Junior SOC Analyst
Tier-1 alert triage. Close the false positives, escalate the rest, learn the playbooks.
A supervised entry option. Compare the investigation responsibilities, mentoring and escalation support.
Read the full role verdict and reasoning
A supervised SOC role develops alert investigation and escalation judgement.
- Domain
- Cybersecurity
- Entry
- £32–40k
- Senior
- £52–65k
- You want into security and don't have an internal mover's advantage
- You've actually checked you can handle shifts, not just assumed
- You want to explore detection, incident response or threat hunting
- You can write a clean ticket under pressure
- You haven't done any structured study, the bar is real even for tier 1
- You can't bear repetitive triage even in moderation
- You picture yourself in offensive work, this isn't the right on-ramp
What "doing well" looks like in the seat
- Your closed tickets stay closed
- You start spotting the false positives others miss
- You're volunteering for purple-team exercises and IR shadowing
- You're studying detection logic, not just consuming alerts
A junior analyst needs usable runbooks and accessible escalation. Check how feedback is provided and whether uncertainty can be raised without pressure to guess.
Tradeoffs at a glance
Open a tradeoff for its meaning. Ratings are directional, not absolute.
Promotion ceiling
Progression depends on the responsibilities demonstrated and opportunities available; there is no fixed promotion timetable.
Who actually gets in
- +Help desk
- +Desktop support
- +Self-taught (TryHackMe SOC path)
Common misconceptions
- −That junior SOC means doing exciting investigations. It means triaging Defender alerts on a shift rota.
Where this leads
- SOC Analyst
- Detection Engineering
- DFIR
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
Pathways that pass through here
What this is based on
Practitioner assessment checked against published external evidence.
Last reviewed: September 2026 · UK market · Confidence: indicative