How to find a SOC analyst.

Security operations has the highest turnover in the security field, and the cause is structural rather than mysterious. SOCs run around the clock, rotating night shifts take a real toll, and Tier 1 work often means triaging large volumes of alerts that turn out to be false positives.

That shapes both sourcing and retention. Concealing the shift pattern in an advert produces hires who leave within months. Naming a progression path into detection engineering or threat hunting — day-shift work using the same knowledge — is what actually keeps good analysts, and it is also the pitch that wins them from competitors.

Job titles worth searching

Grouped by what the person actually does, because searching all44 at once produces a result set you cannot triage. Decide which group you need first — that decision does more for the search than any string below.

Certifications and what each indicates

Blue team certifications range from foundational multiple-choice through to lab-based practical examinations. The practical ones and the platform-specific ones are what predict productivity.

Where SOC analysts actually are

Published detection content is the clearest capability signal in defensive security. A GitHub repository of Sigma rules, YARA signatures, or KQL hunting queries demonstrates blue team depth that no certification list conveys, and it is public, dated, and attributable.

Practical training platforms have become the main proving ground for this discipline. LetsDefend, CyberDefenders, and Blue Team Labs publish completion and ranking data, which identifies analysts practising on their own time — a strong motivation signal, particularly for early-career candidates whose CVs are otherwise hard to distinguish.

Managed security service providers are the most under-searched pool. Their analysts see far more incident variety across many client environments than in-house teams typically encounter, and many want to move in-house for depth rather than breadth. For conferences, Blue Team Con and the SANS summits attract defenders specifically, while BSides events run locally in most cities.

Boolean search strings

Written to be pasted as-is. Each one is built around an intent rather than a platform, since the useful question is what you are trying to find, not which site you happen to be on.

site:linkedin.com/in/ ("SOC analyst" OR "security operations" OR "incident response") (GCIH OR Splunk OR Sentinel OR BTL1) "{city}"

site:github.com ("sigma" OR "detection-rules" OR "YARA" OR "KQL" OR "SPL") ("detection" OR "hunting") -awesome -tutorial

("SOC analyst" OR "security operations") ("shift work" OR "night shift" OR "burnout" OR "leaving SOC" OR "day role") -jobs

("Splunk" OR "Microsoft Sentinel" OR "Chronicle" OR "QRadar" OR "Elastic Security") ("SPL" OR "KQL" OR "use case" OR "content development") -jobs -vendor

("BTL1" OR "Blue Team Labs" OR "LetsDefend" OR "CyberDefenders" OR "blue team CTF") ("completed" OR "ranked") -jobs

("MSSP" OR "managed security" OR "managed detection") ("SOC analyst" OR "security analyst") "{city}" -jobs -sales

("speaker" OR "talk") ("BSides" OR "SANS Summit" OR "FIRST" OR "Blue Team Con") 2024..2026 -jobs

("threat hunt" OR "incident writeup" OR "detection engineering") ("how we" OR "lessons" OR "we detected") -jobs -vendor

Mistakes that cost the most time

1. Not naming the tier in the advert

   Tier 1 triage against a runbook and Tier 3 threat hunting are different jobs requiring different people and paying differently. Advertising both as 'SOC Analyst' produces a shortlist mixing candidates who cannot do the work with candidates who will find it beneath them. Naming the tier is the single most useful improvement available.

2. Concealing the shift pattern

   Security operations centres run around the clock, and shift rotation is the largest cause of turnover in the field. Candidates who discover a rotating night schedule after accepting leave quickly, and word travels in a well-connected community. State the rotation plainly — some candidates actively prefer nights for the premium and the quiet.

3. Requiring CISSP on junior roles

   CISSP requires five years of documented experience, so asking for it on an entry-level SOC role is impossible by definition. This is a well-known irritant in the security community and marks the advert as written by someone outside the field, which suppresses applications well beyond the specific role.

4. Ignoring detection engineering as a retention path

   The main reason good analysts leave security operations is that shift work has no obvious end. Detection engineering, threat hunting, and automation offer day-shift progression that uses the same knowledge. Employers who make that path explicit retain analysts who would otherwise leave for any role with regular hours.

5. Overlooking MSSP analysts

   Analysts at managed security service providers see far more incident variety across many client environments than in-house analysts typically do, and many want to move in-house for depth rather than breadth. It is a large, experienced, and consistently under-searched population.

6. Screening on certification count

   Certifications in this field vary enormously in rigour, and stacking acronyms says little. Published detection content, hunt writeups, and practical platform completions demonstrate capability that a certification list does not. For blue team roles specifically, a GitHub repository of Sigma rules outweighs almost any credential.

Common questions

What job titles should I search for when hiring a SOC analyst?

Search the tier and the specialisation rather than the generic title. Tier 1, Tier 2, and Tier 3 SOC Analyst describe genuinely different jobs. For escalated work, Incident Responder, DFIR Analyst, and CSIRT Analyst. For the engineering side, Detection Engineer, Threat Hunter, SIEM Engineer, and Security Content Developer. For analysis rather than operations, Threat Intelligence Analyst and CTI Analyst. Platform-specific titles such as Splunk Engineer or Sentinel Engineer matter where the organisation has heavy investment in one SIEM.

What is the difference between Tier 1, Tier 2, and Tier 3 SOC analysts?

Tier 1 analysts triage incoming alerts against documented runbooks, closing false positives and escalating what needs deeper investigation. This is high-volume, often shift-based, and a common entry point into security. Tier 2 analysts investigate those escalations, correlating across data sources and determining scope and impact. Tier 3 analysts handle the most complex incidents, hunt proactively for threats the tooling missed, and often build detections. The skill and pay differences are substantial, so naming the tier in an advert prevents a mixed and unusable shortlist.

Why is turnover so high in security operations centres?

Shift work, primarily. SOCs operate around the clock, and rotating night shifts take a genuine toll that no salary fully offsets. The secondary cause is alert fatigue — Tier 1 work can mean triaging large volumes of alerts, most of which are false positives, which becomes monotonous quickly. The retention answer that works is a visible progression path into detection engineering, threat hunting, or automation, all of which use the same knowledge during normal working hours. Employers who make that path explicit keep analysts who would otherwise leave.

Which certifications matter for SOC and blue team roles?

The GIAC family is the most respected, particularly GCIH for incident handling and GCIA for intrusion analysis, though the cost means holders usually had employer sponsorship. Blue Team Level 1 and 2 are practical, lab-based, and far more affordable, which makes them common among self-funded candidates and a good signal of motivation. CySA+ and Security+ indicate foundational knowledge. Vendor SIEM certifications are genuinely useful where the platform matches. CISSP requires five years of experience and is inappropriate on junior adverts.

Where can I find SOC analysts outside LinkedIn?

Published detection content is the strongest signal — GitHub repositories with Sigma rules, YARA signatures, or KQL hunting queries demonstrate real blue team capability. Practical training platforms such as LetsDefend, CyberDefenders, and Blue Team Labs publish completion and ranking data, which identifies analysts practising on their own time. Blue Team Con and SANS summits attract defensive practitioners specifically, and BSides events run locally in most cities. Managed security service providers are a large, experienced, and under-searched pool.