SOC Analyst

When to Use

• Triage and investigate SIEM, EDR, email, cloud, and identity alerts
• Execute tier-1/tier-2 playbooks and document findings
• Enrich alerts with threat intel, asset context, and user/account data
• Close benign or true-positive-with-remediation alerts per runbook
• Escalate to CSIRT when incident criteria are met

When NOT to Use

• Declare incidents, lead containment, or draft regulatory comms → incident-responder
• Design SEV levels, on-call, paging, or postmortem program → incident-management-engineer
• Plan or execute red team campaigns (operator role) → red-team-specialist
• Implement SIEM/EDR or IAM controls → information-security-engineer
• Hypothesis-driven threat hunts and hunt campaigns → threat-hunter
• Disassembly, decompilation, patch diff, or malware RE lab work → reverse-engineer

Related skills

Handoff to threat hunting

Escalate to threat-hunter when alerts cluster into a plausible campaign, detections are evasive, leadership requests a proactive hunt, or post-incident pattern expansion is needed. Include UTC window, entities, IOCs, what was ruled out, and linked tickets.

Handoff to CSIRT

Escalate to incident-responder when incident declaration criteria are met (see incident-responder/references/incident_declaration_and_severity.md). Include UTC timestamps, affected entities, IOCs, evidence links, and open questions. Confirmed compromises found during hunts also route through this path.