through modern hiring systems, which tilts its figures toward software, cloud and security companies. Its SOC analyst salary page gave security operations and incident response a typical yearly band of $146,000 to $320,000 and a midpoint of $177,000, built from 129 ranges at 68 employers (read 11 November 2026, 22:07 UTC). Because that band mixes analysts with detection engineers and incident response leads, it overstates what an analyst title pays. Today's live figures for the specialty are a middle of $177k/yr, within a typical span of $146k/yr to $320k/yr.

Splitting the sample by title shows how much the word on the business card matters. The chart uses the 96 US postings in the sample that printed a range, and shows the median midpoint of each group's ranges.

Analyst-titled postings in the US had a median midpoint of $116,250, incident response and DFIR postings $157,700, detection and response engineering postings $197,744, and managers and directors $221,250. The gap between analyst and engineer, roughly $80,000 at the midpoint, is the clearest financial argument for learning automation and detection writing early.

The analyst ranges themselves show the spread within one title. These are the US analyst-titled postings in the sample that printed a range:

Three patterns stand out. The first rung at a mid-size employer starts around $70,000 to $90,000, close to the BLS lowest decile. Moving up a tier at the same employer adds roughly $25,000 to $60,000 at the midpoint, as the two pairs from 7AI and SpaceX show. And defense-technology companies (Palantir, Anduril Industries) pay analyst titles at levels other employers reserve for senior seats; both name clearances in their postings, which shrinks the pool they can hire from.

Employer kind and workplace

On the salary page, the middle stated pay for security operations at security consultancies and managed service providers was $155,000, at security software companies $177,000, at software and internet companies $189,000 and at the six AI-lab postings with a range $340,000. Remote work carried no discount: remote postings came out at $186,000 in the middle, on-site and hybrid ones at $173,000. The sample agrees: among US postings with a range, remote seats had a median midpoint of $178,320 and the others $176,350.

Outside the United States

More than half the sample (139 postings) was outside the US, and most of those print no salary, which is normal in many European and Asian markets. For those, the board's salary calculator compares an offer with what postings of the same specialty and level state, and the security jobs by city pages show what each metro's postings state where they do. Ask the recruiter for the range early; in jurisdictions with pay-transparency rules, they may have to give it.

8. Shifts, on-call, burnout and remote work

How often the hours are unusual

Of the 262 postings, 133 (51%) mention round-the-clock coverage, scheduled shifts, on-call duty or after-hours work. The kind of out-of-hours work changes with the title. Analyst postings lean toward continuous coverage: 18 of 57 (32%) name 24x7 operation and 9 describe shift patterns outright. Engineering postings lean toward the pager: 52 of 107 (49%) mention on-call duty, against 15 of 57 analyst ones. Words like weekend, night or overnight appear in 38 postings.

The postings also show how varied the arrangements are, which is useful when you compare offers:

• Deliveroo advertised a 24/7 global security operations centre with scheduled night and weekend shifts.
• Esri works business hours, Monday to Friday, and adds an after-hours on-call rotation once a new analyst knows the systems and procedures.
• Flexential's Incident Response Analyst I works a day shift of four days, either Monday to Thursday or Tuesday to Friday.
• CrowdStrike and Palo Alto Networks both had incident response roles on dedicated weekend shift teams, CrowdStrike's on a four-day, ten-hour pattern from Friday to Monday.
• Huntress posted a remote analyst seat named for its West Coast shift.
• Check Point asked incident response analysts to join an on-call rotation including at least one weekend a month.
• Flexport described a follow-the-sun pager spread across time zones "so nobody is paged at 3am local".

Across the industry, round-the-clock coverage is the norm rather than the exception: in the SANS 2025 SOC Survey, 79% of SOCs operated 24/7 - SANS 2025 SOC Survey. The US government notes that information security analysts sometimes have to be on call outside normal business hours for emergencies - BLS.

Burnout, tenure and why people stay

The same SANS survey found that SOC staff most commonly stay three to five years in a SOC environment (31%), very few stay ten years or more (4%), and 62% of respondents said their organization was not doing enough to keep its best people - SANS 2025 SOC Survey. Its 2026 edition found that meaningful work and career progression have outranked pay as retention drivers for three years running, and that only 32% of practitioners say management prioritizes SOC hiring and retention - SANS 2026 SOC report.

Read together, those figures suggest that SOC burnout is about more than night shifts. People leave when the work stops teaching them anything: when the queue is the same false positives every night, nobody has time to fix the rules that produce them, and there is no visible way up. The shifts are survivable when the work is meaningful and the path to tier 2 is real. Before you accept an offer, ask questions that expose which kind of SOC it is:

• How many alerts does one analyst handle on a typical shift, and what share turn out to be real?
• Who owns tuning, and how long does a request to fix a noisy rule take?
• What is the rotation pattern, how much notice do schedule changes get, and is there a shift differential?
• How much of an analyst's week is protected for projects such as automation, detections or training?
• How did the last two people who were promoted from tier 1 get there, and how long did it take?

Remote work

Of the 262 postings, 109 (42%) were listed as remote, and the share varied by title: 19 of 57 analyst titles (33%), 42 of 107 engineering titles (39%) and 26 of 44 incident response titles (59%), the last because consultants work for clients wherever they are. Four of the 10 first-rung postings were remote: Expel, Samsara, Flexential and Bitdefender. At this moment 121 of the 309 open SOC and incident response roles carry a remote listing, and the remote SOC analyst jobs page lists them by employer. Most SOCs allow some home working: 73% of organizations in the SANS 2025 survey let SOC staff work remotely at least some of the time, though not every role on a team gets that flexibility - SANS 2025 SOC Survey.

Remote junior seats exist, but they are contested by applicants nationwide. A hybrid or on-site seat at a SOC within commuting distance, especially one that needs nights and weekends covered, is likely to face a much smaller pool of applicants.

9. What AI agents are doing to tier 1

The question beginners ask most is whether the first rung is disappearing. The postings give a more precise answer than the headlines.

In the sample, 50 of the 262 postings (19%) described AI systems or agents taking on part of triage or investigation, and they show three distinct arrangements. In the first, agents hold the bottom of the queue and people supervise: Nscale's agents "hold level 0 and level 1 around the clock", while its engineers judge the detection rules the agents propose, which run as shadow rules until a person approves them. In the second, analysts verify the machine's work: 7AI's tier 2 and tier 3 analysts validate the investigations its AI agents produce, prove the threat was real and answer for the result to customers. In the third, analysts build the automation themselves: Deliveroo wanted a senior SOC specialist to build and manage autonomous AI runbooks for alert triage, and Rubrik's SOC leader was asked to set the strategy for reducing alert fatigue on L1 analysts.

Industry surveys show adoption running ahead of integration. In SANS's 2026 report, 79% of SOCs used AI or machine-learning tools, but only 36% had built them into a defined SOC workflow - SANS 2026 SOC report. A year earlier, 42% of SOCs were using such tools out of the box with no customization - SANS 2025 SOC Survey.

The underlying logic is straightforward. Automation absorbs work whose evidence is structured and whose patterns are known: confirming that a flagged sign-in came from the company VPN, that a quarantined file stayed quarantined, that a reported email was marketing. Much of classic tier 1 work looks exactly like that. What remains for people is the work that requires accountability and judgment across systems: deciding that an agent's conclusion is wrong, connecting a sign-in, an endpoint and a cloud API call into one story, and deciding to wake the incident lead at 3 a.m. Someone also has to own the agents, which is why so many engineering postings now ask for the skills to build and tune them.

For a newcomer, this changes what to practise rather than whether to start. The tier 1 seat is becoming a review seat, in which you check a machine's reasoning as often as you produce your own. The skills that make you good at that are the ones in section 4: knowing what the evidence really is, writing queries to test a claim, and explaining why a conclusion holds or does not. An analyst who can say exactly why an agent's verdict is wrong is worth more than one who can only repeat its work by hand.

10. Where the SOC leads after two or three years

A SOC seat is a starting point for several careers, and the postings show which ones pay and what each asks for. Searching the board's security operations roles right now finds 152 for "engineer" and 80 for "analyst".

Detection engineering. The largest group in the sample, and the best-paid technical one: 107 engineer titles, a US median midpoint of $197,744, with 79% naming Python, 69% writing or tuning detections and 91% automation. People get there by writing detections and automations while still analysts, then moving into the team that owns the rules.

Incident response and DFIR consulting. Forty-four postings, mostly at security vendors and consultancies responding to breaches at client companies. They lean on forensics (84% of them) and malware analysis (45%), name the CISSP more often than any other group (16 of 44) and are the most often remote (59%), with travel to client sites. The sample's US ranges for senior consultants started around $115,000 to $165,000, rising to about $157,600 to $216,700 for principal consultants.

Threat hunting and detection research. Fourteen postings, almost all at security vendors such as CrowdStrike, Palo Alto Networks, Arctic Wolf, Wiz and SentinelOne, where hunters work across many customers' data and turn what they find into product detections. These ask for deep attacker knowledge and a median minimum of five years. The threat intelligence guide covers the neighbouring analysis work.

Cloud detection and response. A branch built on the cloud evidence that nearly half the postings mention (AWS alone appears in 45%). CrowdStrike had a cloud incident response consultant and a cloud detection engineer open, and ID.me a staff cloud detection and response engineer. If you enjoy reading cloud audit trails, the cloud security guide and the cloud security salary page show where that leads.

SOC leadership. Forty postings for leads, managers and directors, with a US median midpoint of $221,250. Management in a SOC means owning coverage, rotations, hiring and the relationship with the rest of the business, and several of these postings (Rubrik, Addepar and Acronis among them) add a strategy for automation and AI on top.

A newer adjacent field is protecting AI systems themselves. Writer's detection and response postings, for example, included leading the response when AI infrastructure or models are compromised. The board's AI security roles page lists that work across every specialty. For the specialty as a whole, with worked cases and a typical working day, see the security operations guide.

11. Your first year in the seat: earning tier 2

Getting hired is half the work; the other half is turning the first year into the step the postings reward. The table in section 2 shows the requirement jumping from two or three years at tier 2 to five at tier 3, and the analyst-to-engineer chart shows what employers pay for along the way. Five habits compress that time.

Own your noise. Keep a running list of the alerts you close as false positives most often, with the rule names. After a month you will know which three rules waste the most analyst time on your shift. Write up the evidence, propose the fix and follow it through to the detection owner. Tuning that reduces noise without losing true detections is one of the most visible contributions a junior analyst can make, and it trains you in exactly what detection engineers do.

Turn one investigation a month into a detection. When you work a real case, ask what rule would have caught it sooner or with less noise. Draft it, in Sigma if your team does not have its own format, and ask a senior colleague to review it. By the end of the year you will have a dozen rules with your name in the history, which is strong evidence of tier 3 potential.

Automate one dull task a quarter. Pick the lookup or report you do most often and script it, then share it with the shift. Four small tools in a year show the automation skill that 91% of engineering postings ask for.

Volunteer for incidents. When something serious happens, ask to take notes, collect evidence or build the timeline. Incident work teaches containment, forensics and communication under pressure, and it puts you in front of the people who decide promotions.

Write well, every shift. Your case notes are read by people who will later decide whether you are ready for more responsibility. Clear, sourced, concise notes are the cheapest reputation you will ever build.

At the end of the year, update your résumé with the numbers (alerts handled per shift, rules tuned, detections written, scripts adopted by the team) and decide which of the paths in section 10 you are aiming at. Then ask your manager what tier 2 or an engineering seat would require, in writing.

12. SOC analyst questions, answered

How long is the road to a first SOC analyst job?

It depends on where you start. The board's security operations guide estimates 6 to 18 months to a first SOC seat, with people already in IT support or network operations at the short end, because they only need to add the logging foundations, one query language, an entry certification and two or three written investigations. Coming from outside tech, expect to spend a year or more in an IT role first. Only 10 of the 262 postings read on 11 November 2026 were written for interns or first-rung juniors.

Can you become a SOC analyst with no experience?

Yes, but rarely with none of any kind. MDR providers and large SOCs hire beginners for tier 1 because they need people on every shift; Expel's associate analyst posting preferred one to two years of IT or security work but invited applicants with "a compelling story" instead. Interns, co-op students and veterans also have dedicated doors. Everyone else does best by building a lab, writing up investigations and starting in IT support or a NOC.

What does a tier 1 SOC analyst do?

A tier 1 analyst watches the alert queue, works out which alerts are real, enriches them with context from other logs, closes the benign ones with a written reason and escalates the rest with an investigation package. In many SOCs tier 1 also handles phishing reports from employees and takes the first containment steps a playbook allows.

What is the difference between tier 1, tier 2 and tier 3 SOC analysts?

Tier 1 triages and escalates, tier 2 investigates escalations end to end and contains incidents, and tier 3 handles the hardest intrusions, hunts for undetected attackers, analyzes malware and forensic evidence, writes detections and mentors the others. In the postings read for this guide, tier 1 and tier 2 seats asked for a median of two years' experience, untitled seats three and senior or tier 3 seats five.

How much does a SOC analyst make?

In the US, analyst-titled postings read on 11 November 2026 had a median range midpoint of $116,250, with first-rung seats starting around $70,000 to $90,000 and the best-paid analyst titles reaching ranges of $145,000 to $200,000. Engineering titles in the same field had a median midpoint of $197,744. The US government's median for information security analysts as a whole was $129,180 in May 2025.

Do SOC analysts work nights and weekends?

Many do, especially early on. Half the postings in the sample mentioned 24x7 coverage, shifts, on-call or after-hours work, and 79% of SOCs in the SANS 2025 survey operated around the clock. Some teams cover nights with rotating shifts, others with dedicated weekend teams or an on-call pager, and some in-house teams work business hours and hand nights to a provider.

Will AI replace SOC analysts?

It is taking over part of what tier 1 used to do, not the need for people who can judge evidence. In the sample, 19% of postings described AI or agents doing part of triage or investigation, and those postings still hired people to verify the machine's conclusions, handle the cases it cannot and build or tune the agents themselves.

What is the best certification for a SOC analyst?

For a first job, CompTIA Security+, the single exam analyst-titled postings named most often (16 of 57). Once in the job, the GCIH, the most-named certification across all SOC postings in the sample, or CySA+. The CISSP belongs later: it requires five years of experience and was named mostly in incident response consultant and management postings.

Do SOC analysts need to code?

Analysts need scripting rather than software engineering: enough Python or PowerShell to automate lookups and parse logs, plus fluency in a query language such as KQL or SPL. Python appeared in 44% of analyst-titled postings and 79% of engineering ones, so coding ability is one of the clearest differences between the two pay levels.

Can a SOC analyst work remotely?

Often, though analyst seats are listed as remote less often than incident response ones: a third of analyst-titled postings in the sample were remote, against 59% of incident response postings, and 73% of organizations in the SANS 2025 survey allowed remote work at least some of the time. Beginners usually have better odds with a local hybrid or on-site seat.

This guide reflects open postings read on 11 November 2026 and the sources linked in each section. Certification exams, tools and hiring patterns change often, so check the current version of anything you plan to buy or sit.