What Is a SOC Analyst? Job Duties, Salary & How to Become One

If you’ve been researching cybersecurity careers, you’ve probably run into the term “SOC analyst” more than once. It’s one of the most common entry-level job titles in the field and also one of the most misunderstood.

Here’s exactly what a SOC analyst does, what the job actually looks like day to day, what it pays in California and nationwide, and the most direct path to getting hired.

What Is a SOC?

SOC stands for Security Operations Center. It’s the team and, often, the physical space within an organization responsible for monitoring, detecting, and responding to cybersecurity threats in real time.

Every organization that takes security seriously operates some version of a SOC. That includes Fortune 500 companies, federal agencies, hospitals, financial institutions, defense contractors, and cloud providers. Many smaller organizations outsource this function to a Managed Security Service Provider (MSSP), which hires its own SOC analysts.

What Does a SOC Analyst Do?

A SOC analyst monitors an organization’s network, systems, and endpoints for signs of malicious activity. The job is fundamentally about three things: detect, analyze, and respond.

Day-to-day responsibilities typically include:

• Monitoring security dashboards and SIEM (Security Information and Event Management) platforms for alerts
• Triaging and investigating security events, separating real incidents from false positives
• Escalating confirmed threats to Tier 2 analysts or incident response teams
• Documenting incidents and contributing to post-incident reports
• Tuning detection rules to reduce alert fatigue
• Running vulnerability scans and reviewing results

Most entry-level SOC analysts begin as Tier 1 analysts, the first responders who handle the initial triage of security events. With additional experience, analysts can advance to Tier 2 roles, where they conduct deeper investigations into threats. Senior analysts may eventually progress to Tier 3 positions, focusing on threat hunting and leading incident response efforts.

SOC Analyst Tiers Explained

Tier	Role	Focus	Experience Level
Tier 1	Alert Triage Analyst	Monitor dashboards, first-pass triage	Entry-level (0–2 years)
Tier 2	Incident Responder	Deep investigation, containment	Mid-level (2–4 years)
Tier 3	Threat Hunter / IR Lead	Proactive hunting, forensics	Senior (4+ years)

SOC Analyst Salary

National average: $65,000–$90,000 for Tier 1

California average: $75,000–$105,000 (San Diego, LA, Bay Area)

Defense contractor SOC (with clearance): $90,000–$130,000+

Salary growth in SOC roles is primarily driven by certifications (CySA+, GCIH, GCIA), SIEM platform experience (Splunk, Microsoft Sentinel, IBM QRadar), and clearance status for those working in defense or government environments.

*Note: All salary data is sourced from salary.com

Tools SOC Analysts Use

Entry-level SOC analysts are expected to be familiar with or quickly trainable on the following platforms:

• SIEM: Splunk, Microsoft Sentinel, IBM QRadar
• Ticketing: ServiceNow, Jira
• EDR: CrowdStrike Falcon, SentinelOne, Microsoft Defender
• Threat intel: VirusTotal, MISP, ThreatConnect
• Network analysis: Wireshark, Zeek
• Frameworks: MITRE ATT&CK, NIST Cybersecurity Framework

You don’t need to be expert-level in all of these before your first job. Most employers expect foundational knowledge plus the ability to learn quickly in a structured environment.

Certifications That Help You Get Hired as a SOC Analyst

These are the certifications most commonly listed in SOC analyst job postings:

For entry-level (Tier 1):

• CompTIA Security+: the most commonly required baseline cert
• CompTIA CySA+: validates analyst-specific skills that are increasingly in demand.

For Tier 2 and beyond:

• CompTIA PenTest+: offensive perspective improves defensive thinking

See our full IT Certification Roadmap to see how these credentials stack in career progression.

How to Become a SOC Analyst: The Most Direct Path

Step 1: Build your foundational knowledge

You need a working understanding of networking (TCP/IP, DNS, HTTP, firewalls), operating systems (Windows and Linux basics), and security concepts (encryption, authentication, access control). CompTIA A+ and Network+ build this foundation.

Step 2: Get Security+

Security+ is the single most requested certification in SOC job postings. It covers threat detection, incident response, cryptography, and network security — all directly applicable to Tier 1 SOC work. See our guide: How Long Does It Take to Get CompTIA Security+?

Step 3: Add CySA+

CySA+ (Cybersecurity Analyst) is the certification most directly aligned with SOC analyst responsibilities. It covers threat intelligence, vulnerability management, incident response, and SIEM usage. Candidates with both Security+ and CySA+ are significantly more competitive for analyst roles than those with Security+ alone.

Step 4: Get hands-on practice

Before your first interview, you want to demonstrate practical experience. Home lab environments (a VM running Kali Linux and a SIEM receiving logs from a practice network) or platforms like TryHackMe and Blue Team Labs Online provide real practice without an employer.

Step 5: Build your resume around incidents, not just tools

Employers want to see that you can think through a security event, not just list software. Frame your lab work as incidents: “Investigated a simulated phishing campaign using Splunk; isolated the affected endpoint and wrote an incident report.”

Is a SOC Analyst Job a Good Starting Point?

Yes, for most people entering cybersecurity, a Tier 1 SOC analyst role is the best available starting point. Here’s why:

• High volume of open positions nationally and in California
• Clear, structured skill progression from Tier 1 → Tier 2 → Tier 3
• Exposure to the full security operations stack in a single role
• Direct pathway into incident response, threat intelligence, and security engineering
• Many roles are available with defense contractors in San Diego, providing clearance opportunities.

The main challenge is alert fatigue; Tier 1 SOC work is high-volume and can feel repetitive. Analysts who advance quickly treat every alert as a learning opportunity rather than a task to close.

SOC Analyst Frequently Asked Questions

CIAT’s cybersecurity programs include Security+ and CySA+ prep with exam vouchers, plus career services support to help you land your first analyst role. Explore Cybersecurity Programs →