What a security operations centre does
In short: A security operations centre (SOC) monitors an organisation for signs of attack and leads the response when something is found. It combines skilled analysts, documented processes and tools such as SIEM and EDR, and can be run in-house, outsourced or as a hybrid.
What a SOC is for
Prevention eventually fails: a user clicks a link, or a new flaw appears before a patch. A security operations centre (SOC) is the team and function that detects attacks, investigates them and responds quickly to limit damage. In NIST CSF 2.0 terms, the SOC does most of the Detect and Respond work. It may be a large room with screens, a small team, or a fully remote service.
People and tiers
- Tier 1 analysts watch the alert queue, check whether alerts are genuine, gather basic context and escalate. It is the most common entry role into cyber security.
- Tier 2 analysts investigate escalated incidents, work out scope and start containment, such as isolating a laptop or disabling an account.
- Tier 3 specialists handle complex cases, hunt proactively for hidden threats, analyse malware and support digital forensics.
- Detection engineers write and tune the rules that create alerts; SOC managers look after staffing, quality and reporting.
Many SOCs now use a more flexible "pod" model where analysts own cases end to end, with automation handling much of the old tier 1 work. The idea of escalating to deeper expertise remains.
Process and technology
Good SOCs run on documented process: playbooks for common incident types (phishing, malware, suspicious logins), clear escalation paths, shift handovers and a link to the wider incident response plan. Guidance such as NIST SP 800-61 Revision 3 describes how incident response fits into overall risk management.
| Technology | Role in the SOC |
|---|---|
| SIEM (security information and event management) | Collects logs from many sources, correlates them and raises alerts |
| EDR / XDR (endpoint, extended detection and response) | Watches device activity and can isolate hosts |
| SOAR (security orchestration, automation and response) | Automates repetitive steps in playbooks |
| Threat intelligence platform | Adds context about known attackers and indicators |
| Case management | Tracks incidents, evidence and actions |
Useful measures include mean time to detect (MTTD), mean time to respond (MTTR), the false positive rate and detection coverage against frameworks such as MITRE ATT&CK.
In-house, outsourced or hybrid
| Model | Advantages | Drawbacks |
|---|---|---|
| In-house SOC | Deep knowledge of the business; full control | Expensive; hard to staff around the clock |
| Managed security service provider (MSSP) or managed detection and response (MDR) | 24/7 cover; experienced staff; faster start | Less business context; quality varies; response may be limited |
| Hybrid | Provider covers nights and volume; internal team handles context and decisions | Needs clear division of responsibilities |
Small and medium organisations often choose MDR; larger ones frequently run a hybrid. Whatever the model, someone inside the organisation must own security decisions and know how to reach the provider in an emergency.
Tip: to prepare for a tier 1 role, practise reading Windows and Linux logs, analysing phishing emails and writing clear incident notes. A SOC home lab is a strong portfolio piece.
Real-world example: a hybrid SOC for a group of schools
A fictional trust running eight secondary schools has a three-person IT security team that works office hours. Attacks, however, often happen at night and during holidays. The trust signs a contract with a managed SOC provider that watches its SIEM and EDR alerts around the clock and handles first-level triage. The provider may isolate a laptop on its own, but must phone the trust's on-call manager before disabling any staff account. During the summer break the provider spots a teacher's account signing in from abroad minutes after a phishing email, isolates the session, and the trust's team completes the investigation the next morning. The in-house team keeps ownership of decisions and school context, while the provider supplies the out-of-hours eyes.
Practice
What is the main job of a tier 1 SOC analyst?
What does a SIEM do?
Give one advantage and one drawback of an outsourced MDR service.
Key takeaways
- A SOC detects, investigates and responds to security incidents.
- Analysts are often organised in tiers, with escalation to deeper expertise.
- Playbooks and clear processes make response consistent.
- Core tools include SIEM, EDR or XDR, SOAR and case management.
- SOCs can be in-house, outsourced (MSSP or MDR) or hybrid.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.