SOC Analyst (Security Operations Centre)

Overview

SOC (Security Operations Centre) Analysts are the first responders in enterprise cybersecurity — monitoring security alerts, detecting threats in real time, conducting incident triage and initial response. SOC analysts operate in tiered models (L1 first-line monitoring, L2 deeper investigation, L3 advanced threat hunting). Indian Managed Security Service Providers (Wipro CRS, TCS CISO Services, Infosys Cyber Defense, HCLTech Cybersecurity, Tech Mahindra Security) plus enterprise SOCs at banks (HDFC, ICICI, SBI), telcos (Reliance Jio, Airtel), and GCCs operate 24/7 SOCs employing thousands of analysts. The role is the highest-volume entry point into cybersecurity careers.

Day-to-day responsibilities

Monitor SIEM (Security Information and Event Management) consoles — Splunk, Sentinel, QRadar, ArcSight — for security alerts; triage alerts to determine real threats vs false positives; investigate incidents using EDR (endpoint detection and response) tools — CrowdStrike, SentinelOne, Defender; correlate events across log sources (firewall, IDS/IPS, AV, proxy, AD); document and escalate confirmed incidents to L2/L3 or incident response team; maintain runbooks for known attack patterns; participate in threat intelligence feeds; conduct shift handover documentation.

Skills required

• SIEM tools (Splunk, Microsoft Sentinel, QRadar, ArcSight, ELK)
• EDR tools (CrowdStrike, SentinelOne, Microsoft Defender)
• Network protocols and packet analysis (Wireshark, tcpdump)
• Windows / Linux / Active Directory event interpretation
• MITRE ATT&CK framework
• Incident response procedures
• Scripting (PowerShell, Python, Bash) for automation
• Threat intelligence consumption (MISP, ThreatConnect, Recorded Future)

Education path

Career progression

1. 1
   SOC Analyst L1 (0-2 yrs)
2. 2
   SOC Analyst L2 (2-4 yrs)
3. 3
   Senior SOC Analyst / L3 / Threat Hunter (4-8 yrs)
4. 4
   SOC Lead / Incident Response Manager (8-12 yrs)
5. 5
   SOC Director / CISO track (12+ yrs)

Top employers in India

Useful certifications

• CompTIA Security+
• CEH (Certified Ethical Hacker)
• GIAC GCIH (Certified Incident Handler)
• CompTIA CySA+
• Splunk Certified Power User / Admin
• Microsoft SC-200 Security Operations Analyst
• IBM QRadar Certifications

Adjacent careers

Courses that lead to this career