SOC Analyst

SOC Analysts triage security alerts, hunt threats, and respond to incidents. The role is the most common entry point into hands-on cyber and the foundation for detection engineering, incident response, and threat intelligence specialisations. ## Career milestones ### Year 0 (entry) — Tier 1 SOC Analyst _Salary: £26k–£34k_ Monitor SIEM, triage low-severity alerts against playbooks, escalate to Tier 2. ### Year 1–2 — Tier 2 SOC Analyst _Salary: £35k–£50k_ Investigate complex incidents, write detection rules (KQL, Sigma, Splunk SPL), own threat hunts. ### Year 2–4 — Tier 3 / Detection Engineer _Salary: £55k–£80k_ Build detection content, tune SIEM, run purple-team exercises, mentor Tier 1/2. ### Year 4+ — SOC Lead / Incident Response Manager _Salary: £80k–£110k_ Own the SOC operating model, vendor relationships, SOC shift rotation, IR runbooks. ## Core skills - SIEM (Splunk, Sentinel, Elastic, QRadar) - EDR (CrowdStrike, Defender XDR, SentinelOne) - KQL / Splunk SPL / Sigma rule authoring - MITRE ATT&CK fluency - Windows + Linux event log analysis - Network forensics (Wireshark, Zeek) - Python or PowerShell scripting - Incident response lifecycle (NIST 800-61r2) ## Recommended certifications - `security-plus` - `azure-security` - `aws-security` ## First 90 days in the role Master your SIEM and EDR consoles. Read every closed incident from the last 6 months — that is your fastest path to recognising what 'normal' looks like. Build a personal 'detection ideas' notebook from the day you start. ## Common pitfalls Staying stuck in Tier 1 for >18 months. The escape velocity is detection authoring — pick a MITRE technique per week, build a Sigma rule, and propose it to your SOC lead. By month 6 you should have 10 rules in production with your name on them.