TL;DR: SOC hiring rewards demonstrable triage skill over cert counts: read logs fast, write clear tickets, know the network and Windows basics cold. Security+ gets interviews; a home lab and a ticket-writing habit get offers. Expect tier 1 alert work first, tier 2 investigation within 12 to 18 months of focused effort.
What a SOC analyst actually does
Tier 1 is alert triage around the clock: a queue of SIEM alerts, each needing a verdict (true positive, false positive, benign true) plus a ticket the next person can act on. Tier 2 takes the confirmed incidents: deeper log correlation across sources, containment actions, escalation write-ups, and occasional threat-hunt tasks. Both tiers live in the same tools (SIEM, EDR console, ticket queue, threat intel feeds) and both are judged on the same two outputs: correct verdicts and readable documentation. Nobody hires "passion for cybersecurity." They hire verdicts and tickets.
The skill stack in hiring order
- TCP/IP and ports cold. You cannot triage a firewall deny you cannot read. Our port cheat sheet is day-one material for a reason.
- Log reading speed. Firewall, proxy, authentication, DNS, endpoint: the five log types behind most alerts. Practice correlating three sources on one host before calling anything a finding, as the CySA+ study plan teaches.
- Windows and AD basics. Logon types, Kerberos flow, service accounts, common event IDs. Most enterprise alerts involve a Windows host; guessing at Windows slows every investigation.
- Linux basics. Enough to read your own tooling and pivot through logs on sensors. The Linux cheat sheet covers the working set.
- Ticket writing. Evidence, verdict, confidence, next step, in that order. Hiring managers routinely say a clear writing sample outweighs one more cert line.
- Framework vocabulary. MITRE ATT&CK tactics, the incident response order, kill-chain phases. These are communication tools: they let your ticket say "credential access via brute force" instead of a paragraph.
Certs that matter, in order
Security+ first: it is the HR filter for most tier 1 postings and teaches the vocabulary everything else assumes. Our Security+ study plan fits it around a job. Next, either CySA+ (analyst tradecraft, log-heavy, closest to the daily work) or a network cert if networking is your weak side. After a year in-seat, Splunk or vendor SIEM credentials and then GCIA-style analysis training carry more weight than collecting more entry certs. One honest rule: no cert substitutes for a lab you can demo. "Walk me through your home lab" ends more interviews than any acronym.
What tier 1 does not do (boundary clarity)
Tier 1 does not redesign networks, approve firewall changes, reverse malware, or declare incidents closed alone. Knowing the boundary protects you: escalate with evidence instead of improvising containment, propose rule changes instead of making them, and write "recommend tier 2 review" without shame. Interviewers probe this with "what would you do if" scenarios that exceed tier 1 authority; the winning answer names the playbook step, the escalation point, and the ticket contents, in that order. Ambition shows in ticket quality and lab depth, never in cowboy actions on production systems.
The 12-month plan
Months 1 to 3: Security+ study plus daily log exposure. Read one public breach report a week and rewrite its timeline from the attacker's view; this builds the correlation habit before you own any tooling. Months 4 to 6: build the lab (a SIEM trial or Security Onion, two victim VMs, an attacker VM), generate traffic, break things, write tickets for your own findings. Months 7 to 9: apply broadly while doing CySA+-level study; tailor each application with one lab story told as evidence, verdict, action. Months 10 to 12: in-seat or still hunting, publish two write-ups (a lab investigation, a tool comparison) so future applications link proof instead of claiming skill. The study mistakes guide warns off the traps that stretch this timeline (passive video watching, cert collecting without labs).
A week in tier 1 (so the job is concrete)
Monday starts with queue triage: overnight firewall denies, a cluster of failed logons on one service account, two phishing submissions from users. You verdict each (scan noise, possible brute force worth escalating, actual phish needing mailbox rules), ticket each, and hand the service-account case to tier 2 with corroborating logs attached. Midweek brings an EDR malware alert you contain per playbook (isolate host, collect hashes, confirm scope) and a false-positive tuning request you document with numbers (this rule fired 400 times, zero true). Friday is shift handover notes and one improvement: a detection tweak, a runbook correction, a short write-up. The variety is the appeal and the grind: same tools daily, different puzzle each queue.
The home lab in one weekend
Two victim virtual machines (one Windows, one Linux), one attacker VM, and a free SIEM or Security Onion sensor watching the virtual network. Generate attacks from the lab's own tools (an Nmap scan, a brute-force attempt with Hydra against a test account, a simulated phish click opening a harmless payload), then find each in the logs and write the ticket. Total cost is a laptop with enough RAM and a weekend. Interview value is outsized: "show me" beats "tell me" every time, and every alert you triage in the lab rehearses the tier 1 queue. Keep the lab running into your first role; it becomes the safe place to test ideas you would never try in production.
Shifts, pay talk, and honest downsides
SOC work means shifts, including nights and weekends at tier 1, and alert fatigue is real: most alerts are noise, and staying sharp through noise is the job skill nobody lists. Pay varies widely by city, sector, and clearance; compare live postings in your market rather than trusting national averages quoted in articles. The upside is concrete: tier 1 to tier 2 is the fastest skill jump in security, incident experience compounds, and on-call pain converts directly into the stories that win tier 2 and IR roles. Go in clear-eyed about the shifts and the queue, and the path pays off.
Interview prep that works
Expect a log sample ("what do you see here"), a scenario ("impossible travel plus a new mail rule, walk me through it"), a networking question (ports, DNS, DHCP behavior), and "tell me about your lab." Answer logs out loud in order: timeframe, entities, anomaly, corroboration, verdict, next step. Bring one printed redacted ticket or write-up; interviewers remember artifacts. Review the practice-test strategy guide for the timed-question habits that transfer to technical screens.
The role is learnable, and the fastest way to prove you can do it is to work a queue. If you want to compare what the SOC-adjacent lab platforms actually grade, the CySA+ resources comparison covers the options honestly, including the ones that are better than ours at open-ended investigation.
Sources
- NICE cybersecurity workforce framework
- CompTIA Security+ certification page
- MITRE ATT and CK knowledge base
By SecLern Editorial. Published October 18, 2026. Updated October 18, 2026. Role descriptions reflect standard tier 1 and tier 2 SOC structures; no salary figures are quoted because they vary by market and date quickly.