Face the attacker
Security Operations & Incident Response
Work the alert queue, separate real intrusions from noise, and lead the response when one is real.
The job, briefly
A security operations center (SOC) is the team that watches an organization's logs and endpoints for signs of attack and acts on what it finds. Analysts triage alerts from tools such as a SIEM and an EDR agent, decide which are false positives and which point to a real intrusion, and escalate or contain the real ones. Incident responders and DFIR (digital forensics and incident response) specialists take over when something serious has happened: they scope it, collect evidence, push the attacker out and write the account of what occurred.
Day to day
- Triage a queue of alerts in the SIEM and EDR consoles, closing the benign ones with a short reason and escalating the rest
- Pivot from one alert into the surrounding records (sign-ins, process trees, DNS, proxy and mail logs) to see what else the same user or host did
- Contain a confirmed threat: isolate a laptop, disable an account, revoke sessions, block a domain or a file hash
- Tune noisy detections with the engineers who own them so the same false positive stops waking the night shift
- Hunt through historical data for attacker techniques that no alert covers yet, usually mapped to MITRE ATT&CK
- Write incident timelines, shift handovers and post-incident reports that people outside security can follow
Worked examples
Triage an impossible-travel sign-in alert
The SIEM flags a user signing in from Chicago and, eleven minutes later, from a hosting provider's address abroad. In the identity provider's logs you see the second sign-in passed MFA through a push the user approved at 2 a.m. their time, and that the session then created an inbox rule forwarding invoices to an outside address. That combination is account takeover, not a VPN quirk. You revoke the sessions, reset the password and MFA factors with the help desk, delete the rule, search other mailboxes for the same source address and open an incident with your notes attached.
Investigate a suspicious PowerShell alert on a laptop
EDR reports an encoded PowerShell command launched by a Word document. You decode it, see it fetching a second-stage file from a domain registered three days ago, and confirm in the process tree that the file ran. You isolate the host, add the hash and domain to the blocklists, check whether any other machine reached that domain in the past week, and hand the laptop to incident response with a timeline: message received, document opened, script run, connection made.
Write the post-incident report
After a ransomware attempt is stopped on two servers, you draft the report leadership will read. It states when the first malicious activity happened, how the attacker got in (an unpatched VPN appliance), what they touched, how long they went unnoticed, what stopped them and the three changes that would have caught them sooner. Every claim points to a log line or an artifact, and the wording stays plain enough for the finance director.
Who does well here
Security operations suits people who stay calm while something is going wrong and like working out what really happened from incomplete evidence. Many analysts come from help desk, system administration or network operations, where they already learned how computers, accounts and networks behave when nothing is wrong. Veterans of military cyber and signals units come in here too, as do security graduates with real lab experience. Shift work is common at the junior level, and the strongest analysts write as clearly as they investigate.
Signs it suits you
- You enjoy puzzles where the answer comes from evidence rather than a hunch
- You can give the last alert of a long shift the same attention as the first
- You can work a night or weekend rotation for a year or two while you build experience
- You can explain what you found in a few clear sentences, to technical and non-technical readers alike
Requirements
- Working knowledge of networking (TCP/IP, DNS, HTTP, common ports) and of how Windows and Linux run processes, services and accounts
- A baseline certification such as CompTIA Security+, which most junior postings ask for and which US defense roles often require under DoD 8140
- For federal and defense work, often a security clearance: the employer sponsors it, and it requires US citizenship
Useful skills
A route in
- 1If you are not in IT yet, a help desk, desktop support or network operations job is the most dependable first step, because it teaches you how healthy systems behave
- 2Study for Security+, then CySA+ or Security Blue Team's BTL1, to cover the vocabulary employers screen for
- 3Practise on real evidence: the Boss of the SOC datasets, Blue Team Labs Online, LetsDefend and CyberDefenders all give you alerts and logs to work through
- 4Build a small home lab with a free SIEM (Splunk Free, Elastic or Wazuh), send it logs from a couple of virtual machines and write up one or two investigations you ran in it
- 5Apply for SOC analyst, security analyst and MSSP (managed security service provider) roles, which take on the most juniors
- 6After a year or two of triage, pick a direction: incident response, detection engineering, threat hunting or forensics
Myths and reality
Myth: SOC work means staring at a screen waiting for a hacker to appear.
Reality: Most of a shift is reading evidence and deciding: closing a false positive with a reason, asking a user whether they really did something, following one odd sign-in across five systems. Quiet hours go into hunting, tuning and documentation.
Myth: You need a computer science degree to get hired.
Reality: Many analysts have none. Hiring managers test whether you understand networks, operating systems and logs, and IT experience, certifications and written-up lab work can all show that. A degree matters to some employers and to government postings that list one, far less to the work itself.
Myth: Tier 1 is a dead end of repetitive tickets.
Reality: The repetition is how you learn what normal looks like. Analysts who keep good notes, automate the dull steps and ask to shadow incident response usually move up or sideways within a couple of years.
Salary
Salary ranges on open SecOps & IR roles currently center on $145k–$314k/yr. The median sits at $177000, measured over the 130 openings that publish a range.
Questions career changers ask
Can I get a SOC job with no IT experience at all?
It happens, but it is the harder road. A tier 1 hiring manager wants to know you can tell what an ordinary account, process or network connection looks like before you judge whether one is malicious. Without IT experience, close that gap with Security+, steady practice on blue-team labs and two or three written investigations you can walk through in an interview, then apply widely, including to managed security providers and large SOCs, which train juniors more often than small teams do.
What is the difference between a SOC analyst and an incident responder?
The analyst decides whether an alert is real and handles the routine cases. The responder takes the serious ones: a compromised server, ransomware, stolen data. Responders work out how far the attacker got, preserve forensic evidence, coordinate the cleanup and often brief legal counsel and insurers. Most of them spent time as analysts first.
Is the work always on night shifts?
Teams that watch systems around the clock need people on every shift, and newer analysts often take nights and weekends. Many teams rotate, some cover the clock across time zones, and senior and engineering roles are mostly daytime with an on-call week now and then. Asking about the rotation in an interview is normal.
Will automation and AI assistants replace SOC analysts?
They are changing the job more than removing it. SOAR playbooks and AI assistants already close some routine alerts and draft summaries, which leaves analysts more of the judgment calls and the investigations that cross several systems. Analysts who learn to write detections and automate their own repetitive steps stay in demand inside their teams.
Neighboring paths
Threat Intelligence & Security Research
Track the groups behind attacks and turn what you learn into warnings, detections and decisions.
Security Engineering
Design, build and run the security controls and tooling the rest of the company relies on.
Cloud Security
Put guardrails, identity policies and monitoring around workloads on AWS, Azure and Google Cloud.