What Does a SOC Tier 1 Analyst Actually Do All Day?

Job postings for SOC Tier 1 analyst are vague on purpose because the role is mostly repetitive triage, and companies know "monitor alerts and investigate incidents" sounds better than the reality. Here's what the job looks like from the inside, ticket by ticket.

The queue never actually empties

You start a shift and there's a queue of tickets, usually generated by a SIEM like Splunk, Microsoft Sentinel, or QRadar. Each ticket is one alert: a login from an unusual country, a spike in outbound traffic, a file matching a YARA rule, a user account locked out five times in ten minutes. A busy SOC generates hundreds of these a day, and most of them are Tier 1's problem first.

You open a ticket. It gives you a timestamp, a source IP, maybe a username, and the rule that fired. Your job is to answer one question: is this something, or is this nothing? That's it. You're not fixing anything yet — you're deciding whether this deserves more attention.

Triage is 90% context-gathering

Say the alert is "impossible travel": a user logged in from Chicago and then, 20 minutes later, from Frankfurt. Before you decide anything you pull context:

• Check the user's normal login pattern in the SIEM — do they travel for work, use a VPN, have a laptop that misreports geolocation?
• Check if MFA was satisfied on both logins, or if the second one used a cached token.
• Look up the source IP in something like VirusTotal or AbuseIPDB — is it a known Tor exit node, a VPN provider, a residential ISP?
• Check with the user directly if your SOC's process allows it — a Slack message like "hey, were you logging in from Germany around 2pm?" resolves half these tickets in one reply.

Most of the time it's a VPN client switching servers or a phone syncing over LTE in a weird location. You write up what you found, mark it a false positive, and close the ticket. That's the job, repeated 30-60 times a shift depending on your SOC's volume and your speed.

Knowing when to escalate — and writing it up so Tier 2 doesn't have to redo your work

The real skill isn't spotting malware. It's knowing when something doesn't add up enough to escalate, and writing the escalation so Tier 2 can pick it up without re-doing your triage from scratch. A bad escalation says "suspicious login, please investigate." A good one says:

User: jsmith@company.com
Alert: Impossible travel (Chicago -> Frankfurt, 22 min apart)
MFA: Satisfied on both logins via push notification
Source IP (Frankfurt): 185.220.101.x — matches known Tor exit node list (AbuseIPDB score 94)
User response: Denies traveling or using VPN; reports no MFA prompt received for second login (possible push fatigue?)
Recommendation: Escalate — possible account compromise via MFA push spam. Recommend forced password reset and session revocation.

That writeup took maybe eight minutes but it saves Tier 2 twenty. Tickets like this — where the user denies the activity and the IP is flagged — are the ones that actually matter, and they're maybe 5% of your queue.

The tools you'll touch every single shift

Beyond the SIEM, expect to live in a handful of tools daily: an EDR console (CrowdStrike Falcon, SentinelOne, Defender for Endpoint) to check process trees and isolate hosts if told to, a ticketing system (ServiceNow, Jira) to track your work, threat intel lookups (VirusTotal, AbuseIPDB, urlscan.io) for quick IOC checks, and often a runbook or playbook document that tells you exactly what steps to follow for each alert type. Tier 1 work is heavily playbook-driven on purpose — consistency matters more than improvisation at this level.

Why the repetition is actually the training

The reason Tier 1 exists as a distinct role, rather than throwing every alert straight to senior analysts, is pattern recognition through volume. After a few hundred impossible-travel tickets you start recognizing the shape of a real one versus a routine VPN switch before you've even finished pulling context. That instinct doesn't come from a course — it comes from doing the boring version of the job long enough that the rare real incident actually stands out.

If you're mapping out a path into blue team work, Korra Studio has segments on SIEM query basics, phishing triage workflows, and what separates Tier 1 from Tier 2 responsibilities in practice.