How to become a
SOC analyst

A security operations centre (SOC) monitors an organisation's environment for threats around the clock. SOC analysts triage alerts from SIEM, EDR, email security, firewalls and cloud tools; investigate by correlating logs, processes, network connections and user activity; decide whether activity is benign, suspicious or malicious; escalate incidents with clear evidence; follow and improve playbooks; and help tune detections so true threats stand out.

MITRE ATT&CK, a public knowledge base of adversary tactics and techniques, gives analysts a common language for describing what attackers do.¹ The threats keep shifting: Verizon's 2026 Data Breach Investigations Report found exploited vulnerabilities and ransomware dominating breaches,² and ISC2's 2024 workforce study found 67% of organisations short of security staff.³ The US BLS projects 21% growth for information security analysts to 2035.⁴ SOC roles are the most common way into security in India; AmbitionBox lists SOC analysts at a typical ₹5.3–5.8 lakh from more than 12,000 salaries.⁵

Typical SOC analyst pay in India (AmbitionBox)

₹5.3–5.8 lakh

SOC analyst salaries reported in India (AmbitionBox)

12,000+

US growth, information security analysts, 2025–35 (BLS)

21%

Organisations short of security staff (ISC2, 2024)

67%

Table: How SOC analyst candidates are assessed (editorial summary)

Table: A clear SOC escalation note (illustrative)

Table: How security operations developed (editorial summary)

• A home lab with a SIEM and log sources
• Three investigation write-ups
• ATT&CK mapping for each
• A detection you wrote or tuned
• A clear escalation note sample
• A verified SOC fundamentals certificate

Show investigations: "Built lab SIEM with Windows, Linux and firewall logs; wrote detections for brute force and suspicious PowerShell; documented three investigations mapped to ATT&CK."

"How do you triage a queue of alerts?"

By severity, asset criticality and confidence; group related alerts; investigate high-risk first.

"What Windows event IDs do you know?"

For example 4624 (successful logon), 4625 (failed logon), 4688 (process creation) — and what they tell you.

"What's a false positive and how do you reduce them?"

An alert on benign activity; tune with context, thresholds and allow-lists carefully, without blinding detection.

"When do you escalate?"

When evidence suggests real compromise or high impact, or when you can't rule it out within the playbook time.

"What's impossible travel?"

Logins from locations too far apart to be reached in the time between them.

• "How many alerts per analyst per shift?" — workload.
• "What's the tiering model?" — growth path.
• "Which SIEM and EDR?" — skills.
• "How are detections tuned?" — maturity.

Table: SOC career pay in India (AmbitionBox, October 2026; indicative)

Table: Common SOC tools (editorial guidance)

• Tier 1 SOC analyst — triage.
• Tier 2 analyst — investigation.
• Tier 3 / threat hunter — complex threats.
• Detection engineer / IR — specialisation.
• SOC manager — operations leadership.

1. Week 1: Logs — Windows and Linux events.
2. Week 2: Lab — Set up a SIEM with log sources.
3. Week 3: Attacks — Simulate attacks and investigate.
4. Week 4: ATT&CK — Map findings; write detections.
5. Week 5: Prove it — Write it up; take the SOC Fundamentals Certification.

Related: Incident Response, Cybersecurity Fundamentals and Linux Fundamentals. Guides: incident response, cybersecurity fundamentals and Linux.

• Queue triage — new alerts each shift.
• Investigation — logs and endpoints.
• Escalation — tickets to tier 2 or IR.
• Handover — shift notes.
• Tuning — feedback on detections.
• Learning — new techniques and tools.

"What's the difference between an IOC and a TTP?"

Indicators of compromise are specific artefacts like IPs or hashes; TTPs describe attacker behaviour, which is harder to change.

"How do you stay alert on night shifts?"

Structured routines, breaks, clear handovers and prioritised queues.

Table: A first-90-days plan (editorial guidance)

Learn the tools and what normal looks like in your environment. Follow playbooks carefully and ask questions. By the third month, take ownership of tuning one noisy detection — it makes life better for the whole team and shows initiative.

AI copilots now summarise alerts, explain log entries, suggest queries and draft escalation notes. Some SOCs use AI to auto-close low-risk alerts and group related ones. That reduces tier 1 drudgery but raises the bar: analysts must judge when AI is wrong, investigate novel attacks and understand fundamentals deeply. ISC2's 2024 study found 45% of security teams had already added generative AI to their tools. In interviews, show you can use AI to work faster while verifying every conclusion against evidence.

Summarise open investigations with status, evidence and next steps; list escalations made and their outcomes; note any noisy detections or tool issues; and flag anything time-sensitive. Keep it in a consistent template so the next shift can pick up in minutes. Clear handovers prevent incidents falling through the cracks between shifts.

"Tier 1 is just clicking through alerts." Good triage requires real judgement and is how analysts grow.

"You need years of experience." Labs, fundamentals and clear communication can get you in.

"AI will replace SOC analysts." It changes the work; humans still decide and investigate.

You can practise real SOC work at home for free. Create a few virtual machines: a Windows workstation, a Windows server if possible and a Linux server. Install endpoint logging such as Sysmon on Windows and forward logs to a free SIEM or log platform. Add a simple firewall or router VM so you can see network logs too.

Then generate activity to investigate. Try failed and successful logins, create new users, run suspicious PowerShell commands from public detection-testing projects designed for labs, and download test files. For each exercise, write down what you did, what the logs showed, which ATT&CK technique it maps to and how you would detect it. Build a few detection rules and check whether they fire. Keep the lab isolated from your home network and never use real malware. Three or four well-documented investigations from your lab will make interviews far easier, because you can talk about evidence you've actually seen rather than definitions you've memorised.

• Closing alerts without evidence.
• Vague escalation notes.
• Weak Windows and Linux log knowledge.
• Ignoring asset context.
• No lab experience.

Attack techniques come from MITRE ATT&CK; India pay from AmbitionBox (read October 2026); US outlook from the Bureau of Labor Statistics (May 2025); threat trends from Verizon's 2026 DBIR; and workforce data from ISC2's 2024 study. The escalation example, handover guidance and history are editorial. Science of Apps publishes the free test linked here. Last reviewed October 2026.

• SOC — security operations centre.
• SIEM — security information and event management.
• EDR — endpoint detection and response.
• False positive — an alert on benign activity.
• TTP — tactics, techniques and procedures.