Every SOC job ad uses one of the same three titles, and the title is often the wrong one for the work. Tier 1 answers alerts, tier 2 works incidents, and a hunter goes looking for the attacker nobody has alerted on yet. The rest is what each one does at ten in the morning, who they hand work to, and what the ad is actually paying for.
Tier 1: the alert queue
A tier 1 analyst owns the queue. The SIEM, the endpoint agent, the mail filter and the identity provider all raise alerts, and every one lands in front of you with a severity and a timer. Your day is picking the next one, pulling the evidence, and deciding what it is. On a bad week the queue is nearly all false positives, and the skill at this level is closing those fast while still catching the one that matters.
The tools are the SIEM console (Splunk and Microsoft Sentinel are the two you will meet most), the EDR console (CrowdStrike or Defender), the identity provider’s sign-in logs, a threat intel lookup, and the ticketing system where the case lives. You work from playbooks someone senior wrote.
You escalate to tier 2 when the alert is real and the response is beyond your authority. The escalation is a case with a timeline, the evidence, what you ruled out, and what you think it is. A bare “looks suspicious, please check” bounces back, and it should.
Plan on one to two years here. You leave when your escalations stop bouncing and you have started tuning the rules that generate your own noise. If you came from a help desk, the move from the help desk into a SOC is shorter than it looks, because triage under a timer is the thing you already know.
Tier 2: the incident
Tier 2 takes what tier 1 escalates and owns it until it is closed. The questions now are how far it got, what the attacker touched, and how to get them out without tipping them off first.
Fewer cases, each one longer. You spend hours in one laptop’s process tree and network connections. You isolate hosts, kill processes, reset credentials, and read through mailbox rules to see whether the attacker set up forwarding before you got there. Then you write the report that goes to the manager and sometimes to legal. Every case ends with a close code and a note. Tier 1 closes false positives, benign true positives and duplicates on its own authority. Contained says the attacker was real and is now out, and only tier 2 writes that one.
Where tier 1 reads an EDR alert, tier 2 writes the live-response query. You will touch forensic tools, a sandbox for detonating attachments, and Python or PowerShell, because the data never arrives in the shape you need. Tier 2 also writes the playbooks and tunes the detection rules, and every false positive you tune out is an hour of tier 1’s week returned.
Tier 2 escalates upward to incident response when a confirmed breach puts a regulatory clock on the case. Two to four years here is typical.
Threat hunter: no alert, by design
A threat hunter starts from the assumption that the detections missed something. The hunter picks a technique from MITRE ATT&CK that the SOC has no rule for, writes down what it would look like in the logs, and goes searching. A hunt takes days or weeks, and most hunts find nothing.
The hunter’s tools are query languages more than consoles. KQL in Sentinel, SPL in Splunk, SQL against a data lake, and a Jupyter notebook for stacking events until the rare one stands out.
When a hunt finds something live, the hunter hands it to tier 2 as an incident. When it finds nothing, the hunter still writes a detection rule for the technique, so the next time it happens tier 1 gets an alert. Hunting is a senior role, and the people doing it spent three to five years in tier 1, tier 2 or incident response first.
Who escalates to whom, and what it pays
Draw it as a line. The help desk raises what it cannot explain to tier 1, the same way a support desk escalates between its own tiers. Tier 1 raises confirmed cases to tier 2. Tier 2 raises breaches to incident response. The hunter sits beside the line, feeding cases in to tier 2 and rules back to tier 1. In a small company one person is all three and the line is a note to self.
The money runs the same direction. Tier 1 is the entry level and pays like one, tier 2 pays meaningfully more, and hunters sit above that. The figures, with their sources, are in what SOC analysts make.
Reading a job ad
Titles lie. “SOC Analyst” with no tier attached is tier 1 at almost every company, so read the rest of the ad.
Look at the verbs. Monitor, triage, escalate, document: tier 1. Investigate, contain, remediate, tune: tier 2. Hypothesize, hunt, develop detections: hunter. If the ad says tier 2 and the verbs are monitor and escalate, they are hiring tier 1 and paying tier 1, whatever the title. Look at the tools. A list that stops at a SIEM and a ticketing system is tier 1. Add forensics and scripting and it is tier 2. If the ad wants KQL fluency and “experience with” the ATT&CK framework rather than “familiarity with,” it is a hunting role wearing a cheaper title. Look at the shift. Tier 1 ads mention a 24x7 rotation, tier 2 ads mention on-call, hunting ads mention neither.
If the ad is tier 1 and you have never worked a queue, work one before the interview. ServiceDesk Simulator now has a security desk in beta, where you work a queue of alerts and escalated tickets across an alert console, sign-in history and an endpoint view, and close each case with a close code before the desk tells you what really happened. The Security Simulator beta opens with a passcode and has a waitlist.
Then look at the years. Zero to two is tier 1 regardless of the title. Two to five is tier 2. Five plus, with incident response somewhere in the history, is hunting. An ad asking for zero to two years and listing hunting verbs is a company that does not have a SOC yet and wants you to build one, which is a different post.