A day in the life of a SOC analyst

A security operations center (SOC) analyst is an integral part of a SOC team, which is responsible for keeping an enterprise safe from cybercrime. The SOC analyst is a security professional who handles the good, bad, and the ugly of detecting and managing cyberthreats.

SOC teams are kept on their toes by the large volume of security events that need to be investigated every single day. These team members play a vital role in preventing attacks and bolstering the company's defenses. So, what exactly does a SOC analyst's day look like?

The duties of a SOC analyst

Let's take a closer look at the major duties of a SOC analyst.

• Manage alert notifications

  SOC analysts typically face an onslaught of security alerts every day. This can be security information and event management (SIEM) tools flagging alerts due to anomalies, correlation rules, or just regular alert configurations. The SOC analyst looks into each incident and ascertains the cause. The analyst is required to constantly differentiate between genuine threats and false alarms. There's always the risk of missing an important incident among the multitude of false alarms.

• Prevent a security attack

  Upon detecting anomalous activity, the SOC analyst investigates it immediately and prevents the threat from wreaking havoc on the network. This can involve detecting advanced persistent threats (APT) or hidden malware on the network and weeding them out before they cause damage.

  For this, the analyst should be skilled enough to discern the activities that might be worth investigating from among the thousands of notifications that they receive. If they decide to pursue the incident, they should be able to find the relevant logs to help them construct a timeline of the events that led to the incident. This requires the analyst to be familiar with network topology and have sufficient experience handling security threats.

• Incident response

  SOC analysts need to be able to get the company back up on its feet quickly after a cyberattack. This might mean minimizing the extent of the attack by restricting its activity on the network. This also involves making decisions to limit the cost and recovery time of the attack.

• Threat hunting

  SOC analysts need to proactively hunt for threats on the network. Threat hunting is conducted based on the information from threat intelligence feeds, a constantly updated data source that integrates information on the various threat vectors, infected websites, recent cyberattacks, and so on.

Depending on their experience level, a SOC analyst may be doing different things. These seniority levels are referred to as tiers, and there are specific duties associated with each tier.

• Tier 1:

  This is the most junior position on the team. This person would be responsible for monitoring the network using SIEM tools and responding to alerts about security incidents. They also need to conduct triage and ascertain the seriousness of the alerts. They should also perform periodic vulnerability scans on the network and generate assessment reports.

• Tier 2:

  This person is responsible for performing deeper analysis into security incidents. They coordinate with the threat intelligence team to understand the nature and extent of the attack. They also have to come up with ways to mitigate or remedy the attack

• Tier 3:

  This level requires an experienced person who uses penetration testing tools to understand the vulnerabilities on the network. They are also responsible for performing advanced threat hunting to detect potential threats hiding on the network.

The SOC analyst works tirelessly on the front lines of the battle against enterprise cybercrime. Though constant vigilance is part of the profile, safeguarding enterprises from cyberattacks can be a rewarding job. During a time of increased cyberattacks, security experts can make or break an enterprise!

Job description of a SOC analyst

Below you'll see the job description of a typical SOC analyst.

Experience:

• Experience working in a network security role.
• Experience in using SIEM tools and knowledge of endpoint detection and response (EDR).
• An in-depth understanding of the cyberthreat landscape, the vulnerabilities, and the risks.
• Experience using forensic tools.

Duties

• Should be available to work different shifts around the clock.
• Perform threat hunting and malware analysis periodically.
• Educate oneself on existing and emerging cyberattacks.
• Work closely with other departments to mitigate security incidents.