Security Operations (SOC)
Every organization with a security team needs people watching for and responding to attacks, which is also why this is the most common entry point into the field. It ranges from Tier 1 alert triage all the way up to the engineers who build the detections and automation the rest of the SOC runs on.
Cyber Threat Intelligence (CTI) AnalystInsider Threat AnalystPurple Team / Detection Validation Engineer
SOC Analyst
Watches live security alerts and figures out which ones are real — the industry's most common first job.
What it's about & how to get in
You work in a Security Operations Center watching a live stream of alerts from firewalls, endpoint detection tools, and SIEM platforms like Splunk or Microsoft Sentinel, figuring out which ones are real and which are noise, then escalating the real ones.
Entry-level (Tier 1) SOC analyst is the most common first cybersecurity job in the industry, because it's the role companies hire for the fastest and train the most on the job. You move up from Tier 1 (triage) to Tier 2 (deeper investigation) to Tier 3 (senior analysts who write detection rules and mentor the rest of the team).
Where you can work
- 24/7 Security Operations Centers, in-house at large enterprises or outsourced through an MSSP
- Managed Detection and Response (MDR) providers monitoring many client companies at once
- Banks and financial institutions running their own internal SOCs
- Healthcare systems protecting patient data around the clock
- Government agencies and defense contractors (often requiring a security clearance)
- Retail and e-commerce companies, where SOC hiring often spikes around the holiday shopping season
What it pays
Certifications that open doors
Where you can actually learn it
Threat Hunter
Goes looking for attackers who already got past the automated defenses.
What it's about & how to get in
Instead of waiting for an alert to fire, you go looking for attackers who are already inside the network and got past the automated defenses. The idea behind threat hunting is that some intrusions never trigger an alert at all.
That means forming a hypothesis (“if an attacker got in this way, here's what they'd leave behind”), digging through logs and endpoint data to test it, and building new detection rules out of whatever you find. It's a senior role that usually comes after a few years of SOC or incident response work and learning attacker tactics well enough to think like one.
Where you can work
- Threat intelligence and hunting teams inside large enterprises with mature security programs
- MDR providers that offer proactive hunting as part of their service
- Financial services and critical infrastructure companies — high-value targets for advanced attackers
- Government and defense cybersecurity units
- Cybersecurity vendors building detection products, where hunters help validate what the product should catch
What it pays
Certifications that open doors
Where you can actually learn it
Detection Engineer
Builds the alerts a SOC actually trusts, instead of drowning it in noise.
What it's about & how to get in
A Detection Engineer writes, tests, and tunes the detection logic (correlation rules, Sigma rules, EDR analytics) that SOC Analysts triage and Threat Hunters validate. They treat detections like software: version-controlled, tested against real attack data, and measured for false-positive rate.
This role grew out of the realization that SOC Analysts and Threat Hunters were manually building one-off rules with no engineering discipline behind them. It sits upstream of both: SOC Analysts consume the alerts a Detection Engineer ships, and Threat Hunters feed back the gaps they find in coverage so new detections get built.
Where you can work
- In-house security teams at mid-to-large enterprises building a detection engineering function
- MDR (Managed Detection & Response) providers writing detections used across many customers
- MSSPs maintaining shared detection content libraries
- SIEM/XDR vendors building out-of-the-box detection content
- Financial services and tech companies with mature, in-house SOC teams
What it pays
Certifications that open doors
Where you can actually learn it
Security Automation Engineer (SOAR)
Turns repetitive SOC playbooks into code so analysts stop doing the same triage by hand.
What it's about & how to get in
A Security Automation Engineer designs and builds SOAR playbooks that auto-enrich alerts, auto-contain compromised hosts, and route escalations — reducing the manual load on SOC Analysts. They work at the intersection of scripting/development and security operations.
This role exists because SOC Analysts and Threat Hunters were spending hours on repetitive enrichment that software can do in seconds. Automation Engineers build the playbooks those two roles then rely on and refine based on what breaks or misfires in production.
Where you can work
- Enterprise SOC teams running Splunk SOAR, Cortex XSOAR, or Microsoft Sentinel automation
- MSSPs/MDRs standardizing response across many client environments
- Cloud-native companies automating containment across AWS/Azure/GCP
- Security vendors building out-of-the-box SOAR playbooks/integrations
- Large SOCs with dedicated automation/tooling sub-teams
What it pays
Certifications that open doors
Where you can actually learn it
SIEM Engineer / Administrator
Owns the log pipeline and platform that every SOC Analyst's queue depends on.
What it's about & how to get in
A SIEM Engineer/Administrator manages log ingestion, data onboarding, correlation-rule infrastructure, and platform health (Splunk, Sentinel, QRadar, etc.) so the data SOC Analysts and Detection Engineers rely on is complete and timely. It's an infrastructure-and-content role, not a triage role.
The SOC Analyst role already on this site depends entirely on a healthy SIEM — this role is the one that keeps that platform running, onboards new log sources, and manages licensing/cost. It's a natural next step for a SOC Analyst who wants to move into platform engineering rather than pure investigation.
Where you can work
- Enterprises running self-managed Splunk, IBM QRadar, or Elastic SIEM deployments
- Organizations migrating to or operating Microsoft Sentinel
- MSSPs managing SIEM instances for multiple clients
- Government and regulated industries with heavy log-retention requirements
- Any mid-to-large SOC needing dedicated platform/content administration separate from analysts