A Security Operations Center (SOC) analyst investigates and triages security events, then escalates cases for incident response when needed. The role’s tools, authority, investigative depth, and shift schedule depend on the employer and the analyst’s seniority. For pay context, the best national benchmark available here is for the broader occupation of information security analysts—not SOC analysts alone.
What does a SOC analyst do?
ISACA defines the role this way: “A Security Operations Center (SOC) Analyst investigates and triages security events and escalates events to the incident response team as deemed necessary by management.” In practical terms, SOC analysts help determine which alerts warrant attention and route appropriate cases to incident responders.
ISACA names security information and event management (SIEM), incident response, vulnerability management, risk analysis, and security controls among skills associated with SOC analyst roles. The tools used and how much authority an analyst has to investigate or act can vary by employer and seniority.
Related duties for information security analysts more broadly include monitoring networks for breaches, investigating incidents, maintaining protective software, checking for vulnerabilities, tracking security trends, documenting attempted attacks and breaches, developing security standards, recommending improvements, and helping users follow security procedures. The U.S. Bureau of Labor Statistics (BLS) describes these duties for the broader occupation; they are not a checklist that every SOC analyst performs.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWho SOC analysts work with
SOC analysts may coordinate with incident responders, IT or network teams, and management. Some security analysts work more than 40 hours or remain on call outside normal business hours, according to BLS. Check an individual employer’s job posting for its shift pattern and on-call expectations.
How much does a SOC analyst make?
There is no SOC-only median in the authoritative wage data cited here. The BLS groups the figures under information security analysts, a broader occupation that includes work beyond SOC roles. Its May 2025 figures are useful as context, not as a forecast of what a SOC analyst will earn.
| BLS figure | What it means |
|---|---|
| $129,180 per year | Median annual wage for U.S. information security analysts in May 2025; not a SOC-specific median. |
| Less than $75,090 | Annual wages earned by the lowest 10 percent of information security analysts in May 2025. |
| More than $199,850 | Annual wages earned by the highest 10 percent of information security analysts in May 2025. |
Pay varies with location, industry, experience, and job duties. BLS publishes state and area data for information security analysts, but those figures should not be treated as a SOC-specific pay range.
Employment outlook for the broader occupation
BLS projects employment of information security analysts to grow 21 percent from 2025 to 2035, with an average of 14,100 openings per year over that period. These are projections for the broader occupation, not a separate SOC analyst forecast.
What certification do you need to become a SOC analyst?
The sources cited here do not establish one certification as a universal requirement for SOC analyst jobs. BLS says many employers prefer information security certification, but does not name a credential that every SOC analyst needs. ISACA lists Certified Cybersecurity Operations Analyst (CCOA) and a CCOA review course on its SOC analyst career page; that makes CCOA an option to consider, not proof that employers universally require it.
A California Department of Industrial Relations apprenticeship framework provides one example of how credentials may fit into training. It lists CompTIA Network+ and Security+ before the apprenticeship; Linux+ before or during it; CySA+ and PenTest+ during or after it; and CISSP Associate after it. This is a California framework, not a national requirement or a recommendation that every credential suits every SOC job.
How to compare credentials
- Role fit: Check whether the material matches the duties in SOC job postings you are targeting.
- Prerequisites and experience: Confirm eligibility and whether the credential is intended for your current level.
- Practical assessment: Consider whether it tests hands-on skills relevant to security operations.
- Local employer demand: Look for credentials actually requested by employers in your market.
- Total commitment: Verify current exam and renewal costs and requirements with the credential provider before enrolling.
The cited sources do not provide a current, like-for-like comparison of certification requirements, costs, or renewal rules.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can you become a SOC analyst without a degree?
It is possible to enter the broader information security analyst occupation through more than one route. BLS says analysts typically need a bachelor’s degree in a computer or related field and related work experience, while also noting that some workers enter with a high school diploma plus relevant industry training and certifications. That describes the broader occupation; individual SOC employers set their own requirements.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Related IT experience, education, and training can all contribute to preparation. Review job postings for the roles and locations you want, because degree requirements, experience expectations, and preferred credentials differ by employer.
Quick Recap
Sources and scope
- ISACA: SOC Analyst — role definition and associated skills.
- U.S. Bureau of Labor Statistics: Information Security Analysts — broader occupation duties, education, wages, and outlook. The cited page was updated August 27, 2026.
- California Department of Industrial Relations: Cybersecurity Analyst Occupational Frameworks IT — example apprenticeship framework and credential sequence.
- ISACA: Certified Cybersecurity Operations Analyst — credential information.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
