How to get hired
A SOC watches an organisation's security alerts around the clock. Some companies run their own; many buy the service from a managed security service provider (MSSP), a Big 4 firm or a large IT services company that monitors dozens of clients from one floor. Those providers are where most L1 hiring happens.
What an L1 analyst does
Alerts arrive in a SIEM (Splunk, Microsoft Sentinel, IBM QRadar and others) and from EDR tools (CrowdStrike, Microsoft Defender and others). Your job is triage: is this alert real, how bad is it, and does it follow the playbook for closing, containing or escalating to L2? You document every step in a ticket. A good L1 closes false positives quickly and never sits on a real one.
Indian rules add urgency. Under CERT-In's 2022 directions, covered organisations must report specified cyber incidents to CERT-In within 6 hours of noticing them and keep system logs for 180 days within India. The SOC is where that clock starts.
Who gets hired
- Graduates (B.Tech, BCA, B.Sc IT and similar) in batch hiring by MSSPs and services firms, often after an aptitude test, a networking and security basics test, and a technical interview.
- IT support and NOC engineers who already work shifts and know Windows, networking and ticketing. This is the smoothest move.
- Network and system admins who want to cross into security.
Certifications employers ask for
- CompTIA Security+ (SY0-701) for basics, and CySA+ for analyst skills.
- Microsoft SC-200 (Security Operations Analyst Associate) if the SOC runs Sentinel and Defender; it covers triage, incident response and threat hunting with KQL, and renewal each year is a free online assessment.
- Splunk Core Certified User, an entry-level exam with no prerequisites, for Splunk shops.
- CEH shows up in many Indian SOC job posts, often because client contracts name it.
One of these plus a home lab beats three certificates with no hands-on work.
Build a small SOC at home
Install a free SIEM (Wazuh, Security Onion, or a Splunk free licence) on a spare machine or VMs, send it logs from a Windows VM, then attack yourself: fail ten logins, run a suspicious PowerShell command, add a new admin user. Write detection rules for each and screenshot the alerts. Map each detection to a technique in the MITRE ATT&CK framework. That project is your interview.
What interviews ask
- Read a log. "These are 40 failed logins from one IP, then a success. What happened, and what do you do?" Know Windows event IDs 4624 (successful logon), 4625 (failed logon) and 4720 (account created).
- Phishing. Read an email header, check SPF, DKIM and DMARC results, spot the lookalike domain, and say how you'd find who else received it.
- Networking for security. Common ports, what a port scan looks like in firewall logs, DNS tunnelling at a high level.
- Malware basics. What EDR does when it quarantines a file, what a hash is used for, how you'd check an IP or hash reputation.
- Process. Severity levels, SLAs, when to wake up L2, how to write a ticket someone else can act on at 4 a.m.
- MITRE ATT&CK. Name a tactic and a technique, and how you'd detect it.
First titles
SOC Analyst L1, Security Analyst, Security Monitoring Analyst, Cyber Security Analyst, Information Security Analyst, Junior Incident Responder.
Shift life and the way up
Most SOCs run 24x7 on rotating shifts: mornings, evenings and nights in a cycle, weekends included. Ask about night allowance, cab facility and how often the rotation changes; changing every week is harder on your health than monthly blocks. The early months are mostly false positives, which is tedious, but it is how you learn what normal looks like.
L1 to L2 usually takes one to two years. L2 handles investigations and response; L3 does threat hunting, detection engineering and forensics. From there people move to incident response, threat intelligence, detection engineering, or SOC lead and manager roles, many of which run on day shifts.