From SOC analyst Tier 1 to Tier 3: a practical path

Many analysts join a SOC at Tier 1 with one question in mind: how long before I do more than triage alerts? The answer depends less on time served than on what you learn, and on what you can show. This guide describes what really separates each level, the skills to build for the next one and how to make your progress visible.

What actually changes between Tier 1, 2 and 3

Titles vary from one SOC to another, and some teams do not use tiers at all. The logic stays similar, though: at each step you handle situations that are less covered by procedures, and you make more decisions on your own.

Moving from Tier 1 to Tier 2 means going from execution to investigation. Moving from Tier 2 to Tier 3 means going from investigation to improving the whole setup. Keep that in mind: it is not the number of alerts you close that moves you up, it is the kind of problems you can solve.

If you are not in a SOC yet, start with our guide to becoming a SOC analyst, which covers the baseline expected on day one.

Tier 1 to Tier 2: from triage to investigation

A good Tier 1 analyst is rigorous, fast and reliable. A future Tier 2 stands out for something else: they do not stop at the question the procedure asks.

Skills to build

• Read logs without the tool. Know what a Windows authentication event, a proxy log or a DNS trace contains, not just what the console displays.
• Master the EDR. Walk a process tree, understand a suspicious command line, see what ran before and after.
• Correlate. Connect an alert to other events on the same host, account or time window.
• Know your environment. Which servers are critical, which accounts are privileged, what normal looks like for you.
• Think in attack techniques. MITRE ATT&CK gives you a shared vocabulary to place what you observe within an intrusion scenario.

Habits that get you noticed

Instead of just closing an alert as a false positive, note why it is one, and suggest a rule tweak if it fires too often. When you escalate, include your first checks. Ask to follow up on the incidents you handed over: it is the most direct way to learn what a Tier 2 analyst does.

A well-built ticket is worth a demo. It says what you observed, what you checked, what you conclude and what remains open. SOC managers read these tickets, and they often judge an analyst's maturity on them.

Tier 2 to Tier 3: from investigation to improvement

At Tier 3, you are no longer just asked to handle an incident well. You are asked to make sure the next one is detected sooner, or does not happen.

Skills to build

• Detection engineering. Write, test and maintain rules in your SIEM or EDR, and measure how noisy they are. Sigma is a good way to practise thinking about a rule independently of any tool.
• Threat hunting. Start from a hypothesis, search the data, document the hunt even when nothing turns up.
• Offensive knowledge. Understand how an attacker moves through Active Directory, abuses legitimate tools or keeps persistence. You do not need to be a pentester, but you need to recognise these techniques.
• Major incident handling. Keep the big picture, prioritise, coordinate with incident response, IT operations and sometimes management.
• Coaching. Train Tier 1 and Tier 2 analysts, write procedures, review their investigations.

The change in mindset

The Tier 3 analyst is often the person people turn to when nobody knows. That takes technical confidence, but also the ability to say "I don't know yet, here is how I'll find out". Writing matters even more than before: your post-incident reviews and improvement proposals are read by people who were not in the incident.

Build evidence of your progress

A step up is earned with concrete evidence, not seniority. Over the months, keep a personal record, free of confidential data, that shows what you can do.

1. Investigations you are proud of. Summarise the context, your approach and the outcome, anonymising whatever needs to be.
2. Improvements you made. A tuned rule, a rewritten procedure, a new log source, a useful dashboard.
3. What you learned outside work. A home lab, defensive scenarios on training platforms, write-ups of investigation-focused CTFs. Our article on the cybersecurity portfolio explains how to present that work.
4. Feedback you received. An incident handled well and recognised by the team, a session you ran for a new joiner.

Certifications can help structure your learning, especially on investigation and detection. They do not replace practice: our guide to the certifications that fit your role helps you pick the ones that make sense at your level.

Ask for the step up

Once the evidence is there, do not count on your manager spotting it alone. Prepare the conversation.

• Ask for the criteria. What separates Tier 2 from Tier 1 in this team? If the answer is vague, offer to write it down together.
• Show the gap closed. Take each criterion and pair it with an example from your record.
• Suggest a transition period. Taking on some Tier 2 investigations under supervision is often easier to agree to than an immediate change.
• Discuss the terms. A step up often changes on-call duties, hours and pay. Raise these points clearly, with help from our guide to negotiating your cybersecurity salary.

If the organisation leaves no room to grow, because the SOC is too small, heavily outsourced or has no higher tier, that is not a failure on your part. It is information. Changing employer is then often the fastest route, and your record of evidence becomes your best argument in interviews.

Mistakes that slow you down

• Chasing speed over understanding. Closing lots of alerts without knowing why teaches you nothing.
• Staying locked in the console. If you can only work through one tool, you will struggle the day the SIEM or EDR changes.
• Neglecting writing. An excellent investigation, poorly reported, will not be recognised.
• Never leaving your lane. Talking to infrastructure, incident response or auditors widens your understanding faster than any course.
• Ignoring fatigue. Shift work and on-call duties wear you down. Lasting progress needs a pace you can sustain.

What comes after Tier 3?

Tier 3 opens several directions. Some stay detection experts and become detection engineers. Others specialise in threat hunting, incident response or forensic analysis. Others take charge of a team or a whole SOC. None of these paths is better than the others: choose the one that matches what you enjoy doing day to day.

In short

Going from Tier 1 to Tier 3 means moving from following procedures to investigating, then from investigating to improving detection. Build the next level's skills before you are asked for them, collect concrete evidence and prepare the conversation with your manager like an interview.

Aiming for a Tier 2 or Tier 3 role, or a SOC where you can grow? Join the Cyber Recrut network for free: our shortlisted candidates prove their skills on hands-on labs, which gets your real level recognised rather than a job title. See how we work.