Security operations center

A security operations center (SOC) is the function that watches over an organization's security day to day. It can be a dedicated room with screens, a fully remote team or an outsourced service, but the job is the same: collect signals from across the environment, decide which ones matter, and act on them before an attacker reaches their goal.

Most SOCs are organized in tiers. Tier 1 analysts triage incoming alerts and close the obvious false positives. Tier 2 investigates the alerts that look real and leads containment. Tier 3 handles complex incidents, hunts for threats that did not trigger an alert and improves detections. Around them sit detection engineers, threat intelligence analysts and the incident response team.

Example

An alert reports a sign-in from an unusual country. A Tier 1 analyst checks the user's recent activity in the SIEM, sees a successful sign-in followed by a new inbox rule and escalates. A Tier 2 analyst confirms the compromise, revokes the sessions, resets the password and documents the incident.

Why it matters for a SOC analyst

Knowing how your SOC is structured tells you what is expected of you: which alerts you can close on your own, when to escalate, and who owns each step of the response. Good SOCs measure themselves with metrics such as mean time to detect and mean time to respond, and the fastest way to improve both is to write clear notes on every alert you touch.