Become a SOC Analyst - Level 2

As a SOC analyst, your primary duty is to ensure that the organization’s digital assets are secure and protected from unauthorized access. You protect both the online and on-premise infrastructures, monitor metrics and data to identify suspicious activity, and identify and mitigate risks before adversaries breach your system. Some adversaries will still breach your system, and a SOC analyst fights the frontline battle.

Broadly, a Level 1 Analyst conducts initial triage of alerts to identify potential, false positives, policy violations, intrusion attempts and compromises. A Level 2 Analyst is expected to validate those findings, provide the context necessary to escalate triaged alerts for deeper analysts and review, and possibly initiate Tier-III or Incident Response work.

As a more experienced analyst, you will be expected to have hands-on experience with packet capture technology, IDS and SIEM technologies, and network and endpoint security tools. You should also have excellent analytical and problem solving skills, strong communication skills, self-discipline to work according to playbook and time requirements, passion for cybersecurity and a willingness to learn and stay up-to-date with current threats, tools and techniques, as well as new security technologies, products and incident analysis and response approaches.

No two days are alike in a security operations center – adversaries don’t follow a specific schedule, and how much time you have to spend on an individual incident can depend on many factors. You may be able to circumvent an attack quickly in some cases, while others might take much more time, attention, and work. On a daily basis, you will need to ascertain the weaknesses of hardware, software, and network infrastructure and establish ways to protect it. But the nature of information security means each day may bring different situations, tasks, and challenges, so you’ll rarely feel bored. When a threat or an attack arises, your team will likely work nonstop to expose the attack, shut down access to your systems, resolve the issue, work to prevent the same type of attack from happening in the future, and document and communicate appropriate information to management or clients.

Most organizations look for someone with 3-4 years of hands-on experience in Information Security, as well as experience as an entry-level SOC Analyst. IT or Offensive Security Certifications are seen as added benefits. For professionals with less than 3 years of experience, we recommend the SOC Analyst 1 career path.