Cybersecurity & IT

Skill areas

Cybersecurity & IT

SOC Analyst

A Security Operations Centre (SOC) Analyst is responsible for the continuous monitoring, detection, and response to cybersecurity threats across an organisation's infrastructure. Working within a SOC — which may operate 24/7 — analysts triage security alerts, investigate incidents, contain threats, and document findings. They work with SIEM platforms, endpoint detection tools, network monitoring systems, and threat intelligence feeds to identify and respond to attacks in real time.

Career information

Everything you need to know about this role

Salary, eligibility, background, qualifications, and where people typically work.

Expected salary range

P25 and P75 are the 25th and 75th percentiles for UK full-time pay (national benchmarks). UK median is the national full-time median salary.

P25UK medianP75

£29,000£39,000£54,000

Source: ONS Annual Survey of Hours and Earnings (ASHE), UK full-time gross annual earnings, April 2025 (released Oct 2025).

Entry

0–2 yrs

£25,000–£40,000

MidEst.

2–5 yrs

£36,000–£44,000

Senior

5+ yrs

£40,000–£65,000

Dot = average of the range; coloured bar shows min–max vs UK benchmarks above.

Eligibility limits

Right-to-work, checks, and role-specific requirements — tap to view.

Right to work in the UK required. Many SOC roles — particularly in government, defence, and critical infrastructure — require Security Clearance (SC) or Developed Vetting (DV). SC eligibility typically requires 5 years UK residency; DV requires 10 years. DBS checks are standard. Shift work (including nights and weekends) is common in 24/7 SOC environments. No formal licence required for commercial roles.

Understand eligibility rules →

How the role developed

Security Operations Centres became standard practice in large enterprises and government agencies through the 2000s, modelled on military command-and-control structures. The surge in organised cybercrime, ransomware-as-a-service, and nation-state attacks through the 2010s and 2020s made the SOC model essential for any organisation with significant digital assets.

The role of SOC Analyst formalised alongside the growth of SIEM technology — platforms like Splunk, IBM QRadar, and Microsoft Sentinel created a new category of security professional trained in log analysis and alert management.

Current direction

In the UK, the National Cyber Security Centre (NCSC) has driven adoption of SOC capabilities across government and critical national infrastructure. Commercial SOC services (MSSPs) have also created significant demand for analysts who can work across multiple client environments.

Automation and AI are changing the SOC landscape — reducing low-level alert fatigue and shifting analyst focus toward higher-complexity investigation.

Explore progression

See where this role can take you

Sample career paths, linked roles, and typical UK timelines for moving up or sideways.

Next step

Prepare for your interview

10 common questions with sample answers, structure tips, and what recruiters look for.

Career path3 sample paths

Where this role can take you

Realistic progression routes, linked roles, and typical UK timelines for your next move.

SOC analysts monitor, detect, and respond to security events—often on rotating shifts in MSSPs, banks, or critical infrastructure. Progression leads to senior SOC, threat hunting, detection engineering, or security management.
In financial services, lateral moves into fraud or risk are realistic when you understand transaction abuse and control frameworks. Security analyst roles are projected to grow roughly 29% through 2034 in the US alone — nearly three times the average for all occupations.
Tier-1 SOC work emphasises alert triage and playbooks; tier-2 and senior roles add investigation depth, threat intelligence, and tuning. Many leave shift work for detection engineering, DFIR consultancies, or cyber risk in second line.
Fraud analyst roles value SOC experience with account takeover and mule patterns; risk analyst roles value incident metrics and control failings. Burnout is a real factor—plan rotations, upskilling, or internal moves every 2–3 years if nights are affecting health.
Allow 18–24 months per SOC tier in the UK; senior SOC or team lead often sits at 4–6 years from junior cyber entry. GIAC GCIA/GCIH or equivalent vendor training helps; managers look for incident write-ups and mean-time-to-triage improvements.
Certifications alone rarely skip tiers—demonstrate one complex incident you led across IT, HR, and legal before applying up.

Overview

SOC analysts monitor, detect, and respond to security events—often on rotating shifts in MSSPs, banks, or critical infrastructure. Progression leads to senior SOC, threat hunting, detection engineering, or security management.

In financial services, lateral moves into fraud or risk are realistic when you understand transaction abuse and control frameworks. Security analyst roles are projected to grow roughly 29% through 2034 in the US alone — nearly three times the average for all occupations.

Why this path matters now

IT helpdesk or sysadmin → SOC analyst is the single strongest career-change path — you leverage systems knowledge rather than starting from zero.

Interview prep10 questions

Practise the questions you'll actually get asked

Study the most common interview questions for this role, with structured guidance and strong sample answers.

Common interview questions

Answer guidance, sample responses, and tips for each question.

Ranked by how often this question appears across real interviews.

openingsocintroduction
Why they ask
SOC teams hire for shift reliability and communication; this opener shows your path into security operations.
What they want
Relevant background, labs, certifications, and why SOC fits your skills and interests.
How to structure your answer
Current learning and experience
SOC-relevant skills (logs, networking, discipline)
Why this SOC role
Brief and structured
Sample answer
I am an IT support graduate who has spent the last year preparing for security operations through Security+ study, TryHackMe SOC learning paths, and a home lab where I ingest sample logs into a free SIEM trial. I worked on a university helpdesk logging malware and phishing tickets and escalating to IT security. I am disciplined, calm under pressure, and comfortable with shift patterns. I enjoy investigating alerts and documenting findings clearly. I am applying to your SOC because I want to grow from alert triage into skilled incident response while protecting your customers and infrastructure twenty-four seven.
Common mistakes
Offensive-only hacking persona with no monitoring interest
No mention of documentation or shifts
Overclaiming senior IR experience
Bonus tips
Mention comfort with repetitive high-stakes work
Reference a specific log source you have practised with
Show teamwork mindset for handovers
motivationsocdefensive-security
Why they ask
SOC work is demanding; they need genuine interest in monitoring, investigation, and continuous learning.
What they want
Motivation for defensive operations, teamwork on shifts, and realistic view of alert queues.
How to structure your answer
What excites you about SOC work
Skills you bring
How you handle pressure and learning
Career growth interest
Sample answer
I want to work in a SOC because it is the front line of defence where analysis directly reduces harm. I like combining pattern recognition, structured procedures, and collaboration under time pressure. SOC work suits my detail-oriented nature and my willingness to document cases thoroughly for handover. I understand junior roles involve high alert volumes and false positives, and I see that as training to become a sharper analyst. Long term I aim to specialise in detection engineering or incident response, and this SOC offers the scale and mentorship to grow responsibly.
Common mistakes
Expecting only exciting APT hunts daily
Dismissing shift work or ticketing
No defensive security framing
Bonus tips
Ask about tier structure and mentoring
Mention interest in purple teaming if genuine
Show respect for process and playbooks
siemloggingsoc-tools
Why they ask
SIEM is central to SOC workflows; you must explain its purpose even if you have limited hands-on time.
What they want
Definition, log aggregation, correlation, alerting, and analyst investigation role.
How to structure your answer
Define SIEM in plain language
What data it collects
How alerts are created
Analyst workflow on alerts
Sample answer
A SIEM—Security Information and Event Management tool—collects and normalises logs from sources such as firewalls, endpoints, cloud services, and identity systems into one searchable platform. It correlates events to detect suspicious patterns, for example many failed logins followed by a successful one from a new country. It generates alerts for analysts to triage, investigate, and escalate. Examples include Splunk, Microsoft Sentinel, and Elastic SIEM. As a SOC analyst I would use the SIEM to query timelines, tune false positives with senior staff, and document cases while following playbooks.
Common mistakes
Naming SIEM as only antivirus
No mention of logs or investigation
Claiming SIEM replaces human analysts entirely
Bonus tips
Mention a lab or trial where you ran a simple search
Note compliance and retention if relevant
Differentiate SIEM from SOAR briefly if you know it
phishingtriageinvestigation
Why they ask
Phishing alerts are daily SOC bread and butter; they test structured triage and evidence gathering.
What they want
Validate alert, examine email headers and URLs safely, check user actions, contain, and document.
How to structure your answer
Confirm alert details and affected user
Analyse email indicators in sandboxed tools
Check clicks, credentials, or mailbox rules
Containment and user communication
Close with lessons and blocks
Sample answer
I would open the ticket and confirm the alert source—email gateway, user report, or SIEM rule. I would review headers, sender, URLs, and attachments using approved sandbox or OSINT tools without clicking live links on my own machine. I would check whether the user clicked, submitted credentials, or had mailbox rules added. If malicious I would follow playbook: isolate endpoint if needed, force password reset and MFA review, quarantine messages organisation-wide, and block indicators on proxy or email filters. I would notify the user with guidance, document IOCs and timeline, and escalate if widespread or BEC suspected.
Common mistakes
Clicking links on production analyst workstation carelessly
Closing ticket without user impact check
Skipping organisation-wide search for same campaign
Bonus tips
Mention BEC and executive targeting awareness
Reference headers like SPF/DKIM at high level if asked
Show chain-of-custody mindset for evidence
detectionalertssoc-fundamentals
Why they ask
Alert tuning and analyst judgement depend on understanding detection accuracy terminology.
What they want
Clear definitions, examples, and how false positives affect SOC workload and tuning.
How to structure your answer
Define true positive with example
Define false positive with example
Mention false negative briefly
How SOC manages trade-offs
Sample answer
A true positive is when an alert correctly identifies malicious or policy-violating activity—such as malware beaconing that we confirm and contain. A false positive is when the alert fires but investigation shows benign behaviour—like a vulnerability scanner triggering an exploit signature. False positives consume analyst time and can cause alert fatigue, so teams tune rules, enrich context, and prioritise high-fidelity detections. False negatives—real attacks missed—are more dangerous, so balance matters. I would document false positives with evidence to help detection engineers improve rules without silencing real threats.
Common mistakes
Confusing false positive with false negative
Saying all alerts should be ignored
No link to tuning or documentation
Bonus tips
Mention precision and recall conceptually if comfortable
Give an example from a lab SIEM rule
Show patience with tuning as a team sport
triageincident-responsesoc
Why they ask
Triage speed and quality determine whether incidents escalate correctly before damage spreads.
What they want
Prioritise, validate, gather context, contain if needed, escalate, document—following playbooks.
How to structure your answer
Assess severity and scope
Validate maliciousness
Gather key artefacts and timeline
Contain or escalate per playbook
Communicate and document
Sample answer
During triage I would classify severity using our matrix—considering asset criticality, data sensitivity, and active exploitation. I would validate whether the alert is a true positive using SIEM queries, endpoint data, and identity logs. I would build a short timeline: first seen, affected hosts and accounts, related IOCs. If active threat I would initiate containment steps I am authorised for—disable account, isolate host—while notifying the incident lead. I would preserve evidence, avoid destructive actions beyond playbook, and hand off a clear ticket summary. Throughout I would communicate status to the shift lead and update runbooks if gaps appear.
Common mistakes
Deep-diving for hours without escalation on critical incidents
Deleting logs during triage
Working outside authorised actions
Bonus tips
Mention MITRE tactics for structuring questions
Practice writing executive one-liners for escalations
Ask about severity matrix in the interview
idsipsnetwork-security
Why they ask
Network security basics help analysts understand alerts from perimeter tools and their limitations.
What they want
IDS detects and alerts; IPS can block inline; trade-offs with false positives and latency.
How to structure your answer
Define IDS and mode (passive monitoring)
Define IPS and inline blocking
Compare benefits and risks
SOC relevance for alerts
Sample answer
An Intrusion Detection System monitors network traffic or hosts and alerts on suspicious patterns but does not block traffic by default—it is typically out-of-band or passive. An Intrusion Prevention System sits inline and can automatically block or reset connections when rules match, which speeds response but risks disrupting business if rules are wrong. Both use signatures or behavioural analytics. SOC analysts may see IPS blocks as tickets requiring validation. Understanding the difference helps me interpret whether an event was merely observed or already prevented, and whether tuning is needed.
Common mistakes
Saying IDS and IPS are identical
Ignoring false positive impact on IPS
Confusing with firewall only
Bonus tips
Mention host-based IDS (HIDS) vs network (NIDS) if asked
Relate to a lab packet capture exercise
Note defence in depth—IPS is one layer
networkexfiltrationinvestigation
Why they ask
Outbound anomalies may indicate C2 or data exfiltration; this tests prioritisation and investigation depth.
What they want
Validate baseline, identify host and process, contain if malicious, escalate, preserve evidence.
How to structure your answer
Confirm anomaly against baseline
Identify source host, user, and destination
Check threat intelligence and reputation
Contain and escalate per severity
Document IOCs and scope
Sample answer
I would verify the alert against normal baselines—backups, updates, or SaaS APIs can look unusual but be benign. I would identify the source IP, hostname, user, process if EDR available, destination IP or domain, volume, and timing. I would check threat intelligence and whether other hosts communicate similarly. If indicators suggest command-and-control or exfiltration I would escalate immediately and follow containment playbook such as isolating the host and blocking domains at the firewall pending senior approval. I would preserve logs, avoid rebooting prematurely, and scope lateral movement. I would document findings for handover and longer-term detection improvements.
Common mistakes
Blocking without validation or approval
Ignoring legitimate cloud service traffic
Failing to scope other affected systems
Bonus tips
Mention DNS and HTTPS beaconing awareness
Ask what EDR and NetFlow tools the SOC uses
Practice articulating urgency without panic
labsprojectshands-on
Why they ask
Practical projects demonstrate initiative beyond certifications for entry-level SOC candidates.
What they want
Specific labs, what you learned, and how they map to SOC tasks—not vague interest.
How to structure your answer
Name platform or lab setup
What you built or practised
Skills gained relevant to SOC
What you plan next
Sample answer
I built a home lab with VirtualBox hosting a Windows client, Linux syslog server, and a Splunk free instance ingesting authentication and firewall sample logs. I practised writing searches for failed logins and created a simple detection that emails when thresholds exceed normal. On TryHackMe I completed the SOC Level 1 path covering phishing analysis, log investigation, and basic malware triage in isolated environments. I also documented each exercise in a personal wiki to reinforce learning. Next I plan to practise Sigma rules and connect a trial Sentinel workspace. These projects taught me patient log analysis and clear case notes.
Common mistakes
Illegal activities presented as projects
Vague I play with computers answer
No link to monitoring or investigation skills
Bonus tips
Offer to screen-share a sanitized notebook
Quantify hours or modules completed
Mention collaboration in CTF teams if applicable
threat-intellearningclosing
Why they ask
SOC analysts must evolve with threat actors; continuous learning is non-negotiable on shifts.
What they want
Credible sources, routine, and application to detections or awareness—not passive scrolling.
How to structure your answer
Trusted intelligence sources
Regular learning habit
Sharing with team appropriately
Ongoing certifications or community
Sample answer
I maintain a weekly routine reading NCSC, CISA advisories, and vendor bulletins for technologies in my lab. I follow ATT&CK techniques to understand how detections map to behaviours. When a major CVE breaks, I read mitigation guidance and test understanding in my home lab if safe. I take notes on campaigns relevant to common sectors such as finance or SaaS. I plan to contribute concise threat summaries during shift handover when appropriate. I am studying Security+ and intend to pursue SOC-specific training as my role develops. Staying current helps me triage faster and ask better questions during incidents.
Common mistakes
Only social media memes
No operational link to work
Claiming expertise after one article
Bonus tips
Mention threat intel platforms the employer uses if known
Show discipline to verify rumours
Close with enthusiasm for the SOC mission

Back to Cybersecurity & IT or all industries.

SOC Analyst

Everything you need to know about this role

Expected salary range

Eligibility limits

How the role developed

Current direction

Where this role can take you

Overview

Why this path matters now

Practise the questions you'll actually get asked

Everything you need to know about this role

Expected salary range

Eligibility limits

How the role developed

Current direction

Where this role can take you

Overview

Why this path matters now

Practise the questions you'll actually get asked

Sample career paths

Related roles in this library

Career tips