Next Steps After SOC Analyst (MSSP)

Summary

In this video, a cybersecurity professional discusses various career paths available to junior analysts working in a Security Operations Center (SOC). The speaker covers roles such as Tier 2 and Tier 3 analyst positions, Professional Services, Governance, Risk & Compliance (GRC), Consulting, and Technical Account Management (TAM). Each role is explained in terms of responsibilities, technical focus, and work-life balance, helping viewers understand the next steps in their cybersecurity career journey. The video emphasizes the importance of networking and skill development for progression, offering practical advice for advancing within or beyond the SOC environment.

Takeaways

• 😀 Tier 2 Analyst is a common next step for junior SOC analysts, focusing on deeper investigations, mentoring, and possibly alert tuning.
• 😀 Tier 3 Analysts specialize in roles like incident response, threat intelligence, or threat hunting, often bypassing Tier 2 roles.
• 😀 Professional Services roles involve hands-on technical work like SIM implementation and use case development for clients.
• 😀 GRC (Governance, Risk, and Compliance) analysts ensure clients or businesses are compliant with regulations, focusing on policies and procedures rather than technical skills.
• 😀 Consulting roles involve advising clients on cybersecurity issues, researching solutions, and implementing fixes or improvements.
• 😀 Technical Account Managers (TAMs) act as a liaison between clients and the SOC, handling client communication and project management tasks.
• 😀 Moving up from SOC roles often involves networking and maintaining a positive, approachable attitude within the team.
• 😀 SOC analysts can transition to various career paths that may involve more specialized or client-facing roles.
• 😀 Tier 3 analysts typically work on tickets escalated by lower tiers, but they may not handle direct alerts.
• 😀 Transitioning to a new role in cybersecurity can involve learning new skills, like alert tuning for Tier 2 roles or consulting tasks in Professional Services.
• 😀 Regardless of the path chosen, most roles outside of SOC involve 9 to 5 hours, with occasional on-call work depending on the position.

Q & A

What are some career paths a junior cybersecurity analyst can take after working in a SOC?

After working in a SOC, a junior cybersecurity analyst can explore several career paths, including Tier 2 or Tier 3 analyst roles, Professional Services, Governance Risk and Compliance (GRC), Consulting, or Technical Account Management (TAM).

What does a Tier 2 analyst typically do in a SOC?

A Tier 2 analyst focuses on more in-depth investigations, handling escalated alerts, answering client inquiries, mentoring junior analysts, and updating process documentation. They typically work 9-5 with weekends off, unless on call.

Can a junior cybersecurity analyst skip the Tier 2 role and move directly to Tier 3?

Yes, in some cases, junior analysts can skip Tier 2 and move directly to Tier 3, especially if the organization allows it. However, this is less common, as Tier 3 roles are typically more specialized.

What are the responsibilities of a Tier 3 analyst?

Tier 3 analysts specialize in areas like incident response, cyber threat intelligence, or threat hunting. They typically work on tickets created by Tier 1 or Tier 2 analysts, but they do not deal with incoming alerts or tickets. Their working hours are usually 9-5, but incident response roles may require flexibility.

What is the role of a Professional Services analyst?

A Professional Services analyst works as an engineer or use case developer, helping clients implement or configure security tools, such as SIEMs, and develop use cases. They typically work 9-5, but may be on call for emergencies.

What does a Governance, Risk, and Compliance (GRC) analyst do?

A GRC analyst ensures that an organization or its clients are in compliance with regulatory requirements. They create policies, procedures, and assist with meeting compliance standards. GRC roles are less technical and focus more on regulations and rules.

How does the role of a Consultant in cybersecurity differ from other technical roles?

A Consultant's role focuses on advising clients on cybersecurity posture, vulnerabilities, and risk reduction. They often conduct vulnerability assessments and provide solutions, typically involving a mix of research and client interaction. It's more about offering guidance than performing technical tasks.

What is the main responsibility of a Technical Account Manager (TAM)?

A TAM acts as a liaison between the SOC and the client, relaying information and ensuring the client's needs are met. They organize and attend regular meetings with clients, and their role involves a mix of technical knowledge and client communication.

What are the work hours like for roles like Tier 2 and Tier 3 analysts?

Tier 2 and Tier 3 analysts typically work regular business hours (9-5) and have weekends off, except when on call. However, incident response roles may require flexible hours, including after-hours work.

How can networking in a SOC benefit a junior cybersecurity analyst's career?

Networking in a SOC helps build connections with other departments and professionals, which can lead to new opportunities for career advancement. Building a positive reputation and strong relationships within the SOC can increase chances of moving into new roles.