Not all SOC analysts are the same— Here’s why:

SOC works in the levels of “tier” when handling cyberattacks. Each tier has a specific level of difficulty, which ranges from basic alerts to advanced. Let’s take a simple example:

Let’s say that your internet stops working and you call the helpline. The first person (Tier 1) asks some basic questions: Are all the cables properly connected? If this doesn’t work, they pass on to the second person (Tier 2), who is more skilled and checks deeper problems, for example, signal problems. Now, if there’s still no fix! Then they must pass on the problem to the senior (Tier 3). The third person fixes the complex problems and finds the real root cause of the issue.

The Security Operations Center (SOC) works the same.

In this blog, we will discuss the three tiers in SOC, i.e., Tier 1, Tier 2, and Tier 3—how do they work, how are they different, and why is each tier important and work differently?

So, let’s dive into the blog!

Tier 1 SOC Analyst

Let’s have a brief overview of all three Tiers of SOC.

Tier 1 SOC analysts are the first line of defense in a SOC. They are just like the security guards who pay attention to the cyber threats or attacks. They are not in charge of fixing complex issues or checking the problem deeply; they just detect and report the problem as soon as possible. Its main job is to find something unusual happening in the organization’s network. Tier 1 analysts must stay alert and detect the issue and report to the team as quickly as possible so that they can take immediate action. Their job is critical, and they must keep an eye on the problem so that they can keep the systems safe.

Key Functions of Tier 1 SOC Analyst

Some day-to-day responsibilities of Tier 1 are:

  • Keep an eye on alerts and events:

They observe and watch the data that comes from the different tools, such as firewalls or SIEM systems. They must keep continuous monitoring of security tools to keep the system safe and clean.

  • Prioritization of security alerts:

This is the prime responsibility of the Tier 1 SOC Analyst. When the Tier 1 finds the information about any threat, it immediately checks if the threat is real or not. They separate minor threats from serious ones.

  • Documentations of incidents:

Documentation plays a crucial role for a Tier 1 SOC analyst, as the analyst must keep the record of the events and write clear reports of what happened, when it happened, and what action must be taken. This detailed information gives a clear report to the higher-tier analyst.

  • Passing serious problems to the higher Tiers:

Now if the threat is somewhat serious and requires more skilled people, they immediately transfer the issue to the Tier 2 analysts for deeper investigation.

Tier 2 SOC Analyst

After having a quick overview of the Tier 1 SOC analyst, now we need to understand the functioning and responsibilities of the Tier 2 SOC analyst.
Tier 2 SOC analysts play a vital role in cybersecurity incident response. They are mainly focused on monitoring and alerting; their main job is to fix the complex issues that are not fixed by the Tier 1 analysts. They must go through detailed investigations to have a clear view of the nature and impact of the threats. Tier 2 requires more technical work, terms, skills, critical thinking, and experience in handling real-life situations.
In simple words, Tier 2 analysts must find out the real problem, fix it, and check whether the threat is real, how it entered the system, what type of harm it’s causing, and how it can be stopped.

Key Functions of Tier 2 SOC Analyst

Some day-to-day responsibilities of Tier 2 are

  • Thorough investigation of alerts:

When a Tier 1 analyst passes on the issue to the Tier 2 analyst, then it’s the job of the Tier 2 analyst to fix it and go through a deep investigation of the problem and find out the root cause by taking help of some of the tools like SIEM, EDR, and threat intelligence platforms.

  • Using complex tools and techniques to fix the issue:

As mentioned above, Tier 2 analysts use some advanced tools to fix the threats. They move past the basics and use the advanced and technical tools to analyze logs, endpoint behavior, and user actions.

  • They identify the threat and understand the main problem:

We discussed that Tier 2’s main job is to find out the root cause of the threat, how it works, and how it must be stopped.

  • Detailed Documentation of incidents:

Just like the Tier 1 analysts, they must also make a detailed report of the incident and the event that took place. These reports are important and necessary for further investigation and future learning.

  • Forwarding critical threats for further investigation:

If there is still no solution to the problem, then the Tier 2 analyst must pass on the issue to the Tier 3 analyst, i.e., the last tier in SOC. This is not compulsory in every situation; sometimes a problem is fixed, and it is not required to pass on the issue to Tier 3.

Tier 3

We’re nearing the end of our blog journey.
Let’s discuss the third Tier of SOC. This Tier is the most experienced and skilled in the Security Operations Center. They are the experts who handle the most complex and advanced threats. So, as we read above, when the problem is not fixed or it’s difficult to understand, then Tier 2 escalates it to Tier 3, as now it requires more skilled and experienced analysts. Tier 3 is the end or the final point for the SOC, which deals with the complex security incidents and sophisticated cyber threats. These analysts take full and whole control of the event and perform deep technical analysis. They also drive continuous improvement in a firm’s security posture and help in keeping the system safe and clean with no threats.

Key Functions of Tier 3 SOC Analyst

Some day-to-day responsibilities of Tier 3 are:

  • It handles some advanced cyber threats:

The threats that are not being fixed by Tier 1 and Tier 2 come over to Tier 3, which deals with the complex threats and investigates the problem deeply.

  • It investigates complex issues:

They dig deep to find the root cause of the issues and clear some questions, like what the main reason for the attack was, where it started, and what its weakness and strength are.

  • It improves the strategies of defense:

As we know, Tier 3 is known to fix the issues with complex and advanced tools, but it’s not the only job; rather, it must find some ways to strengthen systems, close security gaps, and prepare the SOC for future threats.

If you are a student and want to crack your interview confidently, then check this out. click here

Understanding SOC Tiers with an Example

Still confused? No worries! – Let’s break down the three tiers, and let’s understand the function of all three Tiers with an example. The best way of learning something is by using an example. One real-life example!

Example: An Unfamiliar Email with a Link! An employee of a big organization suddenly receives an email saying, “Click to win a lottery!” By mistake he clicked it, and his system started acting strange and was not working as it used to work.

  • Tier 1: This information that a strange link has been clicked was caught by the Tier 1. The Tier 1 checks and creates a report and immediately passes on the case to Tier 2 for investigation.
  • Tier 2: After passing on, the Tier 2 analyst begins their work, and after investigating, they find out that the link downloaded is a virus. They suddenly disconnect the systems from the network to stop the virus from spreading and uninstall the malware. After deleting, they check all the computers to see if all the systems are safe or not.
  • Tier 3: Tier 3 checks the history of the malware and finds that it’s a known virus. Now their job of improving the company’s email filters begins, and they make sure that such messages don’t reach anyone. They also provide training to the employees so that they don’t click on the fake emails in the future.

Conclusion

Now let’s bring everything together and discuss what we learned above!

As we all are aware of the increasing cyber threats, due to this reason, the organizations must improve their security policies and should have a clear structure and skilled employees at every level. The Tier 1 SOC analyst is the first level who finds or catches the threat. They are just in charge of monitoring the threats and reporting the problem as early as possible. The Tier 2 SOC analyst is the second level who fixes the complex issues that are not fixed by the Tier 1 analysts. They must do deep investigations to know the nature and the impact of the threat. The tier 3 SOC analyst is the third and the last level, who handles the toughest cases. They must use advanced tools and techniques, and their main job is to fix complex issues and find out the root cause of the issue. Every Tier has its unique job and role, but together they become a strong defense system and keep the company safe from cyberattacks. That’s their job!