SOC Analyst Career Path & Salary Guide

A SOC analyst monitors an organization’s networks and systems for security threats, triaging alerts across SIEM platforms, investigating incidents, and escalating confirmed breaches. Entry-level Tier 1 analysts earn $57,000 to $80,000, while senior Tier 3 threat hunters pull $90,000 to $140,000 or more. The Bureau of Labor Statistics projects 29% job growth for information security analysts through 2034, with roughly 16,000 openings per year.

Sixty-four percent of SOC analysts are thinking about quitting. Not hypothetically. The Tines Voice of the SOC Report found that nearly two-thirds are actively considering leaving their current organization. And yet, 69% of those same analysts say they’re satisfied with the work itself. Strange number. Not contradictory though. The job is intellectually engaging. The conditions around the job are what drive people out. Alert volumes that never slow down, understaffing that never gets fixed, manual work that eats half the day. Good people sign up. Smart people. Curious ones. And then the operational debt, the understaffing, the tools that don’t talk to each other, it wears them out. Average SOC analyst tenure at any one employer? We see roughly 18 months, maybe two years if the team is well-run. After that, they either get promoted because someone above them left, or they bounce to a shop that offers a Tier 2 seat their current org couldn’t create because the team was flat and the one Tier 2 analyst wasn’t going anywhere anytime soon.

We staff SOC analysts and cybersecurity professionals through our cybersecurity staffing services. Have for years. And we’ll be upfront about the tension built into this guide. We benefit when companies struggle to hire and retain security talent. Literally how our business works. Bias on the table. But the information here holds up whether you ever pick up the phone or not. The salary data comes from three independent sources that disagree with each other in ways we’ll explain. The career path reflects what we’ve actually seen from candidates who started at Tier 1 and progressed to security leadership. The certification advice reflects what gets people interviews, not what vendors charge the most for.

What a SOC Analyst Actually Does (And Why the Tiers Exist)

The title “SOC analyst” covers at least three distinct jobs stacked on top of each other. The industry organizes them into tiers, which is helpful as long as you understand that real organizations don’t always follow the textbook version. Some companies have two tiers. Some have four. Some have one overwhelmed person doing all of it. The tier model is still how recruiters talk about the role, how HR writes job descriptions, and how salary bands get justified in budget meetings. Worth learning even if your company calls them something else entirely, because the second you start interviewing at other organizations or working with a recruiter, the tier language is what everyone defaults to and you need to know where you fit in it.

Tier 1: Triage and alert monitoring. This is where almost everyone starts. You sit in front of a SIEM platform. Splunk, Microsoft Sentinel, Elastic Security, IBM QRadar. Your screen fills with alerts. A mid-size organization generates thousands of security events per day, and the vast majority are false positives, routine system behavior that triggers a rule because the rule was written broadly enough to catch edge cases. Your job is deciding which alerts represent real threats and which ones are noise. Fast. Because more are coming.

The mental model isn’t “find the bad thing.” It’s closer to “find the five things that matter out of ten thousand that don’t.” That filtering takes pattern recognition, tool fluency, and a tolerance for repetitive work that many people underestimate before they start. A typical Tier 1 shift involves reviewing alerts, checking IP addresses against threat intelligence feeds, verifying whether a user account showing anomalous behavior is just someone logging in from vacation, and documenting everything in a ticketing system. Six months in, you can spot a real phishing compromise before you’ve finished your coffee. You can also feel your attention starting to fray from the volume, which is the part that nobody warns you about during the certification study and the part that drives more people out of the SOC than the salary ever does.

Alert fatigue is not a soft problem. The 2025 ISC2 Cybersecurity Workforce Study found that 48% of cybersecurity professionals feel exhausted trying to stay current on threats and emerging technologies. In the SOC specifically, the Tines Voice of the SOC Report puts burnout at 71%. Almost three out of four. And 64% say they spend more than half their working hours on tedious manual tasks that they believe could be automated but haven’t been.

Tier 2: Incident response and deep investigation. When Tier 1 escalates an alert as a confirmed or suspected incident, it lands here. Tier 2 analysts dig into the full attack chain. Where did the attacker get in? How far did they move laterally? What systems are affected? What data was accessed? They’re pulling packet captures, analyzing malware samples, correlating events across multiple log sources to reconstruct what happened.

Different skill set entirely. Tier 1 is breadth and speed, cycling through dozens of alerts per hour with a decision tree that’s mostly muscle memory after the first few months. Tier 2 is depth and patience. A Tier 2 investigation might take three days. You’re reading raw log data, building timelines, coordinating with system administrators who need to know whether their server was compromised, and writing incident reports that non-technical leadership can actually understand. The translation layer between “what happened technically” and “what this means for the business” starts here.

Tier 3: Threat hunting and detection engineering. Tier 3 doesn’t wait for alerts. They go looking. Proactive threat hunting means forming hypotheses about how an attacker might move through the environment, then querying data to test those hypotheses. Maybe you suspect an adversary is using living-off-the-land techniques, running PowerShell commands that look like normal admin activity. You build a detection rule. You test it against historical data. You tune it until it catches the real behavior without generating three hundred false positives per day for the Tier 1 analysts who have to deal with whatever you build.

Detection engineering is where the money is moving right now. It used to be that threat hunting was the prestige Tier 3 skill. Still important. But the companies writing the biggest checks want someone who can build the detections, tie them to MITRE ATT&CK technique IDs, and keep iterating on the rules as attackers change tactics. We had a client last quarter reject three Tier 3 candidates who were strong threat hunters because none of them had written Sigma rules in production. That’s how specific the ask has gotten.

Tools Across All Tiers

The toolset overlaps heavily but the depth of use changes at each level.

One number from the Tines report that hiring managers should pay attention to: 53% of SOC analysts use between 11 and 30 different security products. Eleven to thirty. The tool sprawl itself is a burnout driver, and it’s one reason candidates increasingly ask about the security stack during interviews. They want to know if they’ll be fighting 20 dashboards or working with a streamlined toolset.

SOC Analyst Salary by Tier and Experience

Three sources. Three different numbers. All technically correct. The disagreement is useful if you understand why it exists.

Why the $18K gap between ZipRecruiter’s entry figure ($57,761) and Glassdoor’s 25th percentile ($75,245)? Not an error. ZipRecruiter’s sample skews toward smaller shops and MSSPs, where pay is lower and job postings are more frequent because turnover is higher. Glassdoor pulls from people at bigger companies who bother to self-report, and those tend to be enterprise SOCs with better comp packages. Both numbers are real. They’re just counting different populations.

Now here’s the number that causes the most confusion. The Bureau of Labor Statistics reports a median salary of $124,910 for information security analysts as of May 2024. That looks dramatically higher than what most Tier 1 or even Tier 2 SOC analysts actually earn, and the discrepancy confuses people who use BLS data to anchor salary expectations without reading the fine print. The BLS occupation code 15-1212 covers all information security analysts, which includes security engineers, security architects, GRC specialists, and senior security consultants. Not just SOC analysts. The broader category lumps in people making $180K doing cloud security architecture at a FAANG company with people making $62K doing overnight Tier 1 alert triage at an MSSP in Ohio, and then calls the midpoint “the median.” If you’re a Tier 1 analyst expecting $125K because the BLS said so, you’re going to be disappointed. That median reflects the entire field, not the SOC-specific segment.

What Pushes the Number Higher

Geography matters. California, New York, Virginia, and Maryland consistently pay 15-25% above national averages, driven by tech hubs and the government/defense contractor market in the DC metro area. Clearance holders in the Northern Virginia corridor can add $15,000 to $30,000 on top of base salary for TS/SCI clearances.

Industry matters too. Financial services SOCs tend to pay at the top of the range because the regulatory requirements are stricter and the breach costs are higher. Real example from our placements. A Tier 2 analyst at a regional bank in Charlotte doing incident response on trading systems? That’s a $95K to $105K role. The Tier 2 at an MSSP across town monitoring 30 SMB clients from a shared console? $75K to $85K. Same title. Same city. Different world, and the candidates who understand that distinction going in are the ones who negotiate properly instead of anchoring to a national average that doesn’t reflect their specific situation. Healthcare has gotten more competitive in the last two years, partly because of the ransomware epidemic hitting hospitals and the compliance burden that comes with HIPAA.

Remote SOC work. Complicated. A lot of these roles require access to classified or restricted systems, and that means you’re on-site whether you like it or not. The remote jobs that exist cluster at MSSPs, and the pay drops. National applicant pool, more commoditized monitoring work, and companies know they can offer less when the commute is zero. We’ve watched candidates willingly take $10K to $15K less for a remote SOC role and call it the best move they’ve made. We’ve watched others try it and come back to on-site within six months because the isolation on top of the already-isolating nature of staring at alerts made things worse, not better.

Certifications and Their Salary Impact

Not all certifications move the needle equally. Some get you interviews. Some are expensive resume decoration. Here’s what we actually see driving callbacks when we submit candidates for SOC roles.

The ROI question most people ask: is Security+ worth $400? Without question, yes. It’s the minimum viable certification for most SOC Tier 1 roles, it satisfies DoD 8570/8140 requirements for government contract work, and it takes two to three months of study. Is the $8,000 SANS GSOC worth paying for yourself? Almost certainly not. But if your employer offers to cover it, take it immediately. That certification on your resume changes which roles recruiters put you forward for. We see it in our own submission data. Candidates with GIAC certs get presented for higher-tier roles regardless of whether the cert is listed as a hard requirement.

Check current market rates for your experience level with our salary benchmark tool.

The Career Path from Tier 1 to CISO

Nobody stays at Tier 1 for eight years. Well. Some do. But the career path from entry-level SOC analyst to security leadership is well-defined if not always fast. Here’s the realistic timeline based on what we’ve seen from candidates who moved through the progression.

Two to three years at each tier. That’s the median pace we see in our placements. Some people move faster, usually the ones stacking certs while working and getting lucky with a manager who gives them investigation work early. Some people stall, especially at MSSPs where the Tier 1 work is repetitive and the promotion path is “wait for someone to quit.” Fastest career jumps we’ve placed? Analysts who changed companies at the Tier 1 to Tier 2 boundary. Not because their first employer was bad. Just because the new shop had an open Tier 2 seat with real incident response work that the old team’s structure couldn’t offer.

The path branches after Tier 3. Not everyone wants to manage people. Not everyone should. The individual contributor track splits into detection engineering, threat intelligence, security architecture, and penetration testing. The management track goes SOC manager, director of security operations, CISO. Both tracks pay well at the senior end. Management pays more at the top. But the jump from Tier 3 IC to SOC manager trips people up. The thing that made you great at threat hunting, the deep focus, the obsessive attention to log patterns, that’s not what makes someone good at managing 12 analysts across three shifts with four different experience levels and two open reqs that HR won’t let you fill. Budget defense. Board presentations. Vendor negotiation. A Tier 3 analyst who can explain the business impact of a detection gap to a CFO is worth significantly more than one who can only explain it to another engineer.

Breaking In with No Experience

People ask us this constantly. The realistic answer is not glamorous but it works.

Get Security+. That’s step one. Two to three months of study, $400 for the exam, and it opens the door to Tier 1 roles at MSSPs, managed detection and response providers, and government contractors who need cleared analysts. A bachelor’s degree in cybersecurity, computer science, or IT helps but is not strictly required. We’ve placed SOC analysts who came from help desk roles, network administration, and even military intelligence backgrounds with no formal degree. What matters more than the degree is demonstrating that you understand how networks work, how logs are generated, and how to think through an alert triage workflow.

Home labs help. Setting up a SIEM like Elastic Security on a virtual machine, generating traffic with tools like Atomic Red Team, and writing detection rules against that traffic produces something to talk about in interviews that most entry-level candidates can’t match. Hiring managers notice that, and so do we when we’re evaluating whether to present a candidate for a Tier 1 role, because the person who can describe their own detection rule and explain what it catches is immediately more credible than the person who lists Security+ and a degree and nothing else.

The Market Right Now

CyberSeek, the workforce analytics tool maintained by CompTIA and NIST, tracks 514,359 cybersecurity job listings over the past 12 months, a 12% increase year over year. The supply-demand ratio sits at 74%, meaning roughly 265,000 more cybersecurity workers are needed than the current pipeline can produce. The gap is not theoretical. Companies are feeling it directly in time-to-fill metrics that keep stretching, requisitions that sit open for three months while the existing SOC team absorbs the extra coverage and slowly burns through whatever goodwill remains.

The 2025 ISC2 Cybersecurity Workforce Study, based on survey data from 16,029 cybersecurity professionals globally, found that 59% report critical or significant skills shortages within their teams, up from 44% the previous year. That’s not a hiring volume problem. That’s a skills mismatch. Companies have headcount approval but can’t find people with the right combination of technical ability and operational experience. We see this reflected in our own requisitions. Clients open a Tier 2 SOC analyst role expecting a two-month fill. Six weeks in, they’ve interviewed four candidates and none could walk through an incident response scenario convincingly. The candidates exist. They’re employed. Somewhere. Not looking. And the candidates who are actively on the market tend to have the certs stacked up but not the real incident hours. There’s a big difference between someone who can explain MITRE ATT&CK in an interview and someone who has mapped an actual intrusion to it at 2am on a Saturday while the CISO is calling every ten minutes asking if the bleeding has stopped.

For our deeper analysis of compensation trends across the cybersecurity field, see our cybersecurity salary guide.

AI in the SOC: Replacement or Relief?

Every SOC analyst we talk to has an opinion about this. Will AI automate their job away? Short version: not yet. Longer version: AI is changing the shape of the work without eliminating the need for humans.

28% of cybersecurity professionals have already folded AI tools into their daily operations, per the 2025 ISC2 study, and 70% are chasing AI qualifications of some kind. What we’re seeing on the ground: SOAR platforms with AI-driven playbooks are eating the repetitive Tier 1 work. Auto-closing the obvious false positives. Enriching alerts before a human ever touches them. Surfacing the five events out of a thousand that actually need a brain.

That’s good for analysts. The garbage work shrinks. But it also changes what “entry level” means. Tier 1 as a purely manual alert clicking job? That version is disappearing. The entry-level SOC analyst in 2028 is going to spend more time babysitting automated playbooks and validating AI-generated findings than personally triaging every alert. The job count isn’t dropping. The job description is rewriting itself. If you’re getting into this field right now, don’t stop at learning the SIEM. Get your hands on a SOAR platform. Understand how playbooks get built, where they break, what they can’t handle. Two years from now, the entry-level analyst who can troubleshoot an automated workflow that stopped enriching alerts at 3am is going to be worth three of the analysts who can only triage manually.

Common Questions About SOC Analyst Careers

So what exactly does a SOC analyst do all day?

Completely depends on which tier you’re working, and even within the same tier the day looks different depending on whether you’re at a Fortune 500 with a 30-person security team or an MSSP monitoring 40 clients from one console. A Tier 1 analyst spends roughly 70% of their shift monitoring SIEM alerts, checking indicators of compromise against threat intel feeds, and documenting findings in ticketing systems. The other 30% is coordination, following up on escalations, attending shift handoffs, and updating runbooks. Tier 2 and Tier 3 look completely different. More investigation, more tool building, less routine monitoring. For a deeper look at the broader information security analyst role, see our information security analyst career guide.

Do SOC analysts actually get paid well?

Average across ZipRecruiter and Glassdoor lands right around $99K to $100K. Senior roles push past $140K. But averages lie, or at least they omit. Entry-level? $57K to $76K. Your first year at Tier 1 will feel underpaid relative to the stress level and the shift work. That changes at Tier 2. The jump from mid-$70s to six figures happens fast once you’ve got incident response time on your resume. Someone who goes all the way to security architecture or CISO? $200K plus. Compared to software engineering, the education bar is lower and the pay trajectory per year of experience is arguably steeper, especially in the middle of the career arc.

Which certifications should I get first?

Security+ first. Always. It’s the universal baseline, it satisfies government contract requirements, and it costs $400. CySA+ second if you’re going the SOC route specifically. After that it depends on direction. GSOC if your employer will pay for it. GCIH if you want to specialize in incident response. CISSP only makes sense after five years because the experience requirement is built into the certification itself. Don’t chase certifications for the sake of collecting them. Two or three that align with your target tier are worth more than six that scatter across unrelated domains.

Realistically, can I break into SOC work with no IT background?

Yes but it requires intentional preparation. The most reliable path we’ve seen: earn Security+, build a home lab running a SIEM with simulated attack traffic, and apply to Tier 1 roles at MSSPs. MSSPs are where career changers should look first. They churn through Tier 1 analysts, which sounds bad and kind of is, but it also means they’ve built the onboarding playbooks and training pipelines to get someone productive in weeks instead of months. In-house enterprise SOCs rarely have that infrastructure built out. They want someone who already knows the SIEM, already knows the EDR platform, and can contribute in week one, which creates the classic catch-22 where you need experience to get the job but need the job to get experience, and MSSPs are the side door that breaks that loop. Some of our strongest placed candidates came from military intelligence, help desk support, and network administration backgrounds. Zero-to-SOC in under a year is realistic if you’re focused.

Is it too late to switch into cybersecurity at 30 or 35?

We placed a SOC analyst last year who spent ten years teaching high school math before she got Security+ and pivoted. She’s at Tier 2 now. We’ve also placed analysts who made the switch in their mid-30s after careers in accounting, education, and military service. Cybersecurity has a 265,000-person workforce gap in the US alone. Nobody in a hiring position is turning away qualified candidates because they didn’t start at 22. Honestly? The professional maturity helps. A 34-year-old who spent a decade managing classrooms or balancing ledgers can write an incident report that the CFO actually reads. That sounds trivial until you’ve worked with a brilliant 24-year-old analyst whose incident summaries read like Discord messages and the executives have no idea what happened or whether they should be worried.

Can SOC analysts work remotely?

Some. Not most. It comes down to what you’re monitoring. If the SOC handles classified systems or sits inside a government contractor’s SCIF, you’re on-site. Period. Banks and healthcare orgs with strict data handling rules usually want hybrid at minimum. MSSPs are the most remote-friendly because the monitoring infrastructure is already cloud-based and the client data access is handled through VPNs and jump boxes rather than physical presence. The trade-off: remote SOC roles pay $10K to $15K less than the equivalent on-site gig. The employer pool goes national, which means you’re competing with analysts from lower cost-of-living markets, and the salary adjusts accordingly. Some people gladly take that deal. Others decide the commute is worth the extra money.

What’s the difference between a SOC analyst and a cybersecurity analyst?

“Cybersecurity analyst” is the umbrella. SOC analyst sits underneath it, specifically covering real-time monitoring, detection, and incident response inside a security operations center. But the umbrella also covers vulnerability management, GRC, compliance auditing, security architecture, risk assessment. Totally different jobs that share a keyword. The job boards can’t tell them apart, which is part of why salary data for “cybersecurity analyst” is so noisy. When we get a req for “cybersecurity analyst,” first thing we do is ask whether it’s SOC work or not. Half the time it is. The other half it’s a compliance role or vuln management gig with basically zero overlap, and the hiring manager gets annoyed that we’re asking because they assumed the title spoke for itself. Spoiler: never does.

Is SOC analyst a good starting point for a cybersecurity career?

Probably the best one going. Ask ten CISOs where they started and eight of them will say some version of a SOC, a help desk, or the military. The SOC specifically throws everything at you. Networking. Logging. Attack patterns. Incident response procedures. Tool sprawl. Shift work. Politics between security and engineering teams. You learn more in 18 months of Tier 1 SOC work than most cybersecurity degree programs cover in four years. I’m slightly exaggerating. Only slightly. The burnout risk is real and we’ve talked about it at length. But as a place to start a career in security? Nothing else gives you that breadth of exposure that fast.

Ready to explore SOC analyst roles or need help staffing your security operations team? Talk to our cybersecurity recruiting team about current openings and market conditions.