SOC Analyst: market

Vacancy

an open job that cleared the quality gate and lists at least two technologies

Observed candidate

a candidate whose stack contains this technology; an aggregate — not a single record leaves the perimeter

Matchable candidate

not counted yet

Window

jobs open at the moment the snapshot was built

Top 5: cloud, linux, aws, python, active directory. SIEM query languages: SPL (Splunk) or KQL (Kusto — Sentinel) — must for investigation + detection. EDR / XDR: CrowdStrike Falcon (leader) / SentinelOne / Microsoft Defender for Endpoint / Palo Alto Cortex XDR. Russian: Kaspersky KEDR / MaxPatrol EDR. SOAR (automation — reduces toil): Palo Alto Cortex XSOAR / Splunk SOAR / Tines / Torq / Microsoft Sentinel Playbooks. NDR: Darktrace / Vectra / PT NAD. Threat Intelligence: Recorded Future / Mandiant / MISP (open-source) / VirusTotal / AlienVault OTX. Ticketing / case management: TheHive (open-source SOC case management — popular) / Jira Service Management / ServiceNow Security Operations. Frameworks & methodologies — must: MITRE ATT&CK (adversary TTPs taxonomy — modern SOC maps all alerts to ATT&CK techniques + coverage gap analysis), Cyber Kill Chain (Lockheed Martin — attack phases), Diamond Model (intrusion analysis), Pyramid of Pain (IoC value hierarchy). Analysis tools: Wireshark (packet analysis) / VirusTotal (file / URL / hash reputation) / any.run + Joe Sandbox + Cuckoo (malware sandboxes — detonate suspicious files) / CyberChef (data decoding Swiss Army knife — base64 / hex / encryption) / Volatility (memory forensics — L3) / OSINT tools (Shodan + urlscan.io + AbuseIPDB + GreyNoise). Detection engineering (L3 / Detection Engineer): Sigma (vendor-agnostic detection rule format — standard 2026 — write once, convert to Splunk / Sentinel / Elastic), YARA (malware pattern matching), Splunk SPL / Sentinel KQL rule authoring, Atomic Red Team + Caldera (adversary emulation for detection rule validation). Languages: Python primary (alert enrichment + SOAR playbooks + automation) + bash + PowerShell + KQL / SPL query languages.

SOC Analyst (this page) — operational role, real-time monitoring + alert triage + incident detection. Front-line defense. L1 / L2 / L3 tier structure. Often shift work 24×7. The most accessible entry. Security Engineer (general) — engineering role, builds + maintains security infrastructure (SIEM / EDR / IAM / network security configuration). Strategy + automation focus, not real-time monitoring. See Security Engineer (general). Threat Hunter — proactive specialty: hunt for threats that SIEM signature-based detection missed (hypothesis-driven hunting using ATT&CK + behavioral analysis). Often a SOC L3 sub-specialty. Incident Responder (IR) — reactive deep specialty: handles confirmed major incidents (containment + eradication + recovery + forensics + post-mortem). Often separate CSIRT team or external IR consultancy. Detection Engineer (rising 2024+) — SOC's engineering arm: writes + tunes detection rules (Sigma / SPL / KQL), reduces false-positive rates, builds detection coverage against ATT&CK. Bridge SOC ↔ Security Engineering. Reality 2026 (relationship): SOC L1 (triage) → L2 (investigation) → L3 (advanced — often = Threat Hunter / Detection Engineer hybrid). Security Engineer builds the tools SOC uses. IR takes over when SOC confirms a major incident. Career flow from SOC: SOC L3 → either Security Engineer (broader engineering — higher ceiling), or Threat Hunter (proactive deep), or Incident Responder (reactive deep), or Detection Engineer (engineering-leaning), or SOC Manager (people management), or Pentester (offensive pivot — understanding defense helps), or Threat Intelligence Analyst. SOC — the best launchpad: gives broad exposure to all security domains, then specialize.

Classic SOC tier model 2026 (some modern SOCs are transitioning to a «tierless» model, but the tier structure remains dominant): L1 (Tier 1) — Alert Triage Analyst: Responsibilities: monitor SIEM / EDR / NDR alert queue 24×7, perform initial triage (validate alert — true positive / false positive / benign), follow established playbooks, enrich alerts (look up IPs / hashes / domains in threat intel), escalate confirmed / suspicious incidents to L2, dismiss false positives. Skills: SIEM basics, alert interpretation, playbook execution, attention to detail under repetitive load. Typical: shift work (often 12-hour shifts 24×7 rotation), entry-level (1-2 years experience or fresh with certs). Burnout risk is high (repetitive + night shifts) — typical L1 tenure 1-2 years before promotion. L2 (Tier 2) — Incident Responder / Investigator: Responsibilities: deep investigation of escalated incidents, correlation across data sources (SIEM + EDR + network + cloud logs), scope incident (what is affected, timeline reconstruction), determine attack technique (MITRE ATT&CK mapping), recommend containment actions, handle malware analysis (basic — sandbox detonation), document incident thoroughly. Skills: investigation methodology, log analysis depth, malware analysis basics, ATT&CK fluency, SIEM query mastery (SPL / KQL). L3 (Tier 3) — Senior Analyst / Threat Hunter / Detection Engineer: Responsibilities: handle most complex / sophisticated incidents (APT-level), threat hunting (proactive — hypothesis-driven search for threats SIEM missed), detection engineering (write + tune detection rules — Sigma / SPL / KQL — reduce false-positive rates + improve coverage), advanced malware analysis + reverse engineering basics, forensics (memory — Volatility, disk), mentor L1 / L2, develop playbooks, adversary emulation (Atomic Red Team / Caldera to validate detections). Skills: deep technical expertise, threat hunting methodology, detection engineering, programming (Python for automation), forensics. SOC Lead / SOC Manager: team leadership, shift scheduling, SOC metrics ownership (MTTD — Mean Time to Detect, MTTR — Mean Time to Respond, alert volume, false-positive rate, escalation accuracy), SLA management, hiring, customer communication (for MSSP). Cross-cutting: SOC metrics — MTTD / MTTR / dwell time / alert-to-incident ratio / analyst-touch-rate. Modern trends 2026: SOAR automation reduces L1 toil (automate 50%+ repetitive triage), «tierless SOC» model (some orgs flatten the hierarchy — all analysts investigate, specialization vs tier), AI-assisted triage (LLM-based alert summarization + enrichment — rising 2024+). Shift reality: 24×7 coverage requires follow-the-sun model (multiple geo locations) or night shift rotations (burnout management critical).

Yes, 29% of SOC Analyst vacancies — full-remote or hybrid. SOC work is primarily cloud-based (SIEM / EDR / SOAR consoles + dashboards — all accessible remotely). L1 shift work — many SOCs support remote 24×7 coverage (analysts work shifts from home — especially follow-the-sun MSSP model where different geo locations cover different time zones). Outsourcers — usually remote. Russian bank SOCs — hybrid/office due to regulatory + security clearances (especially for state companies + GosSOPKA-linked centers — on-site mandatory). Russian MSSP — hybrid or remote after security background-check. State companies / GosSOPKA — hybrid/office mandatory (air-gapped environments + clearances). International MSSP (Arctic Wolf / eSentire / Expel / Red Canary / Secureworks / Rapid7 MDR / Sophos MDR) — full-remote standard (MSSP business model inherently remote-friendly — serve clients globally). Big Tech SOC — hybrid standard. Caveat for shift work: night shifts require reliable home setup + quiet space. Time zone — SOC roles often require overlap with team coverage windows. Relocant hubs: Poland / Germany / Serbia / Georgia. English for international SOC remote — must (especially MSSP — serve English-speaking clients + vendor docs Splunk / CrowdStrike / Sentinel).

SOC Analyst (L1 / L2) — consumes detection rules: responds to alerts that detection rules generate. Reactive. Detection Engineer (rising specialty 2024+ — often evolved from SOC L3) — creates + maintains detection rules: SOC's engineering arm. Day-to-day: 1) Write detection rules (Sigma — vendor-agnostic format — write once, convert to Splunk SPL / Sentinel KQL / Elastic; native SPL / KQL for platform-specific). 2) Tune false-positive rates (badly tuned rules → alert fatigue → real threats missed — Detection Engineer's core mandate: high signal-to-noise). 3) Detection coverage analysis (map detections to MITRE ATT&CK matrix → identify coverage gaps → prioritize new detections). 4) Detection-as-code (treat detection rules as code — version control in Git + CI/CD pipeline + testing + peer review — modern practice). 5) Adversary emulation (Atomic Red Team + Caldera + MITRE Caldera — simulate attacks → validate detections fire correctly). 6) Threat intelligence integration (convert threat intel reports → actionable detection rules). 7) Detection metrics (rule efficacy + false-positive rate + true-positive rate + coverage %). Skills: programming (Python — must), SIEM query languages mastery (SPL / KQL), MITRE ATT&CK deep, understanding of attacker TTPs, Git / CI-CD (detection-as-code). Why rising 2024+: orgs realized — buying more SIEM / EDR tools doesn't help if detection rules are bad. Quality of detections > quantity of tools. Detection Engineering — a recognized discipline (SANS course SEC555, dedicated conferences). Career flow: SOC L2 / L3 + programming skills + detection rule authoring interest → Detection Engineer — 6-12 months. Detection Engineering — one of the best career paths out of SOC (avoids SOC burnout + leverages engineering skills + higher ceiling).

Roadmap (SOC — the most accessible entry to cybersecurity, can enter without commercial experience): 1) IT fundamentals — networking (TCP / IP / DNS / HTTP / TLS — must), operating systems (Windows internals + Linux basics — where logs live + what gets attacked), basic system administration. CompTIA Network+ a helpful baseline. 2) Security fundamentals — CompTIA Security+ (industry-standard entry cert — must for SOC L1 applications). CIA Triad, common attacks (phishing / malware / lateral movement / privilege escalation), security concepts. 3) SOC-specific cert — CompTIA CySA+ (Cybersecurity Analyst — SOC-focused — behavioral analytics + incident response) or Blue Team Level 1 (BTL1) (Security Blue Team — practical hands-on SOC cert — rising 2024+, highly respected — incident response + SIEM + threat intel + digital forensics). 4) SIEM hands-on — the most important SOC skill. Splunk Fundamentals (free training — SPL query language) or Microsoft Sentinel (Azure free tier — KQL). Build home lab: ingest logs → write queries → create alerts. 5) MITRE ATT&CK fluency — study ATT&CK matrix (tactics + techniques), understand how alerts map to techniques. ATT&CK Navigator hands-on. 6) Home lab — set up SOC home lab: Security Onion (free SOC platform — Suricata + Zeek + Elastic) or Wazuh SIEM + simulate attacks (Atomic Red Team) + practice detection. 7) Hands-on practice platforms: TryHackMe SOC Level 1 + SOC Level 2 paths (best practical SOC training 2026 — affordable), Blue Team Labs Online (BTLO — investigation challenges), LetsDefend (SOC simulation platform — realistic alert triage practice), CyberDefenders (blue team CTF challenges). 8) Analysis tools — Wireshark (packet analysis) + VirusTotal + CyberChef (data decoding) + any.run (malware sandbox — free tier). Practice on real malware samples (malware-traffic-analysis.net). 9) Incident response basics — investigation methodology, the SANS PICERL model (Preparation / Identification / Containment / Eradication / Recovery / Lessons Learned). 10) Detection engineering basics (for L3 path) — Sigma rules + YARA + SPL / KQL rule authoring. 11) Python for SOC — alert enrichment scripts + SOAR playbook basics + automation. 12) Pet project portfolio: a) home SOC lab (Security Onion / Wazuh + simulated attacks + custom detections); b) TryHackMe SOC paths completion + writeups; c) LetsDefend / CyberDefenders investigation writeups (blog). International (eng): TryHackMe SOC Level 1 / 2 paths (best practical 2026), LetsDefend (SOC simulation), Blue Team Labs Online, SANS SEC450 Blue Team Fundamentals + SEC555 SIEM with Tactical Analytics (premium), «Blue Team Handbook» Don Murdoch (canonical SOC reference), «The Practice of Network Security Monitoring» Richard Bejtlich. Books-must: «Blue Team Handbook: SOC, SIEM, and Threat Hunting» Don Murdoch, «Applied Network Security Monitoring» Sanders / Smith, «Intelligence-Driven Incident Response» Roberts / Brown. SOC — entry-level accessible: certs (Security+ + CySA+ / BTL1) + home lab + TryHackMe portfolio → SOC L1 (without commercial experience possible).

76 active open SOC Analyst vacancies with explicit SOC focus in our sample. The real market is significantly wider — many SOC roles classified as general «Security Analyst» / «Information Security Analyst» / «SOC Specialist» / «Information Security». SOC — one of the highest-headcount security segments (24×7 coverage requires many analysts — typical enterprise SOC 10-50+ analysts, MSSP — hundreds). True SOC jobs in CIS + Europe estimated 500-2,000+ active positions at any moment 2026 (SOC — high-volume hiring due to L1 turnover + 24×7 staffing). Geography: Russia / Poland / remote. The real market is wider due to the international remote segment (MSSP business model — inherently remote — Arctic Wolf / eSentire / Expel / Red Canary serve clients globally). SOC L1 closing time — 2-6 weeks (high-volume entry-level hiring), Senior L3 / Detection Engineer — 6-12 weeks (rare skill). SOC — the most liquid entry-level security job market — best way to enter cybersecurity 2026.

Senior SOC Analyst L3 / Detection Engineer owns the full security operations lifecycle + detection engineering. SIEM mastery deep: Splunk Enterprise Security advanced (SPL mastery — complex correlation searches + macros + lookup tables + data models) or Microsoft Sentinel (KQL mastery — advanced queries + analytics rules + workbooks). Custom detection rule authoring + tuning false-positive rates (core mandate — high signal-to-noise). MITRE ATT&CK mastery: deep fluency with all tactics + techniques + sub-techniques, ATT&CK Navigator for detection coverage gap analysis, map every detection to ATT&CK. Detection engineering: Sigma rule authoring (vendor-agnostic — convert to Splunk / Sentinel / Elastic), YARA rules (malware pattern matching), detection-as-code practices (Git version control + CI/CD + peer review + testing), adversary emulation (Atomic Red Team + Caldera — validate detections fire). Threat hunting mastery: hypothesis-driven hunting methodology (don't wait for alerts — proactively hunt), behavioral analysis, hunting using ATT&CK + threat intelligence, anomaly detection. Incident response: investigation methodology (SANS PICERL), incident scoping + timeline reconstruction, containment strategy, lead L1 / L2 during major incidents. Malware analysis: static analysis basics (strings + PE headers + jadx / Ghidra basics), dynamic analysis (sandbox detonation — any.run / Joe Sandbox / Cuckoo — interpret results), basic reverse engineering. Forensics: memory forensics (Volatility), disk forensics basics, network forensics (Wireshark + Zeek), log analysis depth. Threat Intelligence: IoC workflows, STIX / TAXII, MISP, threat actor profiling, convert intel reports → detection rules. EDR / XDR mastery: CrowdStrike Falcon / SentinelOne / Microsoft Defender advanced — threat hunting queries, custom IOA rules, response actions. SOAR mastery: Cortex XSOAR / Splunk SOAR / Tines — playbook authoring in Python (automate L1 toil — typical mandate to automate 50%+ repetitive triage). Programming: Python deep (alert enrichment + SOAR playbooks + detection automation + custom tooling), bash + PowerShell. Cloud security monitoring: AWS CloudTrail / GuardDuty + GCP Security Command Center + Azure Sentinel — cloud-specific detection. SOC metrics: MTTD / MTTR / dwell time / false-positive rate / detection coverage — measure + improve. Soft: clear incident documentation + technical writing, mentor L1 / L2 analysts, calm under pressure (incident handling), shift handover discipline, communication during incidents (stakeholder updates). English for Senior+ MUST — SIEM / EDR vendor docs + threat intel reports + security community are English-language. Certifications: CompTIA CySA+ / BTL1 / GIAC GCIH (Certified Incident Handler) / GCFA (Forensic Analyst) / GCDA (Detection Analyst) / Splunk Core Certified / Microsoft SC-200. Optional bonus: detection engineering open-source contributions (Sigma rules repository / Atomic Red Team), threat hunting writeups / blog, conference talks (Blue Team Village DEF CON / SANS Blue Team Summit) — sharply increase market value for frontier-MSSP (Red Canary / Expel — detection engineering culture) hiring.