---
title: What Does a SOC Analyst Do? A Day in the Life | Herzing College
description: Delve into a SOC analyst job. Follow a typical shift, see what tools and skills you need, and learn how to start in this entry-level cybersecurity career.
image: https://blog.herzing.ca/hubfs/SOC%20analyst.jpg
---

- English
- Français

- News / Blog
- [Contact](https://www.herzing.ca/contact)
- [Student Login](https://student5.campuslogin.com/(S(l5qa1i55nvojjoragnier23j))/StudentLoginDefault.aspx?OrgID=12200)

[![herzing-logo@2x](https://blog.herzing.ca/hs-fs/hubfs/herzing-logo@2x.png?width=164&height=33&name=herzing-logo@2x.png "herzing-logo@2x")](https://www.herzing.ca)

- [PROGRAMS](https://www.herzing.ca/programs-page/)
- [ONLINE PROGRAMS](https://www.herzing.ca/online-programs/)
- [CAMPUS SERVICES](https://www.herzing.ca/campus-services/admissions/)
- [INTERNATIONAL STUDENTS](https://www.herzing.ca/international-students/)
- [WHY HERZING](https://www.herzing.ca/why-herzing/why-choose-herzing/)
- [LOCATIONS](https://www.herzing.ca/locations/)

![menu@2x](https://blog.herzing.ca/hubfs/menu@2x.png "menu@2x")

## Herzing Blog

Expert advice to help you choose the right training program and succeed in your career.

# What Does a SOC Analyst Do? A Day in the Life

**Nov 5, 2026, 8:00:00 AM**

![Two SOC analysts focusing on a laptop](https://blog.herzing.ca/hubfs/SOC%20analyst.jpg)

# What Does a SOC Analyst Do? A Day in the Life

**Nov 5, 2026, 8:00:00 AM**

- [Herzing College \>](https://herzing.ca)
- [Blog](https://blog.herzing.ca)

### Book a Tour

X

Visit a Herzing College Campus!

### Ask a Question

X

Want to Learn More?

### Explore

X

### Is Career Training right for you?

[TAKE OUR CAREER TRAINING READINESS KIT](https://yourcareerexploration.ca/?lead_src=w-cta-box&mid=18419)

Live Chat

 

Tour

 

Ask

 

Explore

 

- [All Campuses](https://blog.herzing.ca/topic/national)
- [Montreal French](https://blog.herzing.ca/topic/montreal-fr)
- [Montreal](https://blog.herzing.ca/topic/montreal)
- [Ottawa](https://blog.herzing.ca/topic/ottawa)
- [Toronto](https://blog.herzing.ca/topic/toronto)
- [Winnipeg](https://blog.herzing.ca/topic/Winnipeg)
- [Herzing Skilled Trades Training](https://blog.herzing.ca/trades)
- [Kompass Professional Development](https://blog.herzing.ca/kompass-online-training)

#### SELECT A CATEGORY:

- Categories 
    - [All Campuses](https://blog.herzing.ca/topic/national)
    - [Montreal French](https://blog.herzing.ca/topic/montreal-fr)
    - [Montreal](https://blog.herzing.ca/topic/montreal)
    - [Ottawa](https://blog.herzing.ca/topic/ottawa)
    - [Toronto](https://blog.herzing.ca/topic/toronto)
    - [Winnipeg](https://blog.herzing.ca/topic/Winnipeg)
    - [Herzing Skilled Trades Training](https://blog.herzing.ca/trades)
    - [Kompass Professional Development](https://blog.herzing.ca/kompass-online-training)

![Two SOC analysts focusing on a laptop](https://blog.herzing.ca/hubfs/SOC%20analyst.jpg)

**A SOC analyst watches an organization’s computer systems for signs of a cyberattack. They review security alerts, investigate anything that looks suspicious, and pass legitimate threats to senior team members. It’s one of the most common entry-level jobs in cybersecurity.**

If you’ve looked at cybersecurity job postings, you’ve probably seen the title “SOC analyst” again and again. But what does the job actually involve? And what would your day look like?

In this post, we walk through a typical shift. You’ll see the tasks, tools, and skills involved, so you can decide if this career is a good fit for you.

## IN THIS POST

- [What is a SOC?](https://blog.herzing.ca/what-does-a-soc-analyst-do#whatissoc)
- [What Does a SOC Analyst Do During a Typical Shift?](https://blog.herzing.ca/what-does-a-soc-analyst-do#shift)
- [What Are SOC Analyst Tiers?](https://blog.herzing.ca/what-does-a-soc-analyst-do#tiers)
- [What Tools Do SOC Analysts Use?](https://blog.herzing.ca/what-does-a-soc-analyst-do#tools)
- [What Skills Do You Need to Be a SOC Analyst?](https://blog.herzing.ca/what-does-a-soc-analyst-do#skills)
- [How Do You Become a SOC Analyst?](https://blog.herzing.ca/what-does-a-soc-analyst-do#become)
- [Is a SOC Analyst Job Right for You?](https://blog.herzing.ca/what-does-a-soc-analyst-do#right)

 

## WHAT IS A SOC?

SOC stands for security operations centre. It’s the team that watches an organization’s networks, computers, and accounts for cyber threats.

Think of it like the security desk in an office building. Instead of watching doors and cameras, a SOC team watches computer activity. When something unusual happens, they look into it.

Some large organizations run their own SOC. Others hire an outside company to do the monitoring for them. Either way, many SOCs run 24 hours a day, because attacks can happen at any time.

 

## WHAT DOES A SOC ANALYST DO DURING A TYPICAL SHIFT?

A SOC analyst spends most of their shift reviewing alerts and deciding which ones need action. They also investigate suspicious activity, write notes, and escalate serious issues.

Every SOC works a bit differently. But here’s an example of what a shift might look like for an entry-level analyst.

### **Start of shift: Catching up**

Your shift begins with a handover from the team before you. You read their notes and check for any open incidents. Is anything still being investigated? Did anything unusual happen overnight?

### **Mid-morning: Working through the alert queue**

Security software creates alerts whenever it spots something that might be a problem. Your main job is to review these alerts one by one.

Many alerts turn out to be false alarms. For example, an employee may have typed their password wrong five times in a row. Part of your job is learning to tell the harmless alerts from the real ones.

In many SOCs, AI tools now sort alerts before an analyst sees them. Industry experts expect [more of this work to be automated](https://www.splunk.com/en_us/blog/leadership/security-predictions-2026-what-agentic-ai-means-for-the-people-running-the-soc.html). In that case, your job is to review what the AI flagged, check whether it got it right, and decide what happens next.

“AI is very good at looking into patterns and flagging things that don’t fit, that seem suspicious,” says Herzing cybersecurity instructor [Sergio Gonzalez](https://blog.herzing.ca/cybersecurity-diploma-meet-the-instructor-explore-the-program?comet_token_override=3949026419404976304639678972035915175342483499351). “But if you rely only on automation, you can have a lot of false positives. A human being still needs to double-check everything and decide what needs escalating and what does not.”

### **Late morning: Investigating a suspicious login**

An alert shows that a staff member’s account just logged in from another country at 3 a.m. But that employee usually works from Toronto during the day.

You start asking questions. Is the employee travelling? Has the account done anything unusual since logging in? Did the same account log in from two places within a few minutes? You check the logs and gather facts before you decide what to do next.

### **Afternoon: Handling a phishing report**

An employee forwards an email that looks suspicious. It claims to be from the company’s bank and asks them to click a link.

You check who really sent the email and where the link leads. If it’s a phishing attempt, you may block the sender and check whether anyone else received the same message.

### **Throughout the day: Escalating and documenting**

When something looks serious, you pass it to a more experienced analyst. This is called escalating. Knowing when to escalate is one of the most important skills you’ll build.

You also write notes on everything you investigate. Clear notes help your team understand what happened and what still needs to be done.

### **End of shift: Handing over**

Before you leave, you write handover notes for the next shift. You list any open issues and anything they should watch for. Then the next team picks up where you left off.

 

## WHAT ARE SOC ANALYST TIERS?

Many SOCs organize analysts into tiers, or levels. New analysts usually start at Tier 1 and move up as they gain experience.

Here’s how the levels typically work:

- **Tier 1:** Monitors alerts, sorts real threats from false alarms, and escalates serious issues. This is where most new grads start.
- **Tier 2**: Takes on escalated cases and investigates them in more depth. Tier 2 analysts often lead the response when an attack is confirmed.
- **Tier 3:** Hunts for hidden threats before they trigger alerts. These are the most experienced analysts on the team.

![A group of SOC analysts](https://blog.herzing.ca/hs-fs/hubfs/SOC%20team.jpg?width=1411&height=744&name=SOC%20team.jpg)*SOC analysts have different responsibilities depending on their level*

 

WHAT TOOLS DO SOC ANALYSTS USE?

SOC analysts use software that collects security data from across an organization and flags anything unusual. You don’t need to master every tool before you start, but you should know what they do.

Here are some common types of tools:

- **SIEM (security information and event management)**: Collects logs from computers, servers, and networks in one place and creates alerts.
- **EDR (endpoint detection and response)**: Watches individual devices, like laptops and phones, for signs of an attack. Many SOCs now use **XDR (extended detection and response)**, which goes beyond devices to pull in data from networks, email, and cloud systems.
- **Firewalls**: Control which traffic can enter or leave a network.
- **Ticketing systems**: Track each alert or incident from start to finish.

 

## WHAT SKILLS DO YOU NEED TO BE A SOC ANALYST?

You need a mix of technical skills and people skills. Technical skills help you spot problems, while people skills help you explain them.

On the technical side, it helps to understand:

- How computer networks work
- How Windows and Linux systems work
- How to read and make sense of log files
- Common types of attacks, like phishing and malware

People skills matter just as much. Sometimes you’ll need to explain a problem to a worried client or manager before you have all the details. That means sharing what you know, being honest about what you don’t, and keeping the other person calm.

The job also involves making a lot of decisions, often with incomplete information. You constantly ask yourself questions like: Is this alert harmless? Should I escalate it? How much damage could be done if I get this wrong?

And you don’t typically have a lot of time to make those decisions.

“For example, in one of my previous jobs, we had a contract with customers that if there was something wrong with the network, like an intruder or an attack, they have to be advised within 15 minutes,” says Sergio.

“So from the moment you saw something suspicious, you had 15 minutes to gather information and decide if this was a real incident or just something that was normal behaviour on their network. You have to do your best with the information you have.”

 

## HOW DO YOU BECOME A SOC ANALYST?

Most people become SOC analysts by completing cybersecurity training and getting hands-on practice. Then they apply for Tier 1 or junior analyst roles.

Here are the main steps:

### **Get the Right Training**

A cybersecurity program teaches you about networking, operating systems, and how attacks work. Herzing offers [cybersecurity diplomas](https://www.herzing.ca/programs/cybersecurity?comet_token_override=3949026419404976304639678972035915175342483499351) and a [Bachelor of Applied Cybersecurity](https://www.herzing.ca/programs/bachelor-of-applied-cybersecurity?comet_token_override=3949026419404976304639678972035915175342483499351), all of which include hands-on labs as well as internships or work-integrated learning.

Read more: [Cybersecurity Diploma vs. Degree: What’s the Real Difference?](https://blog.herzing.ca/cybersecurity-diploma-vs.-degree?comet_token_override=3949026419404976304639678972035915175342483499351)

### **Keep Learning**

Certifications show employers you have a tested level of knowledge. [CompTIA Security+](https://www.comptia.org/en/certifications/security/) is a good starting point that covers core cybersecurity concepts, but it isn’t specific to SOC work. Consider SOC-focused training and learning paths from platforms like [CyberDefenders](https://cyberdefenders.org/tracks/soc-analyst-tier-1/) and [TryHackMe](https://tryhackme.com/path/outline/soclevel1).

### **Practise on Your Own**

Free online challenges and practice labs let you build skills outside class. They also give you real examples to talk about in interviews. Herzing students are given a lab that can be downloaded at home, and you can use it on your own to simulate real case scenarios.

“Don’t get stuck in your ways,” advises Sergio. “You have to evolve and adapt to changes by reading articles, testing tools on your own, and learning on your own. At Herzing, we put a lot of effort into making our students be independent enough to learn new tools so that they are prepared for future challenges.”

 

## IS A SOC ANALYST JOB RIGHT FOR YOU?

A SOC analyst job could be a great fit if you enjoy solving puzzles and paying close attention to details. You’ll also need to be comfortable with shift work and staying calm when an alert turns out to be real.

If that sounds like you, cybersecurity training can help you get started.

 

**Ready to Start a Career in Cybersecurity?**

Herzing can help you build the skills employers look for in entry-level security roles. You’ll learn through hands-on labs and get support from our career development team when it’s time to job hunt.

Click below to explore our cybersecurity programs and chat live with an admissions advisor. We’re here to help!

[**Explore our programs**](https://www.herzing.ca/)

 

## FREQUENTLY ASKED QUESTIONS

 Is SOC analyst an entry-level job?

Yes. A Tier 1 SOC analyst role is one of the most common ways to get started in cybersecurity. Employers usually look for cybersecurity training, a basic understanding of networks, and some practical experience.

 Do SOC analysts need to know how to code?

Not usually for entry-level roles. Basic scripting skills can help you work faster, but most Tier 1 work involves reviewing alerts and logs, not writing code.

 How much do SOC analysts make in Canada?

The Government of Canada Job Bank doesn’t list wages for SOC analysts specifically. But for the broader group of cybersecurity specialists, [hourly wages in Canada](https://www.jobbank.gc.ca/marketreport/wages-occupation/296427/ca) range from about $30 to $72, with a median of $49.52. New analysts typically start toward the lower end of that range.

 What’s the difference between a SOC analyst and a cybersecurity analyst?

The titles often overlap. A SOC analyst is a type of cybersecurity analyst who focuses on monitoring and responding to threats. “Cybersecurity analyst” is a broader title that can also include tasks like risk assessments and security planning.

 What certifications help you get hired as a SOC analyst?

There are no specific certifications that cover the SOC analyst role. [CompTIA Security+](https://www.comptia.org/en/certifications/security/) can be a good starting point because it builds a foundation in cybersecurity concepts. For more SOC-specific preparation, look at learning options from [CyberDefenders](https://cyberdefenders.org/tracks/soc-analyst-tier-1/) or [TryHackMe](https://tryhackme.com/path/outline/soclevel1).

 Will AI replace SOC analysts?

AI is changing the job, but employers still need people to do it. Many SOCs use AI to handle repetitive alert sorting, and experts [expect more of that work to be automated](https://www.splunk.com/en_us/blog/leadership/security-predictions-2026-what-agentic-ai-means-for-the-people-running-the-soc.html). A 2026 survey also found that AI is likely to [eliminate some entry-level SOC positions](https://letsdatascience.com/news/survey-finds-ai-reshapes-soc-staff-roles-137d6c2e).

At the same time, analysts are taking on new tasks. They oversee AI tools, check their results, and investigate the cases AI can’t solve. That means skills like judgment, investigation, and a solid understanding of how attacks work matter more than ever.

 

Tags:

[Technology](https://blog.herzing.ca/topic/technology)

![hard hat icon](https://blog.herzing.ca/hubfs/ic-hard-hat.png "hard hat icon")

## Herzing Skilled Trades Training

[![SKILLED TRADES BLOG](https://no-cache.hubspot.com/cta/default/386626/67ee5376-52fa-4e5b-9b81-a6ec00f6e798.png)](https://cta-redirect.hubspot.com/cta/redirect/386626/67ee5376-52fa-4e5b-9b81-a6ec00f6e798)

 SHARE THIS POST

- [Tweet](https://twitter.com/share)

### Categories

- [News and Events](https://blog.herzing.ca/topic/news-and-events)
- [Training](https://blog.herzing.ca/topic/training)
- [Careers and Employment](https://blog.herzing.ca/topic/careers-and-employment)
- [Student Services](https://blog.herzing.ca/topic/student-services)
- [Business](https://blog.herzing.ca/topic/business)
- [Design](https://blog.herzing.ca/topic/design)
- [Education](https://blog.herzing.ca/topic/education)
- [Healthcare](https://blog.herzing.ca/topic/healthcare)
- [Legal Studies](https://blog.herzing.ca/topic/legal-studies)
- [Media](https://blog.herzing.ca/topic/media)
- [Technology](https://blog.herzing.ca/topic/technology)

- [Toronto Campus Blog](https://blog.herzing.ca/topic/toronto)
- [Winnipeg Campus Blog](https://blog.herzing.ca/topic/winnipeg)
- [Ottawa Campus Blog](https://blog.herzing.ca/topic/ottawa)
- [Montreal Campus Blog](https://blog.herzing.ca/topic/montreal)
- [Blogue du Campus de Montréal](https://blog.herzing.ca/topic/montreal-fr)
- [Kompass Professional Development](https://blog.herzing.ca/topic/kompass-professional-development)
- [Business and Affairs](https://blog.herzing.ca/topic/business-and-affairs)
- [All Campuses](https://blog.herzing.ca/topic/national)
- [scarborough](https://blog.herzing.ca/topic/scarborough)

### Most Read

### READY FOR THE NEXT LEVEL?

## TAKE THE NEXT STEP

#### Fill in the form bellow and one of our representatives will help you with documents and requirements to enrol in this program.

![ballot-check@2x](https://blog.herzing.ca/hubfs/ballot-check@2x.png "ballot-check@2x")

## YOUR NEXT MOVE

## ARE YOU CAREER TRAINING READY?

The fun, online quiz takes 3-minutes to complete and you'll get a personalized report. Identify your strengths and social style plus the training and positions you're best suited for.

[![Try the Career Exploration Kit](https://no-cache.hubspot.com/cta/default/386626/81ed767d-18d4-4a37-81be-52ed95ec12bc.png)](https://cta-redirect.hubspot.com/cta/redirect/386626/81ed767d-18d4-4a37-81be-52ed95ec12bc)

- [WHY HERZING](https://www.herzing.ca/why-herzing/why-choose-herzing/)
- [PROGRAMS](https://www.herzing.ca/programs-page/)
- [LEARN ONLINE](https://www.herzing.ca/online-programs/)
- [LOCATIONS](https://www.herzing.ca/locations/)

- [STUDENT LOGIN](https://student5.campuslogin.com/(S(l5qa1i55nvojjoragnier23j))/StudentLoginDefault.aspx?OrgID=12200)
- [ONLINE STUDENT LOGIN](https://herzingcollege.lambdasolutionscloud.net/)

[![her-ic-facebook@2x](https://blog.herzing.ca/hs-fs/hubfs/her-ic-facebook@2x.png?width=15&height=30&name=her-ic-facebook@2x.png "her-ic-facebook@2x")](https://www.facebook.com/herzingwinnipeg)

[![her-ic-twitter@2x](https://blog.herzing.ca/hs-fs/hubfs/her-ic-twitter@2x.png?width=37&height=30&name=her-ic-twitter@2x.png "her-ic-twitter@2x")](https://twitter.com/herzingcolleges)

[![her-ic-youtube@2x](https://blog.herzing.ca/hs-fs/hubfs/her-ic-youtube@2x.png?width=43&height=30&name=her-ic-youtube@2x.png "her-ic-youtube@2x")](http://www.youtube.com/channel/UCsOQ0vItHHWK1echfbQPgkQ?sub_confirmation=1)

[![her-ic-blog@2x](https://blog.herzing.ca/hs-fs/hubfs/her-ic-blog@2x.png?width=30&height=30&name=her-ic-blog@2x.png "her-ic-blog@2x")](https://blog.herzing.ca)

[![instagram\_white](https://blog.herzing.ca/hs-fs/hubfs/instagram_white.png?width=64&height=64&name=instagram_white.png "instagram_white")](https://blog.herzing.ca)

- [Careers](https://www.herzing.ca/why-herzing/careers-at-herzing/)
- [Policies](https://www.herzing.ca/privacy-policy/)

### Herzing College is not affiliated, associated, authorized, endorsed by, or in any way officially connected with Herzing University, or any of its subsidiaries or its affiliates.

### Copyright © Herzing College

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Herzing Blog",
    "url" : "https://blog.herzing.ca/author/herzingblog"
  },
  "dateModified" : "2026-11-05T13:00:00.199Z",
  "datePublished" : "2026-11-05T13:00:00.000Z",
  "headline" : "What Does a SOC Analyst Do? A Day in the Life | Herzing College",
  "image" : [ "https://blog.herzing.ca/hubfs/SOC%20analyst.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://blog.herzing.ca/what-does-a-soc-analyst-do",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4081/img/vast.png"
    },
    "name" : "Herzing Canada"
  }
}
```