The primary responsibility of a security operations center (SOC) analyst is to ensure that the organization’s information assets are protected from compromise arising from unauthorized access (Confidentiality risk), unauthorized alteration of data/information (integrity risk) and denial of service (availability risk). As such, he/she ensures the protection of IT infrastructures of the organization whether on-premise (in the data center) or cloud based (e.g. Microsoft or Oracle cloud, Azure SaaS) as well as confidential customer/business data by having visibility on all vulnerabilities, threats and threat sources for effective mitigation and defense before occurrence of a breach. This is achieved through prompt identification and detection of suspicious/malicious activities with a corresponding treatment plan in place to mitigate the impact or occurrence of such activities. Where breaches do occur, SOC analysts are primarily responsible for defending the organization from such threat by countering the attack. The Security Operations Center Analyst plays a leading role in the implementation of the cyber defense strategy of an organization by ensuring that roles and responsibilities required for the actualization of the strategy is defined and assigned while resources required/budgeted for the implementation and running of the security operations center of the organization are put to judicious use for the good of the organization. Being the custodian/process owner of security incident response plan of the organization, the SOC analyst is responsible for the development and implementation of the security incident response policy and procedure of the organization and ensures management buy-in of the process. The incident response plan should identify possible security incidents and their classification or ranking in terms of criticality/severity and impact. Then escalation procedures and accountability for the various levels/categories of incidents must be defined and the SOC analyst is duty bound in ensuring that incidents are properly escalated and treated in line the incident response plan/procedure.
The security operation center analyst must have visibility on activities performs in all information assets within an organization such as perimeter firewall, core network devices (switches, routers, intrusion prevention systems, intrusion detection systems), virtualized infrastructure (VMware, ESXi Host), enterprise servers (Windows, UNIX, LINUX), databases, enterprise backup and storage systems, endpoints (workstations, laptops, PDAs, mobile devices), voice communication devices (VOIP) and other enterprise infrastructures. Thus, he/she must ensure that at the minimum, critical assets of the organization as highlighted above are within his/her monitoring scope. To achieve this, the SOC analyst must obtain assets classification and business impact analysis (BIA) reports from the risk function to enable it prioritize its monitoring of information assets on their basis of criticality to the organization (also known as risk-based monitoring). Given resource constraint and limited licenses available on the organization's enterprise security incident/log monitoring and correlation platforms (e.g. SIEM, FIM and DAM tools), it is imperative that risk-based monitoring approach be adopted to enable the SOC analyst have adequate visibility on all information assets in the order of the most critical to the least critical. As such, the BIA and assets classification reports are used in determining assets/servers, applications and databases to be enrolled in the security information and event monitoring (SIEM) tool such as HP arcsight, file integrity monitoring (FIM) tool such as Tripwire or Cimtrak, database activity monitoring (DAM) tool such as Imperva secure sphere, in their order of criticality.
SOC Analysts maintain security incident logs for the organization, which is a database of all security incidents recorded within the organization's IT assets and detected by the security operations center (SOC) monitoring tools. The incident log is mostly reported to management on a periodic basis and to regulatory authorities as required for decision making and compliance purposes respectively. Through the incident log, the organization have visibility and grasp of the nature, type and frequency of security incidents that occur within the organization's IT infrastructure and will enable it perform root cause and impact assessment of such incidents for decision on appropriate mitigation and treatment plan to forestall future occurrence. The incident log can be fed into the problem management database (PMDB) of the organization to address reoccurring incidents that are classified as problems for adequate root cause analysis and corrective actions. Incident log can also form basis for determining the effectiveness of security measures and controls implemented within the organization IT infrastructures. From the record or log of security incidents of an organization, the SOC analyst may be required to develop training and awareness program to sensitize employees and administrators of IT infrastructures within the organization on best security practices and acceptable use of information assets that will enhance the security of the organization's information assets and infrastructure. Also, review of information security and cyber security policies and procedures may be necessitated by security incidents recorded within the organization's network to promote good practices and safe use of information and IT assets.
In addition to the above, a SOC analyst should be able to perform the following functions:
Security Operations Center Analyst and SOC Manager reports directly to the CISO of an organization.
To be endorsed as a SOC analyst, practitioners must acquire certification such as Security+, Certified Ethical Hacker (CEH) by EC Council, Certified Information Systems Security Professional (CISSP) by ISC2, Global Information Assurance Certification (GIAC) and CompTIA Advanced Security Practitioner (CASP), among others.