Skip to content
Back to home
2025-07-13Security Fundamentals4 min read

SOC — The Defenders

A breakdown of what a Security Operations Center actually does — who's on the team, the roles from L1 analyst to SOC manager, and what it means to be responsible for defending an organization's digital infrastructure.

Hello everyone, this post is especially about Security Operations Center (SOC). As an aspiring SOC Analyst, I would like to break down some basic concepts like:

  • Who are we?
  • What do we do?
  • What are the roles available in a SOC?
  • What is our responsibility and how we are responsible?

It is crucial to understand these as a one who has a yearning heart to make a career in SOC. Let's talk about one by one..

Who are we?

We, the SOC, are the Defenders of digital world.

SOC is a centralized team within an organization employing people, processes and technology to continuously monitor and improve an organization's security posture.

SOC comes under Blue team in Cyber Security.

When a company has recorded that there was no breach happened, there would be a well-organized SOC Team who are working 24/7.

What do we do?

SOC Teams perform various works.

We monitor alerts, trigger incidents, detect malware, analyze logs and prevent the digital world from the Cyber attacks.

Let's see much deeper about each..

  • Monitoring real-time security events from across networks, servers and endpoints.
  • Investigating suspicious behaviors or alerts.
  • Responding to potential threats like malware, phishing or data breaches.
  • Documenting incidents and supporting incident response teams.

What are the roles available in a SOC?

As I mentioned, a SOC is not just a single person—it is a team with clearly defined roles. Some of the common roles:

  • Level 1 Analyst (L1): Monitors alerts and triggers basic threats. L1 are really the front-line defenders.
  • Level 2 Analyst (L2): Investigates more complex issues and takes action.
  • Level 3 Analyst (L3): Handles advanced threats and fine-tunes detection systems.
  • SOC Engineer: Maintains security tools and supports automation.
  • Threat Hunter: Proactively searches for hidden threats.
  • SOC Manager: Leads the team and oversees strategy and reporting.

What is our responsibility and how we are responsible?

As a SOC team, we need a great vision to securely protect our digital infrastructure.

We should be:

  • Watchful against cyber attacks
  • Responding quickly and appropriately when there is a security incident
  • Preparing of incident reports and raising threats when necessary
  • Regularly updating our understanding and enhancing security mechanisms.

It is our duty to make sure the organization's digital assets are properly secured and this requires some level of technical ability as well as keen insight.

I'm just beginning this journey and I look forward to learning more, sharing insights and connecting with fellow learners. Let's protect, detect and defend—together.