SOC roles

An effective SOC requires appropriate personnel roles to ensure proper operation and maintenance. The following roles are crucial for a fully functional SOC. Remember that each organization may have unique naming conventions based on its culture:

• SOC analysts:
  • Tier 1: These are more junior information security analysts with a few years of experience in the field. They have a basic understanding of networking, systems, and applications. Their responsibilities include the following:
    • Monitor information security tools
    • Conduct basic investigations and mitigations
    • Open tickets
  • Tier 2: Analysts with a deeper understanding of SOC tools, networking, systems, and applications. Their responsibilities include the following:
    • Employ deeper investigative techniques
    • Implement threat mitigation
    • Recommend changes to information systems
  • Tier 3: Highly skilled analysts with expertise in forensics, malware analysis, threat intelligence, and more. Their responsibilities include the following:
    • Conduct...