What Is a SOC Analyst? Duties, Tiers, Salary and How to Become One
Nov 01, 2026
By Stephen Adindu, Lead Coach at The Career Accelerators. Last updated October 2026.
A SOC analyst works in a security operations centre (SOC), watching an organisation's systems for attacks, investigating suspicious alerts, and responding when something is real. Tier 1 SOC roles are a common way into cybersecurity. Many SOC teams work in tiers: Tier 1 analysts triage alerts, Tier 2 investigates and contains incidents, and Tier 3 hunts for threats. In Canada, Job Bank puts the median wage for cybersecurity analysts at C$49.52 an hour.
This guide covers what a SOC analyst does at each tier, the skills and tools you need, which certifications help, what the job pays in Canada, and how to get your first role.
Key takeaways
|
What does a SOC analyst do?
A SOC is the team that watches an organisation's networks, servers, laptops and cloud services, often around the clock. SOC analysts are its front line. Day to day, they:
- monitor alerts from security tools and review logs from firewalls, intrusion detection systems and antivirus;
- triage alerts by severity, and separate real threats from false positives;
- investigate incidents such as malware, phishing, suspicious logins and insider activity;
- contain threats and work with IT teams to clean them up;
- document every incident for follow-up and compliance;
- write and tune detection rules so the team sees less noise and catches more real attacks.
SOC analyst tiers: Tier 1 vs Tier 2 vs Tier 3
| Tier | Main job | Typical work |
|---|---|---|
| Tier 1: triage | First responder | Watch alerts in real time, sort true from false positives, follow response playbooks, escalate what's complex |
| Tier 2: investigation | Incident responder | Dig into escalated incidents, analyse logs and evidence, contain and remediate, write detection rules, mentor Tier 1 |
| Tier 3: hunting | Threat hunter or forensics specialist | Look for threats before alerts fire, deep forensics and malware analysis, shape detection strategy |
| SOC manager | Leader | Run the team, oversee incident handling, report to leadership |
Most people start at Tier 1. It's demanding work, with lots of alerts and shift patterns in some teams, but it teaches you how attacks really look in the logs.
What skills and tools does a SOC analyst need?
| Area | What to learn |
|---|---|
| IT fundamentals | Networking (TCP/IP, DNS, ports), Windows and Linux basics |
| Security tools | SIEM platforms such as Splunk, EDR, firewalls, IDS/IPS |
| Analysis | Reading logs, spotting patterns, basic digital forensics |
| Attacker behaviour | Common tactics and attack chains, such as phishing, credential theft and lateral movement |
| Scripting | Python or PowerShell to automate repetitive checks |
| Soft skills | Clear incident write-ups, calm under pressure, teamwork across shifts |
Which certifications help you become a SOC analyst?
No single certificate is required. CompTIA Security+ is a common starting point. CompTIA lists cyber defense analyst and incident responder among the roles it maps to.
| Security+ (SY0-701) | Details |
|---|---|
| Exam | Up to 90 questions, multiple choice and performance-based, in 90 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Recommended background | Network+ and two years in a security or systems administration role (recommended, not required) |
The current version, SY0-701, is due to retire for English-language exams on 11 June 2027, so check which version your study materials cover. As you move up the tiers, analyst-focused certifications such as CompTIA CySA+ are a natural next step.
How much does a SOC analyst earn in Canada?
SOC roles fall under NOC 21220 (cybersecurity specialists). Job Bank's wage figures for cybersecurity analysts, updated in November 2025, show:
| Ontario | C$51.28 | |
| Alberta | C$50.51 | |
| Canada | C$49.52 | |
| Quebec | C$49.23 | |
| British Columbia | C$47.80 |
Nationally, Job Bank's low and high wages are C$30.00 and C$72.12 an hour. Job Bank notes that this occupation usually asks for a university degree, though OffSec points out that a degree helps but isn't always required.
How to become a SOC analyst, step by step
| 1. Learn IT basics Networking, operating systems and how attacks work. |
| 2. Get hands-on with a SIEM Practise searching logs and building simple alerts in a tool like Splunk. |
| 3. Earn Security+ A widely recognised first credential. |
| 4. Build a portfolio Write up home-lab investigations as short incident reports. |
| 5. Apply for Tier 1 Also consider help desk or IT support roles as stepping stones. |
How we prepare people for cybersecurity roles at TCA
Our cybersecurity program is a live, online coaching program with a live project and one-to-one mentorship. Its main focus is governance, risk and compliance (GRC) rather than SOC operations. It does build core SOC skills: hands-on Splunk for security information and event management (SIEM), tools such as Wireshark, Nmap and Nessus, and preparation for CompTIA Security+. If a SOC role is your goal, treat these as your foundation and add the SIEM and home-lab practice from the steps above.
SOC analyst FAQs
Is SOC analyst an entry-level job?
Tier 1 is often the first security role people get. Some employers ask for IT support experience or a degree first.
Do I need to know how to code?
Not to start. Basic scripting in Python or PowerShell helps you move up, especially into Tier 2.
What's the difference between a SOC analyst and a cybersecurity analyst?
A SOC analyst is a type of cybersecurity analyst who focuses on monitoring and responding to incidents. "Cybersecurity analyst" also covers roles in risk, compliance and vulnerability management.
Is Security+ enough to get hired?
It helps you get past CV filters. Hands-on evidence, such as SIEM practice and written-up investigations, is what tends to win interviews.
Do SOC analysts work shifts?
Some SOCs monitor around the clock, so some roles involve shifts or on-call work. Ask about it in interviews.
Ready to start your cybersecurity career?
Our cybersecurity program combines live training, Splunk practice and a live project. Book a free call to work out whether a SOC role or a GRC role is the better first step for you.
Related reading: how to become a cybersecurity analyst and 75+ cybersecurity interview questions.
Sources
- Job Bank: Cybersecurity analyst wages in Canada, for the national and provincial wages and NOC 21220
- Job Bank: Systems security analyst in Canada, for duties and education requirements
- CompTIA: Security+ (SY0-701), for exam format, passing score, recommended experience and job roles
- OffSec: SOC analyst role, for duties, skills, tools and career path
- Radiant Security: SOC Tier 1 vs Tier 2 vs Tier 3, for the tier responsibilities
