haadi@portfolio:~$ cat soc-role-in-blue-team.md
Room notes · SOC Level 1 · Blue team introduction
SOC Role in BlueTeam
A breakdown of how SOC teams are structured, what each tier does, and how a career progresses from L1 analyst all the way up to security architect. This room is the map of where I am going.
What This Room Covers
A breakdown of how SOC teams are structured, what each tier does, and how a career progresses from L1 analyst all the way up to security architect. This room is the map of where I am going.
Key Concepts Learned
The SOC Tier Structure
| Tier | Role | Responsibility |
|---|---|---|
| Tier 1 | Junior SOC Analyst | Alert monitoring, initial triage, escalation |
| Tier 2 | Senior SOC Analyst | Deep investigation, incident response, threat hunting |
| Tier 3 | SOC Manager and Threat Hunter | Advanced hunting, tool management, team coordination |
| Above SOC | Security Engineer and Architect | Building and designing the security infrastructure |
Understanding this structure changed how I think about learning. As a future Tier 1 analyst, my job is not to know everything: it is to know enough to recognize what I am looking at and know when to escalate. Deep expertise comes at Tier 2 and above.
Blue Team vs Red Team The room positioned the SOC clearly within the blue team: the defensive side. Red teams simulate attackers, blue teams defend. The most effective security programs run both together (purple teaming), where red team findings directly improve blue team detections.
The SOC is not just about technology. A point that stood out: the SOC analyst role requires communication skills as much as technical skills. Writing clear incident reports, briefing management, and communicating risk to non-technical stakeholders is part of the job. These write-ups I am producing now are practicing exactly that skill.
Career progression is not linear. The room noted that some analysts move from L1 straight into specialized roles like threat intelligence, DFIR, or security engineering rather than climbing the traditional SOC ladder. This aligned with my own roadmap toward security architecture: the SOC is the starting point, not the destination.
Hands-On Tasks
Conceptual room: focused on understanding structure and roles rather than using tools. The value here is building a mental model of the environment I am entering, not hands-on practice.
How This Applies to Real SOC Work
Pakistan's SOC landscape is developing rapidly. PKCERT operates as the national CERT and functions much like the SOC described in this room: tiered response, alert monitoring, incident escalation. Understanding the tier structure means I know exactly what is expected of me as an L1 entry-level analyst: monitor, triage, document, escalate. Not solve every problem independently, but be the reliable first filter that senior analysts depend on.
What I Want to Learn Next Based on This
The tier structure makes clear that L1 effectiveness depends on speed and accuracy of triage. The faster I can move from "alert fired" to "true positive or false positive" with confidence, the more valuable I am. That means getting deep on SIEM queries, understanding normal vs abnormal network behavior, and building pattern recognition for common attack types.
Originally published on GitHub
view-source