Security Operations Centre (SOC) Analyst

Role Purpose & Context

Role Summary

The SOC Analyst is responsible for independently investigating security alerts and handling common incident types from start to finish. You'll be the first line of defence, really, diving deep into the noise to find the actual threats. This role sits right at the core of our security operations, making sure we react quickly and effectively when something goes wrong. You'll work closely with the wider IT and infrastructure teams, translating technical findings into clear actions they can take. When you do this well, we catch attacks early, minimise damage, and keep our customers' data safe. If things go sideways, well, that can mean significant disruption, data loss, or even regulatory fines – so the stakes are pretty high. The challenge here is cutting through the sheer volume of alerts and false positives to find the real threats, all while staying calm and methodical. The reward? Honestly, it's knowing you've protected the company, learned something new about how attackers operate, and kept us all a bit safer.

Reporting Structure

• Reports to: Senior SOC Analyst or Lead SOC Analyst
• Direct reports: 0
• Matrix relationships: Cyber Security Analyst, Incident Response Analyst, Detection & Response Analyst,

Key Stakeholders

Internal:

• IT Operations Team
• Network Engineering Team
• Application Development Teams
• Data Privacy & Compliance
• Legal Department

External:

• Managed Security Service Providers (MSSPs)
• Threat Intelligence Vendors
• Industry peers (for information sharing)
• Law enforcement (in incident scenarios)

Organisational Impact

Scope: This role directly impacts our ability to detect, respond to, and recover from cyber security incidents. A sharp SOC Analyst prevents minor issues from becoming major breaches, protecting our reputation, financial stability, and customer trust. You're essentially the eyes and ears of our digital perimeter, and your quick actions can save us millions.

Performance Metrics

Quantitative Metrics

1. Metric: Mean Time to Acknowledge (MTTA)
2. Desc: How quickly you pick up and start working on a critical alert after it's generated.
3. Target: < 15 minutes for critical alerts; < 30 minutes for high severity
4. Freq: Daily/Weekly
5. Example: If a P1 alert drops at 10:00, you should be 'eyes on glass' and acknowledging it in the SIEM by 10:14 at the latest. We track this automatically, so no fudging the numbers!
6. Metric: Alert Fidelity & Accuracy
7. Desc: The percentage of alerts you close as 'true false positives' that are actually benign, versus those that should have been escalated or investigated further.
8. Target: >98% accuracy rate on closing true false positives
9. Freq: Monthly
10. Example: Out of 100 alerts you closed as false positives last month, only 2 were later found to have been actual, albeit minor, security events. That's a 98% accuracy rate, which is what we're after.
11. Metric: Tickets Closed per Shift
12. Desc: The number of security incidents or alerts you investigate and resolve within a typical shift, compared to the team average.
13. Target: Consistently meet or exceed team average (e.g., 15-20 alerts/shift)
14. Freq: Weekly
15. Example: If the team average for a shift is 18 alerts, you're expected to close around that many. We know some incidents take longer, but for routine stuff, we need you to keep the queue moving.
16. Metric: Mean Time to Contain (MTTC) for Common Incidents
17. Desc: How quickly you can contain a common threat (like a detected malware infection or a phishing attempt) once identified.
18. Target: < 2 hours for known malware; < 1 hour for phishing emails
19. Freq: Per incident / Monthly average
20. Example: You identify a host infected with a known piece of malware. From that moment, you're expected to have the host isolated or the threat neutralised within two hours. This is crucial for stopping spread.

Qualitative Metrics

1. Metric: Incident Investigation Quality
2. Desc: The thoroughness and accuracy of your incident reports and investigation notes. Do they tell a clear story? Are all relevant details captured?
3. Evidence: Your incident reports are clear, concise, and include all necessary details (IOCs, timestamps, actions taken, affected systems). Senior analysts rarely need to ask for more information. You've followed the IR playbook, no steps skipped. Your notes are so good, someone else could pick up the investigation and know exactly where you left off.
4. Metric: Collaboration & Communication
5. Desc: How effectively you work with other teams (IT, Network, Dev) during an incident, and how clearly you communicate technical details to non-technical folks.
6. Evidence: IT Ops praises your clear instructions during host isolation. You're able to explain a complex attack chain to a manager without using jargon. You proactively share relevant findings with the team during shift handovers. You're not just 'throwing it over the wall' to another team; you're working with them to get it sorted.
7. Metric: Proactive Identification & Tuning Input
8. Desc: Your ability to spot patterns in alerts, suggest improvements to detection rules, or identify potential false positives that need tuning.
9. Evidence: You flag a recurring benign alert pattern, suggesting a specific filter to reduce noise. You notice a new type of attack activity that isn't currently detected and raise it with the Senior Analyst. You're not just closing tickets; you're thinking about how to prevent them in the first place.
10. Metric: Documentation & Knowledge Sharing
11. Desc: How well you contribute to and maintain our internal knowledge base and playbooks.
12. Evidence: You update a playbook after a tricky incident with new steps or lessons learned. You create a clear 'how-to' guide for a common investigation task. Other analysts refer to your documentation. Honestly, the easier you make it for the next person, the better.

Primary Traits

• Trait: Analytical Scepticism
• Manifestation: You're the person who refuses to take an alert at face value. You'll always ask, 'How could this be faked?' or 'What's another explanation for this?' Before escalating, you'll cross-reference a single alert against three other data sources. You treat every alert as potentially malicious until you've proven it benign, beyond a shadow of a doubt.
• Benefit: This trait is absolutely crucial. It stops us from dismissing a subtle, sophisticated attack – like a slow, stealthy command-and-control beacon – as just another 'false positive'. Missing that subtle clue is often the very first link in a major breach chain, and we can't afford to be complacent.
• Trait: Calm Under Pressure
• Manifestation: When a critical incident hits and everyone else is flapping, you're the one who stays methodical. On the incident bridge call, you speak clearly and concisely, no panic. You follow the incident response playbook step-by-step, no skipping ahead. You can filter out the noise of executives asking for constant updates and just focus on containing the threat.
• Benefit: Panic leads to critical errors, simple as that. Shutting down the wrong system, wiping logs before evidence is collected – these are real risks. A calm analyst contains the threat faster, preserves vital forensic evidence, and ultimately saves the company from a much bigger headache. It's not about being emotionless, it's about disciplined action.
• Trait: Insatiable Curiosity
• Manifestation: You've got a deep-seated need to understand how things work, and frankly, how they can be broken. You probably spend your own time reading The DFIR Report or Krebs on Security. You might even have a home lab where you test new exploits or reverse-engineer malware samples. You'll ask 'why' five times to get to the true root cause of an incident, not just the surface-level trigger.
• Benefit: Threats evolve every single day. An analyst without curiosity only knows how to detect yesterday's attacks. A truly curious analyst has the foundational knowledge and drive to identify novel techniques they've never seen before, making them incredibly valuable when something truly new comes along.

Supporting Traits

• Trait: Meticulous
• Desc: You forget nothing, and you document everything. Every single step of an investigation, every piece of evidence, every decision – it all needs to be logged. This isn't just for compliance; it's so we can reconstruct the timeline and learn from it later.
• Trait: Collaborative
• Desc: You get that the SOC is a team sport. You'll work seamlessly with network engineers, system administrators, and application development teams. You understand that getting the job done often means working across different departments, not just within your own team.
• Trait: Resilient
• Desc: You can handle the psychological toll of 'alert fatigue' – that feeling of being overwhelmed by thousands of low-fidelity alerts. You can also cope with the stress of high-stakes incidents without burning out. It's a demanding job, and resilience is key to sticking with it.

Primary Motivators

1. Motivator: Problem Solving & Investigation
2. Daily: You love the challenge of a good puzzle. Every alert is a mystery waiting to be solved, and you get a real kick out of piecing together the clues to understand an attack.
3. Motivator: Learning & Skill Development
4. Daily: The cyber security landscape changes constantly, and you're excited by that. You're always keen to learn about new threats, tools, and techniques, and you see every incident as a learning opportunity.
5. Motivator: Making a Real Impact
6. Daily: You want to feel like your work genuinely matters and that you're protecting something important. You understand the direct link between your actions and the company's security posture.

Potential Demotivators

Honestly, this job isn't for everyone, and we want to be upfront about the downsides. If you're someone who needs everything to be perfectly organised, or you get easily frustrated by repetition and bureaucracy, you might struggle here.

Common Frustrations

1. The 'Alert Tsunami': You'll often feel like you're drowning in a sea of low-fidelity alerts from poorly configured tools. It's a nightmare trying to spot the one that actually matters amongst thousands of false positives.
2. Tool Sprawl & 'Swivel-Chair' Analysis: You'll frequently find yourself manually copying and pasting an IP address or a hash between seven different browser tabs – your SIEM, EDR, TIP, VirusTotal, and so on – just to investigate one alert. Nothing's perfectly integrated, and it can be a real pain.
3. The Politics of Escalation: There's a dread that comes with having to wake up a Director at 3 AM for a potential incident, especially knowing you'll face their wrath if it turns out to be a false alarm. It's a delicate balance.
4. The Out-of-Date CMDB: You'll get a critical alert on 'PROD-SVR-012' and have zero context on what the server does, who owns it, or if the observed activity is business-as-usual. It makes investigations so much harder.
5. Shift Work Burnout: The relentless cycle of day, swing, and night shifts can really wreak havoc on your health, social life, and ability to ever feel truly rested. It's a tough part of the job for many.
6. 'We Told You So': It's immensely frustrating to watch the company get breached via a vulnerability your team flagged in a report six months ago, only for it to have been marked as 'Risk Accepted' by a business unit that didn't understand the real risk.

What Role Doesn't Offer

1. A predictable 9-to-5 schedule every day (incidents don't care about your plans).
2. An environment where every single alert is a genuine, high-priority threat (most are noise).
3. The ability to completely ignore documentation or process (it's essential, even if tedious).
4. A role where you only ever work on cutting-edge, novel attacks (you'll deal with a lot of mundane stuff too).

ADHD Positives

1. The fast-paced, constantly changing nature of incident response can be highly engaging, offering novelty and high-stakes problem-solving that can suit an ADHD brain.
2. Hyperfocus can be a superpower during a critical incident, allowing deep dives into complex data sets to quickly uncover crucial details.

ADHD Challenges and Accommodations

1. Maintaining focus during routine alert triage or extensive documentation can be challenging. We can offer tools for structured note-taking and break up monotonous tasks.
2. Managing multiple, simultaneous investigations requires strong organisational skills. We use clear ticketing systems and offer visual task management tools.
3. Shift work can disrupt routines, which can be difficult. We aim for consistent shift patterns where possible and support flexible scheduling where team coverage allows.

Dyslexia Positives

1. Strong visual-spatial reasoning, often associated with dyslexia, can be excellent for spotting patterns in logs or network traffic that others might miss.
2. Thinking 'outside the box' to connect disparate pieces of information during an investigation can be a significant advantage.

Dyslexia Challenges and Accommodations

1. Reading dense logs or writing detailed incident reports can be time-consuming. We encourage the use of screen readers, dictation software, and structured templates.
2. Ensuring accuracy in written communication is key. We promote peer review for critical reports and offer grammar/spell-checking tools.
3. Our SIEM and other tools are highly visual, which can be helpful. We also use colour-coding and clear formatting in our documentation.

Autism Positives

1. A strong preference for logical, systematic work fits perfectly with methodical incident response playbooks and forensic analysis.
2. Exceptional attention to detail can be invaluable for spotting subtle anomalies in data that indicate malicious activity.
3. The ability to maintain calm and focus during high-stress situations, like a major incident, can be a huge asset.

Autism Challenges and Accommodations

1. Unpredictable social interactions during incidents or cross-team collaboration can be a challenge. We encourage clear, direct communication and offer options for text-based communication (e.g., Slack, Teams) over calls.
2. Sensory overload from a busy SOC environment (multiple screens, chatter) can be an issue. We can provide noise-cancelling headphones and offer quieter workspaces for focused tasks.
3. Changes in routine or unexpected tasks can be difficult. We strive for clear communication about changes and provide as much notice as possible.

Key Responsibilities

Experience Levels Responsibilities

1. Level: SOC Analyst (Mid-Level)
2. Responsibilities: Independently investigate and resolve Tier 2 security alerts, taking ownership from initial detection right through to closure. This means you'll be the one digging into the details, not just passing it on.
3. Perform initial containment actions for identified threats, like isolating compromised hosts or blocking malicious IPs at the firewall. Getting this right, and quickly, is absolutely critical.
4. Conduct basic threat hunting exercises using established methodologies. Don't just wait for alerts; go looking for the bad stuff based on threat intelligence or a hunch.
5. Enrich alerts and incidents with relevant context from various sources – think threat intelligence platforms, asset management systems, and user directories. The more context, the better the decision.
6. Document all investigation steps, findings, and actions taken in our incident management system. Yes, it's tedious sometimes, but future-you (and the auditors) will be grateful.
7. Contribute to the continuous improvement of our detection rules and playbooks. If you spot a way to make things better or reduce false positives, speak up and help us refine it.
8. Provide informal guidance and support to junior SOC Analysts, helping them get unstuck on trickier alerts or understand a new investigation technique. You'll be a sounding board for them.
9. Supervision: You'll have weekly check-ins with your Senior or Lead SOC Analyst to discuss ongoing investigations, tricky cases, and development goals. For routine tasks, you're expected to work independently, but for anything novel or high-impact, you should definitely be escalating or consulting.
10. Decision: You have the authority to make routine decisions within established guidelines and playbooks. For example, you can decide to isolate a host if it meets specific criteria in the playbook. Any decisions outside of these guidelines, or those with significant business impact (e.g., shutting down a critical application), must be escalated to a Senior Analyst or Manager for approval. You'll consult with your Lead on complex investigation paths or when you're unsure of the best next step.
11. Success: You're successful when you consistently resolve common incidents efficiently and accurately, contribute to reducing false positives, and your investigation notes are clear and complete. If you're seen as a reliable pair of hands who can be trusted to get to the bottom of things, you're doing well.

Decision-Making Authority

• Type: Alert Triage & Initial Investigation
• Entry: Follows pre-defined playbooks; escalates anything outside of known patterns to a Mid-Level Analyst.
• Mid: Independently triages and investigates most common alerts (e.g., malware, phishing, suspicious logins). Decides on initial containment actions (e.g., host isolation) based on playbook criteria. Escalates novel or high-severity incidents to a Senior Analyst.
• Senior: Acts as the final escalation point for complex alerts. Decides on investigation strategy for major incidents. Approves or adjusts containment actions proposed by junior team members.
• Type: Incident Containment Actions
• Entry: Executes containment steps (e.g., host isolation) only under direct supervision or explicit instruction from a more senior analyst.
• Mid: Independently initiates containment actions for known, common threats (e.g., isolating a malware-infected workstation) as per established playbooks. Consults with Senior Analyst before taking actions that could impact critical business systems.
• Senior: Authorises and oversees containment actions for all incidents, including those affecting critical infrastructure. Makes real-time decisions on containment strategy during active incidents.
• Type: Detection Rule Tuning & Improvement
• Entry: Identifies potential false positives and reports them to a Mid-Level or Senior Analyst for review.
• Mid: Proposes specific tuning adjustments for existing detection rules to reduce false positives or improve fidelity. Works with Senior Analysts to implement approved changes.
• Senior: Designs, tests, and deploys new detection rules and tunes existing ones to optimise SOC effectiveness. Reviews and approves tuning suggestions from junior team members.
• Type: Communication during Incidents
• Entry: Provides updates to immediate supervisor. Communicates with affected users only with pre-approved templates.
• Mid: Communicates investigation status and findings to affected internal teams (e.g., IT Ops, Network). Drafts initial incident summaries for review by Senior Analyst or Manager. Can explain technical details to non-technical audiences.
• Senior: Leads incident bridge calls. Communicates directly with business stakeholders and executives during major incidents. Coordinates communication across multiple teams.

Competency Requirements

Foundation Skills (Transferable)

These are the core human skills that underpin everything you do. Without these, even the best technical knowledge won't get you far in a SOC. We're looking for clear thinkers and good communicators, especially when things get hairy.

• Category: Communication & Collaboration
• Skills: Clear and concise written communication for incident reports and documentation.
• Verbal communication to explain technical issues to non-technical colleagues.
• Active listening during incident calls to gather critical information.
• Teamwork: working effectively with peers, senior analysts, and other IT teams.
• Category: Problem Solving & Critical Thinking
• Skills: Analytical thinking to connect disparate pieces of information during an investigation.
• Root cause analysis: digging beyond the surface to find the actual source of a problem.
• Decision-making under pressure, especially during live incidents.
• Structured troubleshooting to systematically eliminate possibilities.
• Category: Adaptability & Resilience
• Skills: Ability to adapt to rapidly changing threat landscapes and new attack techniques.
• Managing 'alert fatigue' and staying focused amidst a high volume of alerts.
• Coping with the stress and intensity of high-stakes security incidents.
• Learning agility: quickly picking up new tools, concepts, and methodologies.
• Category: Professionalism & Ethics
• Skills: Maintaining confidentiality of sensitive information and incident details.
• Adhering to strict chain of custody for forensic evidence.
• Integrity and honesty in all investigations and reporting.
• Commitment to continuous professional development.

Functional Skills (Role-Specific Technical)

These are the specific technical skills and knowledge you'll need day-to-day. We're talking about understanding how attackers operate, how to use our tools, and how to make sense of all the data thrown at you.

Technical Competencies

• Skill: MITRE ATT&CK Framework
• Desc: You don't just know it exists; you actively map observed adversary activity to specific Tactics, Techniques, and Procedures (TTPs). For example, you'd say, 'This looks like T1059.001, PowerShell execution,' to understand the attacker's intent and predict their next moves.
• Level: Intermediate
• Skill: Incident Response Lifecycle (PICERL)
• Desc: You can methodically move through Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned for common incident types. You ensure no steps are skipped under pressure, leading to thorough and effective incident handling.
• Level: Intermediate
• Skill: Threat Hunting Methodologies
• Desc: You can shift from a reactive 'wait for alert' posture to a proactive, hypothesis-driven approach for basic hunting. For instance, you might think, 'I believe threat actors could be using WMI for persistence. I will now hunt for anomalous WMI consumer registrations.'
• Level: Basic
• Skill: Log Analysis & Correlation
• Desc: This is the core skill of weaving a story from disparate data sources. You can connect a firewall deny, a proxy block, an EDR process alert, and a failed login from Active Directory to identify a single, coordinated attack.
• Level: Intermediate
• Skill: Network Traffic Analysis (NTA)
• Desc: You can differentiate between normal and malicious traffic at a basic protocol level. You're able to spot things like unusual DNS queries, C2 beaconing with odd patterns, or initial signs of data exfiltration.
• Level: Intermediate
• Skill: Digital Forensics Fundamentals
• Desc: You understand the basics of evidence preservation (like chain of custody), memory analysis (using tools like Volatility), and disk imaging. This ensures your investigations are sound and evidence isn't accidentally destroyed during containment.
• Level: Basic

Digital Tools

• Tool: Splunk Enterprise Security / Microsoft Sentinel / IBM QRadar (SIEM)
• Level: Intermediate
• Usage: You'll be running pre-defined queries, triaging alerts from dashboards, and adding detailed comments to notable events. You'll follow documented procedures for initial investigation and know how to find what you need in the logs.
• Tool: CrowdStrike Falcon / SentinelOne / VMware Carbon Black (EDR/XDR)
• Level: Intermediate
• Usage: You'll triage endpoint alerts, isolate a host from the network when needed, and pull process trees and command-line history for initial review. You're comfortable navigating the EDR console to understand endpoint activity.
• Tool: Palo Alto Cortex XSOAR / Splunk SOAR (Phantom) / Tines (SOAR)
• Level: Basic
• Usage: You'll be executing pre-built playbooks for common alerts, such as phishing email analysis or initial malware containment. You understand the basic logic of these playbooks and can identify when a playbook fails or needs manual intervention.
• Tool: Recorded Future / Anomali ThreatStream / Mandiant Advantage (TIP)
• Level: Basic
• Usage: You'll use the Threat Intelligence Platform to enrich Indicators of Compromise (IOCs) – like IPs, domains, or hashes – from alerts. You can look up threat actor profiles related to an active investigation to get more context.
• Tool: Wireshark / Zeek (formerly Bro) / Corelight (Network Analysis)
• Level: Intermediate
• Usage: You can apply basic filters in Wireshark to narrow down traffic, follow a TCP stream to reconstruct a web session or file transfer, and identify common protocols. You're comfortable looking at network data to spot anomalies.

Industry Knowledge

• Area: Common Attack Vectors & TTPs
• Desc: You understand how phishing, malware, ransomware, credential stuffing, and common web application attacks typically work. You know the usual TTPs associated with these threats.
• Area: Operating System Fundamentals (Windows/Linux)
• Desc: You have a solid grasp of how Windows and Linux operating systems function, including common directories, logging mechanisms, and command-line tools. This is crucial for endpoint investigations.
• Area: Networking Basics (TCP/IP, DNS, HTTP/S)
• Desc: You understand core networking concepts and protocols. You know how DNS works, what HTTP/S traffic looks like, and how IP addresses and ports connect systems. Essential for network analysis.

Regulatory Compliance Regulations

• Reg: General Data Protection Regulation (GDPR)
• Usage: You understand the basic principles of GDPR, especially around data breach notification requirements and the importance of protecting personal data during investigations. You know when an incident might trigger a GDPR reporting obligation and who to escalate to.
• Reg: Payment Card Industry Data Security Standard (PCI DSS)
• Usage: If our organisation handles payment card data, you'll understand the core requirements of PCI DSS related to security monitoring and incident response. You'll know that any incident involving cardholder data is a high-priority event.

Essential Prerequisites

• At least 2-5 years of hands-on experience in a Security Operations Centre or a similar incident response role.
• Proven ability to independently investigate and resolve common security incidents (e.g., malware, phishing, suspicious logins).
• Demonstrable experience with at least one major SIEM platform (Splunk, Sentinel, QRadar) for alert triage and log analysis.
• Experience with an Endpoint Detection and Response (EDR) tool (CrowdStrike, SentinelOne, Carbon Black) for host investigation and containment.
• A solid understanding of networking fundamentals (TCP/IP, DNS, HTTP/S) and common operating systems (Windows, Linux).
• Strong written and verbal communication skills; you need to be able to explain complex technical issues clearly.

Career Pathway Context

Think of these as the foundational building blocks. If you've been working in a junior SOC role, or perhaps in IT support with a strong security focus, you should have picked up most of these. We're looking for someone who can hit the ground running on common incident types, not someone who needs to be taught the basics from scratch.

Qualifications & Credentials

Emerging Foundation Skills

• Skill: Prompt Engineering & LLM Integration for Security
• Why: Large Language Models (LLMs) are already changing how we work, and security is no exception. Competitors are using tools like GPT to draft incident summaries or analyse threat intelligence in minutes, not hours. Analysts who figure this out will significantly outproduce their peers.
• Concepts: [{'concept_name': 'Context windows and token limits', 'description': 'Understanding how much information an LLM can process at once and how to manage it effectively for security data.'}, {'concept_name': 'Temperature settings for different tasks', 'description': 'Knowing when to ask for creative summaries versus precise, factual extractions from logs.'}, {'concept_name': 'RAG (Retrieval-Augmented Generation) architectures', 'description': 'Learning how to integrate LLMs with our proprietary security data (e.g., internal incident reports, specific log formats) to get accurate, context-aware responses.'}, {'concept_name': 'Output validation and hallucination detection', 'description': "Crucially, knowing how to verify that an AI's output is correct and not just making things up – this is paramount in security."}, {'concept_name': 'Prompt chaining for complex analysis', 'description': 'Breaking down a complex security investigation into smaller, sequential prompts to get the AI to perform multi-step analysis.'}]
• Prepare: This week: Start using Claude, ChatGPT, or similar tools to draft email summaries of alerts or brainstorm investigation steps.
• This month: Experiment with using an LLM to summarise a threat intelligence report or extract IOCs from a public write-up.
• Month 2: Explore how to feed anonymised log snippets into an LLM to ask 'what happened here?' and compare its analysis to your own.
• Month 3: Work with a Senior Analyst to prototype an AI-assisted incident report drafting process for common incident types.
• QuickWin: Start using AI to draft your shift handover notes or summarise complex security articles today. No approval needed, immediate benefit to your productivity and understanding.
• Skill: Cloud Security Posture Management (CSPM) & Cloud Native Security
• Why: More and more of our infrastructure is moving to the cloud (AWS, Azure, GCP). Attackers are following, and traditional on-prem security tools often don't cut it. You'll need to understand cloud-specific threats and how to monitor them.
• Concepts: [{'concept_name': 'Cloud Identity and Access Management (IAM)', 'description': 'Understanding how permissions work in AWS IAM, Azure AD, etc., and how they can be abused.'}, {'concept_name': 'Cloud Logging & Monitoring (CloudTrail, Azure Monitor)', 'description': 'Knowing where to find security logs in cloud environments and how to interpret them.'}, {'concept_name': 'Serverless & Container Security', 'description': 'Understanding the security implications of technologies like Lambda functions, Docker, and Kubernetes.'}, {'concept_name': 'Cloud misconfigurations as attack vectors', 'description': 'Recognising common cloud misconfigurations (e.g., open S3 buckets, exposed RDP ports) that attackers exploit.'}, {'concept_name': 'Cloud-native security tools', 'description': 'Familiarity with tools like AWS Security Hub, Azure Security Centre, or third-party CSPM solutions.'}]
• Prepare: This week: Read up on common cloud security threats and the OWASP Top 10 for cloud.
• This month: Get a free tier account on AWS or Azure and explore their security services (e.g., CloudTrail, Security Hub).
• Month 2: Complete an online course on cloud security fundamentals (e.g., AWS Certified Security - Specialty, Azure Security Engineer Associate).
• Month 3: Start to analyse cloud logs in our SIEM, identifying patterns specific to our cloud environment.
• QuickWin: Familiarise yourself with our current cloud providers (AWS/Azure/GCP) and their basic logging capabilities. You can start by looking at existing cloud alerts in our SIEM.

Advancing Technical Skills

• Skill: Advanced SIEM Querying & Rule Development
• Why: As threats become more sophisticated, so must our detection capabilities. Moving beyond basic searches to writing complex correlation rules and custom parsers will be essential to catch subtle attacks that bypass standard detections.
• Concepts: [{'concept_name': 'Advanced Splunk SPL (Search Processing Language)', 'description': 'Mastering complex commands, subsearches, and lookups to extract precise information from vast datasets.'}, {'concept_name': 'Custom log parsing and normalisation', 'description': 'Understanding how to ingest new log sources and ensure their data is correctly formatted for effective analysis.'}, {'concept_name': 'Behavioural analytics rule creation', 'description': 'Developing rules that detect deviations from normal user or system behaviour, rather than just known signatures.'}, {'concept_name': 'Optimising query performance', 'description': "Writing efficient queries that don't overload the SIEM or take too long to run, which is crucial for real-time detection."}]
• Prepare: This week: Review existing complex correlation rules in our SIEM and try to understand their logic.
• This month: Take an advanced SIEM training course (e.g., Splunk Power User or Architect track).
• Month 2: Propose and develop one new, high-fidelity detection rule based on a recent threat intelligence report.
• Month 3: Work with a Senior Analyst to onboard a new log source, including parsing and normalisation.
• QuickWin: Challenge yourself to rewrite a simple SIEM query using more advanced functions to see if you can make it more efficient or effective.
• Skill: Scripting for Automation (Python/PowerShell)
• Why: Manual 'swivel-chair' analysis is inefficient and prone to error. Automating repetitive tasks, enriching data, and orchestrating response actions with scripting will become a core expectation for improving SOC efficiency.
• Concepts: [{'concept_name': 'API interaction for security tools', 'description': 'Learning how to programmatically interact with our SIEM, EDR, SOAR, and TIP platforms to pull data or trigger actions.'}, {'concept_name': 'Basic data manipulation (JSON/CSV)', 'description': 'Processing and transforming data formats commonly used in security tools.'}, {'concept_name': 'Error handling and logging in scripts', 'description': 'Writing robust scripts that can gracefully handle failures and log their activity for auditing.'}, {'concept_name': 'Orchestration logic for playbooks', 'description': 'Understanding how to sequence automated tasks to build effective incident response playbooks.'}]
• Prepare: This week: Start with a basic Python or PowerShell tutorial focused on scripting for IT/security tasks.
• This month: Write a simple script to automatically pull IOCs from a public source and check them against our internal logs.
• Month 2: Automate a repetitive enrichment task, like querying VirusTotal for a hash from an alert.
• Month 3: Work with a Senior Analyst to contribute a module to an existing SOAR playbook using Python or PowerShell.
• QuickWin: Write a small script to automate a task you do manually more than once a day – even if it's just formatting an email or extracting specific data from a text file.

Education Requirements

• Level: Minimum
• Req: A degree-level qualification (e.g., Bachelor's degree) in Cyber Security, Computer Science, or a related technical field.
• Alts: We're open to candidates with equivalent practical experience. If you've got a strong portfolio of relevant work, or a couple of years in a junior SOC role with demonstrable skills, that counts too. We care more about what you can do than the piece of paper.

Experience Requirements

You'll need at least 2-5 years of hands-on experience in a Security Operations Centre (SOC) or a similar incident response role. This isn't an entry-level position; we need someone who's already comfortable with the basics and can hit the ground running on common incident types. We're looking for practical experience in alert triage, incident investigation, and initial containment actions.

Preferred Certifications

• Cert: CompTIA Security+
• Prod: CompTIA
• Usage: Demonstrates foundational knowledge of core security concepts, network security, and risk management. A great starting point.
• Cert: CompTIA CySA+
• Prod: CompTIA
• Usage: Focuses on the analytical skills needed for a SOC Analyst, including threat detection, vulnerability management, and incident response. Directly relevant to the role.
• Cert: GIAC GCIH (GIAC Certified Incident Handler)
• Prod: SANS Institute
• Usage: A gold-standard certification for incident handling and response. It shows a deep understanding of the incident response lifecycle and practical skills in containing and eradicating threats. If you have this, you're definitely ahead of the game.
• Cert: Certified Ethical Hacker (CEH)
• Prod: EC-Council
• Usage: While not directly an IR cert, understanding attacker methodologies is crucial for detection. This shows you can think like a hacker, which helps in anticipating threats.

Recommended Activities

• Regularly participate in industry webinars and conferences (e.g., Black Hat, DEF CON, local BSides events).
• Contribute to open-source security projects or build your own home lab to experiment with tools and techniques.
• Follow leading security blogs and researchers (e.g., Krebs on Security, The DFIR Report, SANS Internet Storm Centre).
• Engage in online security challenges or CTFs (Capture The Flag) to sharpen your practical skills.
• Mentor junior colleagues or participate in internal knowledge-sharing sessions.

Career Progression Pathways

Entry Paths to This Role

• Path: Junior SOC Analyst / Associate SOC Analyst
• Time: 1-2 years
• Path: IT Support / Helpdesk with Security Focus
• Time: 2-3 years
• Path: Network Administrator / System Administrator
• Time: 2-4 years

Career Progression From This Role

• Pathway: Senior SOC Analyst
• Time: 2-4 years from this role
• Pathway: Threat Hunter / Detection Engineer
• Time: 3-5 years from this role

Long Term Vision Potential Roles

• Title: SOC Manager
• Time: 5-8 years
• Title: Principal Incident Responder
• Time: 8-12 years
• Title: Security Architect (Detection & Response)
• Time: 8-12 years

How Zavmo Delivers This Role's Development

DISCOVER Phase: Skills Gap Analysis

Zavmo maps your current competencies against all requirements in this job description through conversational assessment. We evaluate your foundation skills (communication, strategic thinking), functional skills (CRM expertise, negotiation), and readiness for career progression.

Output: Personalised skills gap heat map showing strengths and priorities, estimated time to competency, neurodiversity accommodations.

DISCUSS Phase: Personalised Learning Pathway

Based on your DISCOVER results, Zavmo creates a personalised learning plan prioritised by impact: foundation skills first, then functional skills. We adapt to your learning style, pace, and neurodiversity needs (ADHD, dyslexia, autism).

Output: Week-by-week schedule, each module linked to specific job responsibilities, checkpoints and milestones.

DELIVER Phase: Conversational Learning

Learn through conversation, not boring modules. Zavmo uses 10 conversation types (Socratic dialogue, role-play, coaching, case studies) to build competence. Practice difficult QBR presentations, negotiate tough renewals, and handle churn conversations in a safe AI environment before facing real clients.

Example: "For 'Stakeholder Mapping', Zavmo will guide you through analysing a complex enterprise account, identifying key decision-makers, and building an engagement strategy."

DEMONSTRATE Phase: Competency Assessment

Zavmo automatically builds your evidence portfolio as you learn. Every conversation, practice scenario, and application example is captured and mapped to NOS performance criteria. When ready, your portfolio supports OFQUAL qualification claims and demonstrates competence to employers.

Output: Competency matrix, evidence portfolio (downloadable), qualification readiness, career progression score.