A Security Operations Center (SOC) analyst is the person watching the alerts, deciding what's real, and kicking off the response when something is. If detection engineers build the tripwires, SOC analysts are the ones who answer when they trip.
What the job actually involves
- Triage - working a queue of alerts and deciding, fast, which are true positives worth escalating.
- Investigation - pulling logs, process trees, network and identity data to reconstruct what happened.
- Response - containing incidents (isolate a host, revoke a session) and handing off to IR for the big ones.
- Tuning - feeding false positives back so the same noise doesn't page you tomorrow.
Tiers
- Tier 1 - fast triage and enrichment; escalate the real ones.
- Tier 2 - deeper investigation, scoping, and containment.
- Tier 3 / hunter - proactive hunting and detection engineering.
The skills that matter
Reading logs (Windows events, auth, proxy, cloud), understanding attacker TTPs (MITRE ATT&CK), a scripting language (Python/PowerShell), and calm decision-making under pressure. You don't need to be a hacker - you need to know normal well enough to spot the deviation.
How to break in
Build reps. Work realistic alerts and incidents end to end, learn to write a clear investigation note, and get comfortable making the malicious-vs-benign call quickly. That reflex is the whole job.