SOC Career Path & Job Roles

Americas SOC (Reston, VA):
  └─ Hours: 6 AM - 6 PM ET
  └─ Tier 1: 8 AM - 8 PM (overlap morning/evening)
  └─ Tier 2: 7 AM - 7 PM (overlap with APAC handover)

EMEA SOC (London/Dublin):
  └─ Hours: 6 AM - 6 PM GMT
  └─ Tier 1: 8 AM - 8 PM (overlap morning/evening)
  └─ Tier 2: 7 AM - 7 PM (overlap with Americas handover)

APAC SOC (Singapore/Sydney):
  └─ Hours: 6 AM - 6 PM SGT/AEST
  └─ Tier 1: 8 AM - 8 PM
  └─ Tier 2: 7 AM - 7 PM

Overlap windows:
  └─ Americas → EMEA: 12 PM - 2 PM ET (17:00 - 19:00 GMT)
  └─ EMEA → APAC: 9 AM - 11 AM GMT (17:00 - 19:00 SGT)
  └─ APAC → Americas: 7 AM - 9 AM SGT (19:00 - 21:00 ET previous day)

07:45 — Arrive, check overnight alerts in queue
08:00 — Shift handover from night team (written + verbal)
08:15 — Review new threat intel bulletin from CTI team
08:30 — Begin triage: acknowledge alerts in SIEM queue (typically 30-80 pending)
09:15 — Investigate phishing alert: user@company.com received suspicious email
         → Check URL in sandbox → Confirm malicious → Escalate to L2
09:45 — Investigate brute force alert: 20 failed logins from known scanner IP
         → Check IP reputation → Confirm false positive → Close and tune
10:30 — Break
10:45 — Investigate malware alert: Windows Defender detected Trojan on SALES-03
         → Check process lineage in EDR → Check hash on VirusTotal (8/65 detections)
         → Confirm true positive → Isolate host → Escalate to L2
11:30 — False positive review: tune SIEM rule for backup server noise
12:00 — Lunch
13:00 — Monitoring rotation: watch key dashboards (30 min shifts)
14:00 — Training time (vendor certification study, lab exercises)
15:00 — Continue triage queue
16:30 — Write shift handover document
17:00 — Shift handover to evening team

Technical Skills:
  └─ SIEM: Navigate dashboards, search logs, acknowledge/close alerts
  └─ EDR: Basic console navigation, host isolation, file quarantine
  └─ Email Security: Trace email, check headers, submit to sandbox
  └─ Ticketing: Ticket creation, documentation, SLA tracking
  └─ Threat Intel: Basic IoC lookup (VirusTotal, AbuseIPDB, URLScan)
  └─ Networking: TCP/IP, DNS, HTTP/HTTPS, common ports

Analytical Skills:
  └─ Alert classification: True Positive, False Positive, Benign, Suspicious
  └─ Triage decision-making: When to escalate, when to close
  └─ Pattern recognition: Identifying related events across sources

Soft Skills:
  └─ Written communication: Clear, concise ticket notes
  └─ Process discipline: Following playbooks precisely
  └─ Time management: Prioritizing critical vs. low-severity alerts
  └─ Team coordination: Effective shift handover

Technical Skills:
  └─ Forensics: Disk imaging (dd, FTK Imager), memory acquisition (Volatility), PCAP analysis (Wireshark)
  └─ Malware Analysis: Static analysis (PE Studio, Detect It Easy), sandbox execution (ANY.RUN, Joe Sandbox)
  └─ EDR: Advanced investigation, custom queries, response actions (kill process, delete file, registry edit)
  └─ SIEM: Advanced search (SPL, KQL, ESQL), correlation rule creation
  └─ Cloud Forensics: AWS CloudTrail, Azure Activity Log, GCP Audit Log investigation
  └─ Network Forensics: PCAP analysis, NetFlow analysis, proxy log investigation
  └─ Email Security: Header analysis, DKIM/SPF/DMARC verification, email trace

Analytical Skills:
  └─ Incident scoping: Determining full blast radius of an incident
  └─ Root cause analysis: Identifying how the incident started
  └─ Timeline reconstruction: Building a complete incident timeline
  └─ Threat actor profiling: Identifying TTPs, tools, infrastructure

Leadership Skills:
  └─ Incident coordination: Leading response efforts for medium-severity incidents
  └─ Mentorship: Training L1 analysts on investigation techniques
  └─ Communication: Briefing CISO and stakeholders on incident status

Technical Skills:
  └─ Reverse Engineering: IDA Pro/Ghidra, x64dbg, unpacking, decompilation
  └─ Memory Forensics: Volatility 3, Rekall, kernel object analysis
  └─ Detection Engineering: Sigma rules, YARA rules, correlation logic
  └─ Threat Hunting: Hypothesis-driven hunting, baseline analysis, IOC-less hunting
  └─ Automation: Python, PowerShell, API integration, SOAR playbook development
  └─ Advanced Forensics: Registry analysis, USN Journal, MFT, Prefetch, ShimCache, AmCache
  └─ Cloud Forensics: Kubernetes, container forensics, serverless function analysis

Analytical Skills:
  └─ Advanced threat analysis: APT tracking, nation-state attribution
  └─ Campaign analysis: Connecting related incidents across time and geography
  └─ Predictive analysis: Anticipating attacker next steps based on TTPs

Strategic Skills:
  └─ Detection strategy: Designing multi-layered detection coverage
  └─ Tool evaluation: Assessing and recommending new security tools
  └─ Process design: Building new SOC processes and workflows
  └─ Purple team: Collaborating with red team to validate detections

SOC Analyst L1 (0-2 years):
  └─ Months 0-6: Onboarding, training, supervised triage
  └─ Months 6-12: Independent triage, mastering SIEM/EDR
  └─ Months 12-18: Mentoring new L1s, taking on complex triage
  └─ Months 18-24: Ready for L2 promotion (if skills/certs obtained)

SOC Analyst L2 (2-5 years):
  └─ Years 2-3: Deepening investigation skills, earning GCIH/GCFA
  └─ Years 3-4: Taking incident lead role, mentoring L1s
  └─ Years 4-5: Specialization (forensics, malware, cloud)
  └─ Year 5: Ready for L3 or lateral move

SOC Analyst L3 (5+ years):
  └─ Years 5-7: Establishing hunting program, advanced analysis
  └─ Years 7-10: Detection engineering lead, threat intelligence integration
  └─ Year 10+: SOC Manager, Security Architect, DFIR Consultant, CISO

Alternative Exit Points:
  └─ L2 → Pentesting/Red Team (OSCP, GPEN)
  └─ L2 → Security Engineering (SIEM, EDR engineering roles)
  └─ L3 → DFIR Consulting (higher pay, varied work)
  └─ L3 → Security Architecture (design over operations)
  └─ Any → Vendor/Sales Engineering (better hours, similar pay)