thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

SOC Analyst Tiers

The tiered structure of SOC roles, typically Tier 1 triage, Tier 2 investigation and Tier 3 hunting and advanced response.

Definition

Tier 1 analysts monitor alerts, perform initial triage and escalate; Tier 2 analysts investigate in depth, scope incidents and coordinate containment; Tier 3 analysts perform threat hunting, malware analysis and detection engineering. SOC managers oversee operations and metrics. Automation increasingly handles Tier 1 tasks.

Example

A Tier 1 analyst escalates a confirmed malicious PowerShell alert to Tier 2 for scoping.

Exam tip

Questions may ask which tier performs proactive hunting - that is Tier 3.

Related terms