What Does a SOC Analyst Actually Do

A SOC analyst works an alert queue. Alerts arrive from the SIEM, the analyst decides within minutes whether each one is a real incident, a false positive or something that needs escalating, then documents the decision. At L1 that is most of the job. At L2 you investigate what L1 escalates. At L3 you lead incidents and write the detections that generate the alerts in the first place.

Job descriptions for this role are written by marketing. This is what the work actually looks like.

A shift, start to finish

You log in, read the handover notes from the previous shift, and open the queue. There are anywhere from a dozen to several hundred alerts waiting depending on how well tuned the environment is.

You work them in priority order. For each one the question is the same: is this real, and does it matter. You check the source, the user, the host, what happened before and after, and whether the pattern matches something known.

Most of them are nothing. A backup job that looks like data exfiltration. A sysadmin running a tool that looks like an attacker running a tool. A user who travelled and triggered an impossible-travel rule. You close them with a note explaining why.

A few are not nothing. Those you escalate, with enough written context that the L2 analyst does not have to start from zero.

The tiers, honestly

The honest version: L1 is designed to be repetitive. The tier exists so that L2 does not drown. Treating it as a two-year training investment rather than a destination is the pattern that works. Pay by tier is in SOC analyst salary in India.

The tools you touch daily

• SIEM. Splunk, QRadar, Sentinel or Wazuh depending on the shop. You live in the search bar.
• EDR. Endpoint telemetry, process trees, isolation.
• Ticketing. Every decision gets written down. This is more of the job than people expect.
• Threat intelligence. Reputation lookups on hashes, domains and addresses.
• Sandbox. Detonating a suspicious attachment and reading what it did.

The parts nobody advertises

Shift work

A SOC runs around the clock. At L1 and often L2 in India that means rotating shifts including nights and weekends. This is the main reason people leave the tier, more than the pay. It is also finite: L3, detection engineering and specialist roles are usually business hours.

False positives are the job

New analysts think the job is catching attackers. In practice ninety something out of every hundred alerts are benign, and the skill being built is fast, accurate, well documented dismissal. Getting bored by that is the most common reason people wash out.

Writing matters more than you expect

A triage note that the next analyst can follow is worth more than a clever finding nobody can reconstruct. The same is true on the offensive side, see how to write a VAPT report.

What separates the analysts who get promoted

1. They automate their own queue. A script that enriches an alert before a human reads it removes minutes from every ticket. This is the clearest route from L1 to L2. See Python for cyber security.
2. They learn the offensive side. You cannot detect what you do not understand. Analysts who can explain the attack they are hunting for get moved to detection engineering.
3. They write detections, not just close alerts. Moving from consuming alerts to producing them is the single biggest compensation jump in blue team work.
4. They tune. An analyst who reduces the false positive rate on a noisy rule makes every colleague faster.

Is it a good first security job

Yes, and it is usually the easiest door into the industry in India. There are more SOC openings than offensive security openings, the L1 hiring bar is lower, and the progression ladder is clearer. The trade-offs are lower starting pay and the shift rotation.

If you are still choosing a direction, read red team vs blue team and the full sequence in the cyber security roadmap for India.

How to prepare for the L1 interview

Build a SIEM home lab, generate real attack telemetry against it, and write detections for what you generated. That one project answers most L1 interview questions before they are asked, because it proves you have seen a log that mattered.