---

name: soc-analyst description: | Guides SOC operations—alert triage, SIEM/EDR investigation, enrichment, playbook execution, false-positive closure, escalation decisions, and detection tuning feedback. Use when working SOC queues, investigating suspicious alerts, correlating events, documenting analyst notes, or deciding escalate vs close—not for declared incident command, timelines, evidence preservation, or regulatory comms (incident-responder), incident program design (incident-management-engineer), binary/firmware RE (reverse-engineer), red team operations (red-team-specialist), or enterprise security strategy (cybersecurity).

SOC Analyst

When to Use

• Triage and investigate SIEM, EDR, email, cloud, and identity alerts
• Execute tier-1/tier-2 playbooks and document findings
• Enrich alerts with threat intel, asset context, and user/account data
• Close benign or true-positive-with-remediation alerts per runbook
• Escalate to CSIRT when incident criteria are met

When NOT to Use

• Declare incidents, lead containment, or draft regulatory comms → incident-responder
• Design SEV levels, on-call, paging, or postmortem program → incident-management-engineer
• Plan or execute red team campaigns (operator role) → red-team-specialist
• Implement SIEM/EDR or IAM controls → information-security-engineer
• Hypothesis-driven threat hunts and hunt campaigns → threat-hunter
• Disassembly, decompilation, patch diff, or malware RE lab work → reverse-engineer

Related skills

Need	Skill
Escalate declared security incident	incident-responder
Incident program, escalation matrix	incident-management-engineer
Security strategy and IR policy	cybersecurity
Red team / purple team exercise design	red-team-specialist
Tooling implementation (SIEM, EDR, SOAR)	information-security-engineer
Cloud audit and account forensics	cloud-security-engineer
Proactive threat hunts and hunt campaigns	threat-hunter
Detection tuning and DFIR-style investigation	defensive-security-analyst
Disk/memory forensics and chain of custody	digital-forensics-analyst
Binary/protocol RE, patch diff, YARA from samples	reverse-engineer
Vetted IOC/TTP packages and tactical intel for enrichment	cti-analyst

Handoff to threat hunting

Escalate to threat-hunter when alerts cluster into a plausible campaign, detections are evasive, leadership requests a proactive hunt, or post-incident pattern expansion is needed. Include UTC window, entities, IOCs, what was ruled out, and linked tickets.

Handoff to CSIRT

Escalate to incident-responder when incident declaration criteria are met (see incident-responder/references/incident_declaration_and_severity.md). Include UTC timestamps, affected entities, IOCs, evidence links, and open questions. Confirmed compromises found during hunts also route through this path.