SOC Analyst
When to Use
- Triage and investigate SIEM, EDR, email, cloud, and identity alerts
- Execute tier-1/tier-2 playbooks and document findings
- Enrich alerts with threat intel, asset context, and user/account data
- Close benign or true-positive-with-remediation alerts per runbook
- Escalate to CSIRT when incident criteria are met
When NOT to Use
- Declare incidents, lead containment, or draft regulatory comms →
incident-responder
- Design SEV levels, on-call, paging, or postmortem program →
incident-management-engineer
- Plan or execute red team campaigns (operator role) →
red-team-specialist
- Implement SIEM/EDR or IAM controls →
information-security-engineer
- Hypothesis-driven threat hunts and hunt campaigns →
threat-hunter
- Disassembly, decompilation, patch diff, or malware RE lab work →
reverse-engineer
Related skills
| Need |
Skill |
| Escalate declared security incident |
incident-responder |
| Incident program, escalation matrix |
incident-management-engineer |
| Security strategy and IR policy |
cybersecurity |
| Red team / purple team exercise design |
red-team-specialist |
| Tooling implementation (SIEM, EDR, SOAR) |
information-security-engineer |
| Cloud audit and account forensics |
cloud-security-engineer |
| Proactive threat hunts and hunt campaigns |
threat-hunter |
| Detection tuning and DFIR-style investigation |
defensive-security-analyst |
| Disk/memory forensics and chain of custody |
digital-forensics-analyst |
| Binary/protocol RE, patch diff, YARA from samples |
reverse-engineer |
| Vetted IOC/TTP packages and tactical intel for enrichment |
cti-analyst |
Handoff to threat hunting
Escalate to threat-hunter when alerts cluster into a plausible campaign, detections are evasive, leadership requests a proactive hunt, or post-incident pattern expansion is needed. Include UTC window, entities, IOCs, what was ruled out, and linked tickets.
Handoff to CSIRT
Escalate to incident-responder when incident declaration criteria are met (see incident-responder/references/incident_declaration_and_severity.md). Include UTC timestamps, affected entities, IOCs, evidence links, and open questions. Confirmed compromises found during hunts also route through this path.
1---2name: soc-analyst3description: Guides SOC operations—alert triage, SIEM/EDR investigation, enrichment, playbook execution, false-positive closure, escalation decisions, and detection tuning feedback. Use when working SOC queues, investigating suspicious alerts, correlating events, documenting analyst notes, or deciding escalate vs close—not for declared incident command, timelines, evidence preservation, or regulatory comms (incident-responder), incident program design (incident-management-engineer), binary/firmware RE (reverse-engineer), red team operations (red-team-specialist), or enterprise security strategy (cybersecurity).4---56# SOC Analyst78## When to Use910- Triage and investigate SIEM, EDR, email, cloud, and identity alerts11- Execute tier-1/tier-2 playbooks and document findings12- Enrich alerts with threat intel, asset context, and user/account data13- Close benign or true-positive-with-remediation alerts per runbook14- Escalate to CSIRT when incident criteria are met1516## When NOT to Use1718- Declare incidents, lead containment, or draft regulatory comms → `incident-responder`19- Design SEV levels, on-call, paging, or postmortem program → `incident-management-engineer`20- Plan or execute red team campaigns (operator role) → `red-team-specialist`21- Implement SIEM/EDR or IAM controls → `information-security-engineer`22- Hypothesis-driven threat hunts and hunt campaigns → `threat-hunter`23- Disassembly, decompilation, patch diff, or malware RE lab work → `reverse-engineer`2425## Related skills2627| Need | Skill |28|---|---|29| Escalate declared security incident | `incident-responder` |30| Incident program, escalation matrix | `incident-management-engineer` |31| Security strategy and IR policy | `cybersecurity` |32| Red team / purple team exercise design | `red-team-specialist` |33| Tooling implementation (SIEM, EDR, SOAR) | `information-security-engineer` |34| Cloud audit and account forensics | `cloud-security-engineer` |35| Proactive threat hunts and hunt campaigns | `threat-hunter` |36| Detection tuning and DFIR-style investigation | `defensive-security-analyst` |37| Disk/memory forensics and chain of custody | `digital-forensics-analyst` |38| Binary/protocol RE, patch diff, YARA from samples | `reverse-engineer` |39| Vetted IOC/TTP packages and tactical intel for enrichment | `cti-analyst` |4041## Handoff to threat hunting4243Escalate to `threat-hunter` when alerts cluster into a plausible campaign, detections are evasive, leadership requests a proactive hunt, or post-incident pattern expansion is needed. Include UTC window, entities, IOCs, what was ruled out, and linked tickets.4445## Handoff to CSIRT4647Escalate to `incident-responder` when incident declaration criteria are met (see `incident-responder/references/incident_declaration_and_severity.md`). Include UTC timestamps, affected entities, IOCs, evidence links, and open questions. Confirmed compromises found during hunts also route through this path.
daemon-blockint-tech