What a SOC Analyst Actually Does in the First 90 Days

A security operations centre (SOC) analyst monitors an organisation's systems for signs of attack and responds when something looks wrong. Here is a realistic picture of the first few months in a junior role. Every organisation is different, so treat this as typical rather than universal.

Weeks 1 to 4: learning the environment

Expect to spend much of your time learning the organisation's systems, tools and procedures: which alerts matter, what normal looks like, who to escalate to and how incidents are recorded. You will usually shadow experienced analysts before handling alerts yourself.

Weeks 5 to 8: triaging alerts

Most of the job is triage: deciding whether an alert is a false alarm, something to watch, or something to escalate. You will check logs, look up suspicious addresses and files, and follow written procedures (often called playbooks). Accurate notes matter as much as the decision itself.

Weeks 9 to 12: investigating and improving

As you gain confidence, you will investigate alerts more deeply, help during incidents and start suggesting improvements, such as tuning a noisy alert or updating a playbook.

What carries across from other careers

People from healthcare, policing, the armed forces, customer service and operations often do well, because the job rewards calm, procedure-led work under pressure, careful record-keeping and clear communication with people who are not specialists.

How to prepare

Practise reading logs, write up a mock incident investigation from start to finish, and learn the basics of networking and common attack techniques. A clear, well-structured incident write-up is strong evidence for an interview.

Back to all guides