What Is a Security Operations Center (SOC)? Roles, Tiers and In-House vs Outsourced
What a SOC does, the roles and tiers inside one, the tools it relies on and how to choose between building in-house, outsourcing to MDR or a hybrid model.
A security operations center (SOC) is the team, processes and tools that monitor an organization's systems around the clock, investigate alerts and respond to cyber threats. Analysts work in tiers, from alert triage to deep investigation and threat hunting, using tools such as SIEM and EDR. Most small and midsize businesses get SOC coverage through managed detection and response (MDR) instead of building one.
Photo: Unsplash
On this page
Your security tools generate alerts all day and all night. A login from an unusual country. A laptop running a suspicious PowerShell command. A mailbox suddenly forwarding messages to an outside address. Each alert might be nothing, or it might be the first hour of a ransomware attack.
The question isn’t whether you have security tools. It’s whether anyone is watching them at 3 a.m. on a Sunday and knows what to do next. That’s the job of a security operations center, or SOC.
This guide explains what a SOC does, who works in one, how the tiers fit together and how to decide whether to build your own, outsource it or do a bit of both.
What a SOC is
A security operations center (SOC) is a centralized function that continuously monitors an organization’s environment, detects threats, investigates suspicious activity and coordinates the response. “SOC” can mean a physical room full of screens, but today it more often means a team and a set of processes, whether they’re in your office, remote or provided by a vendor.
In the NIST Cybersecurity Framework 2.0, released in 2024, the core is organized into 6 functions: Govern, Identify, Protect, Detect, Respond and Recover. A SOC lives mainly in Detect and Respond, while feeding lessons back into the others. See our guide to the NIST Cybersecurity Framework for the full picture.
MITRE’s free book 11 Strategies of a World-Class Cybersecurity Operations Center (second edition, 2022) is one of the most widely cited references on how SOCs are organized. It’s written for everyone from new analysts to managers planning to expand a SOC’s capabilities.
What a SOC actually does
Day to day, a SOC handles a predictable set of jobs:
- Monitoring: watching alerts from security tools across endpoints, networks, cloud, email and identity systems.
- Triage: deciding quickly whether an alert is a false positive, a low-risk issue or a real incident.
- Investigation: digging into confirmed alerts to understand scope, affected accounts and attacker activity.
- Response: isolating devices, disabling accounts, blocking IP addresses and coordinating with IT.
- Threat hunting: proactively searching for attackers who haven’t triggered alerts.
- Detection engineering: writing and tuning the rules that generate alerts, so analysts aren’t buried in noise.
- Reporting: tracking metrics such as time to detect and time to respond, and briefing leadership.
- Vulnerability and threat intelligence support: helping prioritize patches and watching for threats aimed at your industry.
Key takeaway: A SOC isn’t a tool you buy. It’s people following tested processes, using tools, 24 hours a day. If no one acts on alerts, you don’t have a SOC; you have a log collection system.
SOC roles and tiers
Many SOCs organize analysts into tiers so simple alerts are handled quickly and complex incidents get senior attention.
| Tier or role | Main job | Typical tasks |
|---|---|---|
| Tier 1: triage analyst | First look at every alert | Validate alerts, close false positives, escalate real issues, follow runbooks |
| Tier 2: incident responder | Investigate escalated alerts | Determine scope, contain threats, coordinate with IT, document findings |
| Tier 3: threat hunter or senior analyst | Find what tools miss | Hunt for hidden attackers, analyze malware, lead major incidents, tune detections |
| Detection engineer | Build and improve detections | Write SIEM rules, reduce false positives, map coverage to attacker techniques |
| SOC manager | Run the operation | Staffing, shift schedules, metrics, escalation to leadership |
| Security leader (CISO or equivalent) | Own security strategy | Budget, risk decisions, communication with executives and the board |
These roles map closely to the NICE Workforce Framework (NIST SP 800-181 Revision 1), which describes work roles such as Defensive Cybersecurity, focused on analyzing data from defensive tools and escalating incidents, and Incident Response, focused on investigating, analyzing and responding to incidents. If you’re considering a career in this area, our guide to tech skills in demand covers the wider job market.
Some modern SOCs flatten the tiers, giving every analyst end-to-end ownership of an alert, with automation handling the repetitive Tier 1 work. Both models can work; what matters is clear escalation paths.
The tools a SOC depends on
A SOC is only as good as its visibility. Common tool categories include:
- SIEM to collect and correlate logs from across the business. See our explainer on SIEM.
- EDR or XDR on endpoints and servers to detect malicious behavior and isolate devices. Compare options in EDR vs antivirus.
- SOAR (security orchestration, automation and response) to automate routine steps such as enriching alerts or disabling accounts.
- Identity and email security tools to catch account takeovers and phishing.
- Threat intelligence feeds for known malicious domains, IPs and attacker techniques.
- Case management or ticketing to track every investigation.
In-house vs outsourced SOC
This is the decision most growing companies face. A 24/7 SOC needs enough analysts to cover nights, weekends, holidays, vacations and sick days, plus tools and ongoing training. For most organizations without a large security budget, that’s hard to justify.
| Model | How it works | Strengths | Trade-offs | Typical fit |
|---|---|---|---|---|
| In-house SOC | Your own staff and tools, 24/7 | Deep knowledge of your business, full control | Highest cost, hard to hire and retain, 24/7 staffing is demanding | Large enterprises, highly regulated organizations |
| Managed detection and response (MDR) | Vendor monitors your tools (often their own EDR) and takes response actions | 24/7 coverage, fast setup, response included | Less customization; depends on vendor’s tool stack | Small and midsize businesses |
| Managed security service provider (MSSP) | Vendor monitors logs and devices, often alert-focused | Broad device coverage, compliance reporting | Response may be limited to notifying you | Organizations needing log monitoring and compliance |
| SOC-as-a-service | Subscription SOC, often built around a SIEM | Predictable subscription pricing, scalable | Quality varies widely by provider | Midsize companies with existing tools |
| Hybrid or co-managed | Your team works business hours; provider covers nights and escalations | Balance of control and coverage | Needs clear handoffs and shared runbooks | Companies with a small security team |
Pricing: Providers commonly price per endpoint, per user, per data volume ingested or as a flat subscription. Prices vary widely by scope and response level, so compare quotes on what’s actually included, not headline numbers. Our guide on how much cybersecurity costs for a small business explains typical budget categories.
Questions to ask an outsourced SOC or MDR provider
- Will you take action, or only alert us? Ask exactly which response actions they can take without approval, such as isolating a laptop or disabling an account.
- What’s covered? Endpoints only, or also Microsoft 365, Google Workspace, cloud, firewalls and identity?
- Who’s watching at night? Is coverage truly 24/7/365, with analysts in-house rather than subcontracted?
- How fast do you respond? Ask for written response time commitments by severity.
- What happens in a major incident? Is incident response or digital forensics included, or billed separately?
- Who owns the data and logs? Can you export them if you leave?
- What reports do we get? Monthly summaries, compliance evidence and executive briefings?
- Do you work with our insurer? Some cyber policies have preferred vendors.
Where to start
- Map your basics first. Make sure you have MFA, EDR on every device, and logs from email and identity. A SOC can’t watch what you don’t collect.
- Decide who responds today. Even without a SOC, name the person who acts on alerts and their backup, and put it in your incident response plan.
- Choose a model. For most businesses under a few hundred employees, MDR or co-managed coverage is the realistic starting point.
- Define authority. Agree in writing what the provider or internal team may do without asking, such as isolating devices after hours.
- Run a test. Use a tabletop exercise to walk through an alert from detection to response with your provider.
- Review monthly. Track alerts, response times and recurring issues, and tune detections to cut noise.
The bottom line
A SOC is the team and process that turns security alerts into action, day and night. Large organizations often build their own, but most small and midsize businesses get better coverage, faster, through MDR or a co-managed arrangement. Whatever you choose, make sure someone has the authority and the runbook to act at 3 a.m.
Sources
- MITRE: 11 Strategies of a World-Class Cybersecurity Operations Center — SOC organization and strategy reference
- NIST: NIST Releases Version 2.0 of Landmark Cybersecurity Framework — CSF 2.0 functions including Detect and Respond
- NICCS: Defensive Cybersecurity NICE Framework work role — analyst role description
- NICCS: Incident Response NICE Framework work role — incident responder role description
- NIST SP 800-181 Revision 1, Workforce Framework for Cybersecurity — NICE Framework structure
Frequently asked questions
What does a SOC analyst do?
A SOC analyst monitors security alerts, decides which ones are real threats and escalates or responds to them. Tier 1 analysts focus on triage and following runbooks. Tier 2 analysts investigate confirmed incidents and help contain them. Tier 3 analysts hunt for hidden threats, analyze malware and lead major incidents. Many also tune detection rules to reduce false alarms.
What is the difference between a SOC and a SIEM?
A SIEM is a tool, while a SOC is a team and process. The SIEM collects and correlates logs and generates alerts. The SOC is the group of people who review those alerts, investigate them and respond. A SIEM without a SOC produces alerts no one acts on, and a SOC without good tools lacks visibility.
Does a small business need a SOC?
Most small businesses need SOC-style coverage, meaning someone watching for and responding to threats around the clock, but not their own SOC. Building one requires enough staff to cover nights and weekends, plus tools and training. Managed detection and response (MDR) or a co-managed service is usually the practical and more affordable way to get that coverage.
What is the difference between MDR and an MSSP?
MDR providers focus on detecting and actively responding to threats, often using their own endpoint tools, and can take actions such as isolating devices. MSSPs traditionally monitor logs and security devices more broadly and may only notify you of issues. The lines have blurred, so ask any provider exactly which response actions they take on your behalf.
How much does an outsourced SOC cost?
Costs vary widely depending on the number of endpoints and users, data volume, coverage scope and whether incident response is included. Providers commonly price per endpoint, per user, by data ingested or as a flat subscription. Compare quotes based on what's included, such as 24/7 coverage, response actions and cloud monitoring, rather than headline prices alone.
What are the tiers in a security operations center?
Most SOCs use 3 tiers. Tier 1 analysts triage incoming alerts and close false positives. Tier 2 analysts investigate escalated incidents and contain threats. Tier 3 analysts handle advanced investigations, threat hunting and detection tuning. Supporting roles include detection engineers, a SOC manager and a security leader. Some modern SOCs flatten tiers and use automation for Tier 1 work.
Is a SOC the same as a NOC?
No. A network operations center (NOC) monitors performance and availability, keeping networks and systems up and running. A SOC monitors security, looking for threats and attacks. They often share tools and work closely, especially during outages that might be attacks, but their goals, skills and metrics are different. Some smaller providers offer both services together.
Was this guide useful
No reviews yet. Share your experience and help other readers.
Write a review
Manishdai
Manishdai writes about the technology that is reshaping every industry — from AI agents and cloud platforms to healthtech, fintech and the IT companies building it all across the United States.
manishdai.com