SOC Roles and Responsibilities: Tier 1, 2 & 3 | Q-Sec

Technical review by Volodymyr Garbar, CISO & Tech Lead
Updated: 11 August 2026

In a common three-tier SOC model, Tier 1 analysts monitor and triage alerts, Tier 2 analysts investigate suspicious activity and coordinate incident response, and Tier 3 analysts handle complex cases, threat hunting, and detection improvement. A complete security operations team also needs clear ownership for detection rules, platforms, incident command, business decisions, and SOC management.

Tier 1, Tier 2, and Tier 3 are useful labels, but they are not a universal standard. The NICE Framework defines a work role as a grouping of work for which a person or team is responsible. One job can contain several work roles, and one role can be shared across several jobs. Define the work, decision rights, and handoffs before choosing titles.

What are the main roles and responsibilities in a SOC?

The main SOC roles cover alert triage, investigation, incident coordination, threat hunting, detection engineering, platform health, and operational management. The exact job titles vary. The responsibility and next decision should not.

System owners, IT operations, cloud teams, identity teams, legal, privacy, communications, and business leaders may sit outside the SOC. They still need named responsibilities when the response depends on their access, context, or authority.

Why do SOC tiers exist?

SOC tiers organize work by complexity, time sensitivity, and decision authority. Tiering can keep routine alerts moving while experienced analysts focus on cases that need broader access or specialist knowledge. The tier number should describe the next decision, not decorate a job title.

FIRST's current description of security operations centers identifies monitoring, detection, and event analysis as core SOC services, while incident and vulnerability services can vary. It does not require a three-tier structure. That makes Tier 1, Tier 2, and Tier 3 a design choice rather than a certification model.

A useful tier model has four working parts:

• Entry criteria: what type, severity, confidence, or complexity brings work to this tier.
• Decision rights: what the analyst can close, escalate, collect, change, or contain without further approval.
• Handoff record: what evidence, checks, context, and unanswered questions must travel with the case.
• Return path: how investigation findings improve Tier 1 guidance, detection logic, telemetry, and training.

What are Tier 1 SOC analyst responsibilities?

A Tier 1 SOC analyst is responsible for initial alert triage. The analyst decides whether the alert is expected, benign, duplicate, suspicious, or urgent according to documented criteria, then records the evidence and routes the work to the correct owner.

Typical Tier 1 responsibilities include:

• Monitor assigned alert and case queues during the covered hours.
• Confirm that the alert contains usable timestamps, entities, telemetry, and detection context.
• Add asset criticality, user identity, exposure, and recent-case context.
• Run approved checks and low-risk playbook steps.
• Separate known benign or duplicate activity from cases that need investigation.
• Create a clear case record with evidence, checks performed, current assessment, and next question.
• Escalate according to severity, confidence, asset importance, business impact, or playbook rules.
• Report missing telemetry, broken enrichment, unclear playbooks, and noisy detections to the correct engineering owner.

ROLE BOUNDARY: Tier 1 can do more when the analyst has the skills, access, and authority. The default role should not quietly include production rule changes, unapproved containment, deep forensics, or risk acceptance. Those activities need explicit ownership and review.

What are Tier 2 SOC analyst responsibilities?

A Tier 2 SOC analyst investigates alerts that remain suspicious after triage. The analyst develops and tests hypotheses, determines scope and likely impact, decides whether incident criteria are met, and coordinates the next technical actions.

• Correlate endpoint, identity, network, cloud, email, and application evidence.
• Build a timeline and identify affected accounts, hosts, workloads, data, and trust relationships.
• Test alternative explanations and record the evidence for and against each one.
• Estimate severity and confidence using business context, not only a tool score.
• Preserve evidence and maintain a case record that another responder can continue.
• Recommend containment and coordinate approved actions with system or incident owners.
• Escalate complex, high-impact, or unfamiliar activity to a senior specialist or incident-response lead.
• Give Tier 1 precise feedback and propose playbook or detection changes when the case exposes a gap.

The NICE Framework Incident Response work role covers investigating, analyzing, and responding to cybersecurity incidents. In practice, a Tier 2 job may perform only part of that work or may share it with a dedicated incident-response team.

What are Tier 3 SOC analyst responsibilities?

A Tier 3 SOC analyst handles cases that need advanced technical judgment, specialist analysis, or a new investigative path. Tier 3 often supports threat hunting and detection improvement, but the title is not automatically the same as threat hunter, malware analyst, or incident commander.

• Lead or advise on complex, novel, or high-impact investigations.
• Form threat-hunting hypotheses and search across multiple data sources.
• Perform advanced endpoint, network, cloud, identity, or malware analysis when the team has that specialty.
• Identify missing telemetry and behaviors that current detections fail to see.
• Work with detection engineers to design and test new analytics.
• Review difficult cases, mentor analysts, and improve investigative methods.
• Support major-incident technical decisions while the incident lead coordinates the wider response.

MITRE ATT&CK's threat-hunting and detection-engineering training separates hypothesis development, data requirements, collection gaps, analytic testing, hunting, and investigation. That is a useful reminder that senior analysis and detection work are related but still need named ownership.

How do Tier 1, Tier 2, and Tier 3 SOC roles differ?

Tier 1 qualifies the alert, Tier 2 investigates the case, and Tier 3 solves complex technical problems and feeds improvements back into the system. The comparison below focuses on outputs and decisions rather than seniority alone.

How do SOC tiers work together during an incident?

A good escalation moves evidence and a decision question forward. It should not send the same alert to a more expensive inbox with no added context. A typical path looks like this:

• Tier 1 validates the alert, adds asset and identity context, runs approved checks, and records why the case looks suspicious.
• Tier 2 builds a timeline, correlates related activity, identifies affected entities, and determines whether the incident criteria are met.
• The incident-response lead or authorized owner sets the response structure and approves containment according to the plan.
• Tier 3 or another specialist answers difficult technical questions, hunts for related activity, and tests whether the initial scope is complete.
• The detection engineer updates and tests alert logic. The platform engineer fixes missing or poor-quality telemetry.
• Tier 1 and Tier 2 receive updated guidance so the next similar case is handled with better evidence and less delay.

The Q-Sec guide to how a SOC detects and investigates cyberattacks explains the full process from telemetry onboarding through detection, triage, investigation, response, and feedback.

Who builds alert profiles and detection rules in a SOC?

A named detection engineer or detection owner should be accountable for alert profiles and detection rules. In a smaller SOC, a Tier 2 or Tier 3 analyst may fill that role. Tier 1 analysts provide essential feedback, but production changes should follow testing, peer review, version control, and an approved deployment process.

The SOC tools stack page explains the platforms analysts and engineers use. The role chart must still name who owns the data, logic, cases, and approved response actions inside those tools.

Which SOC roles sit outside the Tier 1, Tier 2, Tier 3 model?

The numbered tiers describe alert-handling depth. They do not cover every capability a security operations team needs. Depending on scope, the SOC may also need these roles inside the team or through a documented partner:

• SOC manager or service owner: staffing, service quality, priorities, training, measures, budgets, and stakeholder reporting.
• Shift lead: queue ownership, handovers, immediate escalation, analyst support, and quality checks during a shift.
• Detection engineer: the rule and analytic life cycle from requirements through testing and retirement.
• Platform engineer: log pipelines, connectors, parsing, data health, access, retention, and platform reliability.
• Incident responder or incident commander: incident declaration support, coordination, evidence, containment, communication, and recovery workstreams.
• Threat intelligence analyst: relevant actors, techniques, indicators, priorities, and intelligence requirements.
• Digital forensics or malware specialist: deep evidence and artifact analysis when the case justifies it.
• System, cloud, network, identity, and application owners: context, access, containment, remediation, and restoration for their environments.
• Legal, privacy, compliance, communications, and business owners: regulatory, contractual, customer, and risk decisions outside the SOC's technical authority.

FIRST's CSIRT Services Framework notes that vulnerability scanning and remediation often belong to other roles. Treat vulnerability assessment and penetration testing as explicit services, not automatic Tier 3 duties.

Which SOC tasks can be automated?

Repetitive steps can be automated when inputs, failure states, permissions, and review rules are defined. Automation does not become accountable for the case. It changes what the analyst checks and approves.

How do SOC responsibilities change in internal, co-managed, and managed models?

The work remains, but the employer, access path, and decision boundary can change. A provider can monitor, investigate, and sometimes contain under agreed authority. The customer still owns business context, risk acceptance, recovery, and decisions the contract does not transfer.

Use the SOC operating-model guide to define who handles alerts after hours, then use the build-versus-outsource guide to decide which responsibilities should stay internal.

How should you define SOC roles and responsibilities?

Start with the work the SOC must perform, then assign accountability, access, and decision rights. A neat organization chart can still hide an empty chair at 2 a.m. Use this seven-step method:

• List the services the SOC provides. Separate monitoring, triage, investigation, response coordination, hunting, detection engineering, platform work, reporting, and improvement.
• Name one accountable owner for each service. Contributors can be shared; accountability should be clear.
• Define coverage by hour, technology, environment, and severity. State who owns the queue when the primary team is unavailable.
• Write decision rights. Specify who can close an alert, declare an incident, change severity, preserve evidence, disable an account, isolate a host, or accept risk.
• Set escalation criteria and the required handoff record. Include a fallback when the expected owner does not respond.
• Separate frontline analysis from detection and platform changes. Require testing and review for production changes while keeping analyst feedback fast.
• Test the model with exercises and real cases. Measure handoff quality, reopened work, delayed approvals, missed coverage, and repeat failures, then update the role design.

NIST SP 800-61 Rev. 3 places incident response across cybersecurity risk management, including preparation, detection, response, and recovery. That supports a cross-functional responsibility model rather than assigning every incident task to the SOC.

What should a SOC escalation include?

An escalation should carry enough evidence for the next analyst to continue without repeating the first ten minutes of work. Include:

• Alert name, rule or case ID, source, timestamp, and time zone.
• Affected users, hosts, workloads, applications, data, and business owner when known.
• Relevant raw evidence and normalized context, with links to the source records.
• Checks completed, queries used, results, and failed or unavailable data sources.
• Current hypothesis, alternative explanation, confidence, severity, and business context.
• Actions already taken, approvals obtained, and any risk created by delay.
• The exact question or decision the next owner must answer, plus the required response time.

What skills do SOC analysts need at each tier?

SOC analyst skills should match the work and authority assigned to the role. Years of experience and certifications can support hiring, but they do not replace evidence that a person can perform the required tasks.

Use the SOC maturity model to assess staffing, process, technology, measurement, and response separately. A senior title cannot compensate for missing coverage, poor data, or unclear authority.

Final thoughts: Define the work before naming the tiers

Use Tier 1, Tier 2, and Tier 3 when they make routing and authority easier to understand. Add named owners for detection, platforms, incident coordination, business decisions, and recovery. Then test the handoffs. A role chart earns its keep only when the next person knows what to do, what they can approve, and when they must act.

Frequently asked questions about SOC roles

What does a SOC Analyst do?

A SOC analyst takes a look at security alerts, digs up the background information, investigates anything that looks suspicious, keeps track of the evidence, and helps get the response process under way. The scope of that kind of work can vary greatly depending on what the specific job entails.

What's the difference between Tier 1 and Tier 2 SOC Analysts?

Tier 1 SOC analysts decide whether an alert needs more investigation and start getting a case together, whilst tier 2 analysts figure out what actually happened, what's affected and whether it meets the organisation's criteria for an incident.

Is a Tier 3 SOC Analyst always a threat hunter?

No. At Tier 3 level you're usually talking about a senior or specialist analyst - threat hunting can be part of the job but a lot of the time SOCs actually assign different specialists like hunting, malware analysis, detection engineering and incident response to different people on the team.

Who is responsible for creating alert profiles and detection rules?

Someone who's specifically qualified in detection engineering or a named owner of detection rules should be accountable for this. Tier 1 analysts feed back on how the rules are performing in practice, while Tier 2 and Tier 3 help test whether the logic behind the rules is effective in supporting useful investigation and detecting potential threats.

Can Tier 1 SOC work be automated?

Some parts of Tier 1 work definitely can be. You can automate things like enrichment, deduplication, gathering evidence, routing and even case drafting to save analysts a lot of time. However, a human is still needed to review the context, handle any exceptions and make the call on whether to close the case or escalate it.

Do all SOCs use a three-tier system?

No. Smaller teams often end up doing multiple jobs, while bigger or managed teams might use buckets like specialist queues, teams focused on specific products, or differentiated levels of experience. What matters most is clear ownership and reliable handoffs between people.

What does a SOC Manager do?

A SOC manager is the person who oversees staffing, coverage, service levels, the escalation process, training, metrics, stakeholder reporting, and what's needed to improve the service. They also have to sort out any gaps that fall between teams or contracts.