Skip to main content
TechWaymark

Classroom mode. Nothing is saved to this machine and no personal detail is asked for.

Leave classroom mode
A security analyst works through an alert queue across three monitors
Cybersecurity Used in TechWaymark Education

SOC Analyst

The first person to look at an alert and decide whether it's noise, a mistake or the start of something real.

Could I move into this role? See a day in the role

Role at a glance

The shape of the job

Typical UK pay£32–40k entry · £52–65k senior
ExperienceEntry to early career
Work patternOn site or hybrid, often shift based
Technical depthNarrow at first, deepens fast
People contactModerate, mostly internal
HoursShifts and rotas are common

Pay bands are TechWaymark practitioner estimates for UK roles, reviewed 2026-09, not survey data. They vary by region, sector and employer.

What the SOC Analyst role involves

  • You work an alert queue. Each alert is a question: did something bad happen, or did a rule fire on normal behaviour?
  • You pull logs from sign-ins, endpoints, email and network tools, then put events in order until the story holds together.
  • You close most alerts as benign, and you write down why, because someone will ask later.
  • When it's real, you escalate with evidence: what happened, when, to which accounts or machines, and what you've already checked.
Read TechWaymark's full role verdict and reasoning
TechWaymark verdict

Security monitoring work that rewards careful investigation and defensible escalation.

Domain
Cybersecurity
Entry
£32–40k
Senior
£52–65k
Pick this if
  • You want supervised experience investigating security signals
  • Shift work doesn't break you (and you've actually checked, not just assumed)
  • You want to explore detection engineering, incident response or threat hunting
  • You can write a clear ticket under time pressure, that's half the job
Skip this if
  • You picture yourself doing offensive work and just see SOC as a step, the gap is wider than you think
  • The specific role's shift pattern would not work for you
  • The advertised balance of routine triage and investigation does not suit you

What "doing well" looks like in the seat

  • You spot the false positives that everyone else tickets and closes blindly
  • You start writing detections, not just consuming them
  • Your tickets read like an analyst wrote them, not a script
  • You volunteer for purple-team exercises and IR shadowing when they come up
The bit you're probably underestimating

Alert volume, shift arrangements and escalation support shape this job. Ask how analysts gain feedback and whether they can improve detections alongside triage.

An analyst writes investigation notes beside a timeline of events
Most of the job is building a timeline and writing down why you believe it.

Illustrative

A day in the role

  1. Read the night shift's handover and pick up two open investigations
  2. A burst of failed sign-ins followed by a success. Check location, device and what the account did next
  3. Phishing report from finance. Pull the email, check who else received it and who clicked
  4. Close a batch of alerts caused by a new backup job, and flag the rule for tuning
  5. Malware alert on a laptop. Isolate it with the endpoint tool and escalate to incident response
  6. Write up the phishing case so the IT team can block the sender and reset two passwords
  7. Hand over open cases with timelines, not just ticket numbers

An example day. Roles and organisations vary, and no two days match.

Day to day

What you'll work with

Systems

SIEM (e.g. Microsoft Sentinel, Splunk)Endpoint detection (e.g. Defender for Endpoint)Email security gatewayIdentity logs (Entra ID, Active Directory)

Tools

Ticketing and case managementThreat intelligence lookupsSandbox for suspicious filesQuery languages (KQL, SPL)

Concepts

MITRE ATT&CKTrue vs false positiveIncident severityChain of evidence

Hiring reality

What employers actually expect

Must understand

  • Read logs patiently and spot what doesn't fit
  • Write a clear case note someone else can act on
  • Know the difference between suspicious and proven
  • Escalate early when impact could be high

Commonly expected

  • Networking basics (IP, ports, DNS, HTTP)
  • Windows and identity fundamentals
  • Hands-on time in a SIEM, even a lab one
  • A cert such as Security+, SC-200 or BTL1

Sets you apart

  • A detection rule you wrote and tested
  • Writing up a lab investigation end to end
  • Scripting to speed up a lookup (Python or PowerShell)
  • Prior IT support experience

What this role isn't

It isn't hacking, and it isn't the film version with red screens. It's investigation and judgement under a queue that never empties. Most alerts are nothing, and saying so with confidence is a skill.

How the role changes with seniority

1Junior

Triages alerts against playbooks, closes the clear ones, escalates the rest with notes.

2Experienced

Runs investigations end to end, tunes noisy rules, coaches newer analysts on shift.

3Senior / lead

Owns detection quality, leads incidents, and argues for the logging the team is missing.

Two analysts talk through an open incident at shift change
Shift handover is where half-finished investigations get lost or saved.

Nobody puts this in the advert

The hard parts

Alert fatigue

Hundreds of alerts, nearly all benign. Staying sharp on the one that isn't is the real test.

Shift work

Nights and weekends are common in 24/7 teams. It suits some lives and wrecks others.

The entry-level myth

It's sold as a way into security from nothing. Most hiring managers want IT basics first.

Limited control

You spot the problem but can rarely fix it. You depend on other teams acting on your notes.

More than one way in

How people actually get into it

From IT support

The most common route. Support teaches the systems SOC analysts spend all day reading about.

Apprenticeship

Cyber security apprenticeships often place people in SOC teams from day one.

Graduate scheme

Larger firms and managed security providers run analyst intakes.

Self-taught with a lab

A home SIEM, written-up investigations and a foundation cert. Harder, but it happens.

Evidence employers value

"Passionate about cyber"

A written investigation from a lab: the alert, the queries you ran, what you ruled out and your conclusion

"Knows Splunk"

Three saved searches you built, what each one catches and one false positive you had to handle

"Completed TryHackMe paths"

One room written up as if it were a real case note for a manager

Projects that prove it

Small pieces of work you can do on your own, and what each one shows an employer.

Build a home detection lab

2 weekends

Send logs from a Windows virtual machine into a free SIEM tier. Generate some failed sign-ins and a suspicious process, then find them with your own queries.

What it demonstrates

Log collectionQuery writingKnowing what normal looks like

Write up one investigation properly

2-3 evenings

Take a public sample incident or a lab scenario. Produce a one-page case note: timeline, evidence, conclusion, and what you'd ask the IT team to do next.

What it demonstrates

Timeline buildingClear escalation writingSeparating fact from assumption

Tune a noisy rule

1-2 evenings

Create a detection that fires too often in your lab. Work out why, change it to cut the noise, and record what you might now miss as a result.

What it demonstrates

Detection logicFalse-positive reasoningDocumenting tradeoffs

Your next hops

Where SOC Analyst can take you

SOC AnalystIncident ResponderSOC Lead

Other common branches

Detection EngineerThreat HunterCloud Security Engineer

There is no single ladder. See the routes on the Atlas.

See the pathway to Detection Engineer

Worth the effort?

Certifications that complement it

ISC2 SSCP

Relevant to the route into this role.

See certification verdict Security+

The usual first security cert. Often listed on analyst adverts as a baseline, and it covers the vocabulary you'll hear on shift.

See certification verdict CySA+

A step up from Security+ with more analysis. Useful once you've done some time on a queue.

See certification verdict Splunk Core Certified User

Relevant to the route into this role.

See certification verdict GIAC GSEC

Relevant to the route into this role.

See certification verdict CompTIA PenTest+

Relevant to the route into this role.

See certification verdict CEH

Relevant to the route into this role.

See certification verdict Microsoft SC-200

Directly maps to Microsoft Sentinel and Defender, which many UK SOCs run. Practical rather than theoretical.

See certification verdict

Interview reality

Questions you may be asked

Loading questions…

Practise with model answers in My Waymark

For educators

Used in TechWaymark Education

These modules use this page as investigation material in the classroom.

  • 1
    Technology is not one career

    An example of work that mainly protects systems, and how it differs from the film version

Where this fits

Roles connect to pathways, certs and other roles. Use one to test the next.

Roles to consider

Further reading

Could you realistically get here from where you are?

The Guided Route compares your background with this role and shows the honest route, hop by hop.

Try the free Guided Route About the Career Verdict

Last reviewed 2026-09. Photographs are illustrative.