﻿CW 222 Transcript Welcome to the InfoSec Career Video Series.
These set of short videos will provide a brief look inside cybersecurity careers
and the experience needed to enter them. Today, I’ll be speaking with InfoSec’s skills author,
Mark Viglione, about the role of SOC analyst. So let’s get into it. Welcome, Mark.
Thanks, Chris. Mark, let’s start with
the basics. What is a SOC analyst? Also, for people who are just getting started, what does
SOC stand for? What does a SOC analyst do? Sure. SOC stands for security operation center.
Essentially, what these analysts do is they work in some form of operation center where they have
different teams, different tiers of analysts. Typically, what they do, their day consists of
monitoring, a lot of eyes on glass, a lot of looking at different tools and alerts. They try to
triage what’s important, and what’s not, and what needs the best and what doesn’t need the best. A
lot of hands on, a lot of looking at glass. Okay. Are there other levels of SOC analysts?
Do you start at one level and then the tasks sort of increase as your experience grows?
Yeah, definitely. A lot of – different organizations call different things. Sometimes
within a SOC, you’ll have different tiers, whether it’s a SOC, and then it goes to incident response,
and maybe advanced threat hunting, they might put all of that in the SOC. But yeah,
there’s definitely different tiers and different experience levels for these individuals.
Okay. Now, how does one become a SOC analyst? Is this an
entry level position or do you need experience in other aspects of cybersecurity first?
Yeah. I would say, it’s typically an entry or junior level position. A lot of times, you’ll get
either some – college kid, if you have the right degrees, stuff like that, you kind of
get into the field. Do a couple years of tier one work, and then you get into SOC. So yeah,
it’s definitely something that’s a more junior, but also can be an entry level as well.
Okay. Are there particular education or certification requirements that you need to
get in or can you just go on unexperienced alone? Are there particular certs that
specially help in this regard? Yeah. I would say, along with like,
depending on your experience, or education, if you have a degree in IT or as a security
potentially in general. I would say there’s a lot of the certs like Security+,
is a great resource to get into. Again, this is not like, a senior level role. So you know,
you’re not supposed to get a lot of different high advanced certs, but like Security+ or SSCP,
stuff like that probably gives you a good edge to getting that.
Okay. What skills, whether hard skills or soft skills does a SOC analyst need to do their job
well, whether it’s the tech background, or just things like, yeah, like you said, being able
to read lots of data and interpret it. What are the skill sets for a SOC analyst?
I think it’s really two parts. I think there’s the technical side,
which you have to have. Like the analytics, you have to be able to
interpret that, and want to do that, and find it funny because you’ve be doing a lot
[inaudible 00:03:00] and different alerts. And then also the soft skill side, where you
need to present your findings to either your team member, maybe your SOC manager, or maybe there’s
an IT director who has no idea what was some of the technical jargon is and they still need to
know. Those soft skills are just as important, I think as the technical skills as well.
Okay. And you sort of grow in levels by sort of getting better at interpreting those numbers and
finding sort of higher-level ways to sort of like crunch the data, I imagine.
Exactly, yeah. As you start to like, for instance, “Oh! What is this alert?” Then it moves into like,
“How can I solve this? If not, I pass it up.” And then, obviously, you’re the one who solves it, and
then, yeah, so it’s all different progression perhaps.
Okay. We always ask about different tools that SOC analysts use or all the careers use. But I
imagine, the SOC analyst is especially tool heavy. Can you talk about some of the tools
that SOC analysts use to do their work? Yeah, sure. So I would say, depending on the
organization, and the panel, the size and what you’re using, you’re going to use a lot of either
open source tools or commercial. I would say on the commercial side, a lot of them are going to be
commercial sims, like algorithm RSA, Splunk, all these giant tools that are spitting off
logs. And then tons of alerts you’re going to be looking at every single day. Also,
intrusion detection systems. If you’re a smaller shop and you’re on the open-source side, Suricata.
If you want to use some of the Cisco products, you have like Firepower and all those different things
on the commercial side. It’s a lot of tools that are either spitting off alerts via network data,
or sims where it’s like everything to a lot of different tools.
If you’re wanting to get into SOC analyst as a job, would you recommend just getting
some of the open-source tools and playing around with them yourself
on your own so you have a comfortableness of? Yeah. I would absolutely recommend that because
it gives you a hands-on experience. You might not use the exact tool on the job you end up getting,
but you’ll probably use a version of that to tool at that job. That experience
will help you with interview process and also when you’re on the job working, crunching data.
Okay. For people who are interested in doing SOC analyst as a job,
can you move into other roles if you find that this isn’t what you like? Is this a good job
that you can pivot into other places with? Yeah, absolutely. It’s a really good, like I said,
entry, middle level job for security professionals, I think for sure. Because
there’s a lot of different roles you can grow into. Again, sometimes, on the SOC
team, you can go into incident response, which is more responding. You can go into threat hunting,
which are just actively probing. And then also as a penetration tester. They always say like,
it’s great knowing how to defend your network, the blue team work, and then we transition over to
the pen testing, having both of those skill sets. So it’s definitely, definitely a lot of areas to
grow. You’re not like locked in on, “Okay. This is the only thing I’m going to be doing.
Okay. As we wrap up today, for our listeners who are ready to get started,
what’s something they can do right now, right after this video ends,
that would move them towards the goal of becoming a professional SOC analyst?
Yeah. I think there are couple of things. I think, reviewing different content,
looking at different course. Where some are like the ones at InfoSec and just understanding,
diving to some of that knowledge base and doing some training. Then also, just reading blogs and
staying active in the community. Because it seems, a lot of security changing every day, and you got
to be keeping up with it. That looks really impressive to employers as well, when you’re
actively probing for that stuff. Definitely just doing a lot caption flag as well around different
stuff so you’re getting experience. Are there any kind of experience-based
things that you could do to sort of put on your resume even before you have a job?
Can you show your ability to use a tool or do something with your own network like that?
Yeah. I think a great thing is like building a home lab.
I know now a lot of people, colleagues do that, and they put that on their resume,
they put down [inaudible 00:06:56] different attacks and this is how I use this tool,
so it’s not just reading a book. It’s also just building it hands-on, so it’s definitely a great
advantage. Mark Viglione,
thank you for your time and experience.
Yeah, thank you. Appreciate it. And thank you all for watching this episode. If
you’d like to know more about other cybersecurity job roles, please check out the rest of InfoSec’s
Career Video Series. We’ll see you next time. © 2022 Cyber Work