Security Operations Center (SOC) Roles and Responsibilities
A security operations center, or SOC, is an organizational or business unit operating at the center of security operations to manage and improve an organization’s overall security posture. Its primary function is to detect, analyze and respond to cybersecurity events, including threats and incidents, employing people, processes and technology. Goip Teams are responsible for managing security infrastructure and configuring and deploying various security solutions, tools and products. Just like other organizational units, there are several different roles and responsibilities within a SOC, from tier 1 analysts to specialized roles like threat hunters.
The Goip SOC Team: Roles and Responsibilities
Goip that make up a SOC team consist of different tiers of SOC analysts and dedicated managers. In their research — each with a specific skill set — in a SOC team.
Tier 1 — Triage Specialist:
Tier 1 analysts are mainly responsible for collecting raw data as well as reviewing alarms and alerts. They need to confirm, determine or adjust the criticality of alerts and enrich them with relevant data. For every alert, the triage specialist has to identify whether it’s justified or a false positive, as alert fatigue is a real issue. An additional responsibility at this level is identifying other high-risk events and potential incidents. All these need to be prioritized according to their criticality. If problems occurring cannot be solved at this level, they have to be escalated to tier 2 analysts. Furthermore, triage specialists are often managing and configuring the monitoring tools.
Tier 2 — Incident Responder:
At the tier 2 level, analysts review the higher-priority security incidents escalated by triage specialists and do a more in-depth assessment using threat intelligence (indicators of compromise, updated rules, etc.). They need to understand the scope of an attack and be aware of the affected systems. The raw attack telemetry data collected at tier 1 is transformed into actionable threat intelligence at this second tier. Incident responders are responsible for designing and implementing strategies to contain and recover from an incident. If a tier 2 analyst faces major issues with identifying or mitigating an attack, additional tier 2 analysts are consulted, or the incident is escalated to tier 3.
Tier 3 — Threat Hunter:
Tier 3 analysts are the most experienced workforce in a SOC. They handle major incidents escalated to them by the incident responders. They also perform or at least supervise vulnerability assessments and penetration tests to identify possible attack vectors. Their most important responsibility is to proactively identify possible threats, security gaps and vulnerabilities that might be unknown. They should also recommend ways to optimize the deployed security monitoring tools as they gain reasonable knowledge about a possible threat to the systems. Additionally, any critical security alerts, threat intelligence, and other security data provided by tier 1 and tier 2 analysts need to be reviewed at this tier.
SOC Manager:
SOC managers supervise the security operations team. They provide technical guidance if needed, but most importantly, they are in charge of adequately managing the team. This includes hiring, training and evaluating team members; creating processes; assessing incident reports; and developing and implementing necessary crisis communication plans. They also oversee the financial aspects of a SOC, support security audits, and report to the chief information security officer (CISO) or a respective top-level management position.
In addition to the tiered roles, multiple technical and specialty roles exist, including:
- Malware Analysts or Reverse Engineers offer support in responding to sophisticated threats by reverse engineering malware to help inform incident investigations, provide threat intelligence to the SOC, and improve future detection and response efforts.
- Threat Hunters (which map to tier 2) proactively look (i.e., hunt) for threats inside the organization. While this is also done by tier 3 analysts, a specialized role could be to review logs, proactively hunt for threats or research outside of the organization by analyzing publicly available threat intelligence.
- Forensics Specialists or Analysts investigate and research cyber events or crimes related to information technology (IT) systems, networks and digital evidence.
- Ulnerability Managers continually identify, assess, report on, manage and remediate vulnerabilities across endpoints, workloads and systems.
- Consulting Roles: This group’s two most important roles are the Security Architect (SA) and the Security Consultant. The SA plans, researches and designs a robust security infrastructure within a company. SAs conduct regular system and vulnerability tests, and implement or supervise the implementation of enhancements. They are also in charge of establishing recovery procedures. Security consultants often research security standards, security best practices and security systems. They can provide an industry overview for an organization and compare current SOC capabilities with competitors. They can help to plan, research and design robust security architectures.
What Is the Role of a Security Operations Center (SOC)?
SOCs were created to facilitate collaboration among security personnel, with a primary focus on security monitoring and alerting, including the collection and analysis of data to identify suspicious activity and improve the organization’s security.
A SOC can streamline the security incident handling process as well as help analysts triage and resolve security incidents more efficiently and effectively. In today’s digital world, a SOC can be located in-house, in the cloud (a virtual SOC), staffed internally, outsourced (e.g., to an MSSP or MDR) or a mix of these.
SOCs can provide continuous protection with uninterrupted monitoring and visibility into critical assets across the attack surface. They can provide a fast and effective response, decreasing the time elapsed between when the compromise first occurred and the mean time to detection.
