What is SOC Analyst: Job Description, Skills, and Responsibilities
What is SOC Analyst?
A SOC analyst (security operations center) is an important role in modern security teams. SOC analysts are at the forefront of cyber defense and respond to cyber attacks as soon as they occur. Learn more about the SOC analyst role and its responsibilities.
SOC analyst job description
SOC analysts respond first to any cyber security incident. They are responsible for reporting on cyber threats to the organization and implementing any necessary changes.
SOC analysts have the following job duties:
- Vulnerability analysis and threats
- Investigating, documenting, and reporting on information security (InfoSec), issues, and emerging trends.
- Analyse and mitigation of previously unknown software and hardware vulnerabilities
- Preparing disaster recovery plans.
SOC analysts are the last line of defense. They usually work in a large security team alongside cybersecurity engineers and security managers. SOC analysts usually report to the chief information security officer of the company (CISO).
SOC analysts must be detail-oriented as they have to monitor many aspects at once. They must monitor the network and respond to any threats or events. The size of an organization will determine the level of responsibility.
SOC analyst career path
Security operations centers typically assign analysts to three to four tiers.
- Tier 1 support security analyst — receives and reviews alerts every day. To determine the urgency and relevancy of SIEM alerts review them daily. Triage is performed to determine if a security incident is actually occurring. Assists in the configuration and supervision of security monitoring tools.
- Tier 2 support security analyst — deals with real security incidents. Assesses incidents that have been identified by tier-one analysts. To pinpoint the affected systems and determine the extent of an attack, threat intelligence is used. Analyzes the running processes and configurations of affected systems. Performs in-depth threat intelligence analysis to identify the perpetrator, type of attack, and the affected data or systems. Develops and implement a strategy to contain and recover.
- Tier 3 security analyst — More experienced than a level 2 analyst. Responsible for responding to critical incidents. Performs vulnerability assessments and penetration testing to determine the organization’s resilience and identify areas that require attention. Examines alerts, threat intelligence, and security data. Examines alerts, threat intelligence, and security data.
- Incident response manager — Manages and prioritizes actions during analysis, isolation, and containment. They communicate to external and internal stakeholders any requirements for high-severity incidents.
Originally Published on The Tech Trend
