SOC Analyst Tiers Explained: L1 vs L2 vs L3

Job posts say "Tier 1 SOC Analyst" or "L2 Security Analyst" like everyone knows what that means. Then you ask three people and get three answers.

The honest truth is that the tier model is a common convention, not a standard. This post explains the usual split between Tier 1, Tier 2 and Tier 3, where the sources agree, where they don't, and what it takes to move up. We use SANS and Microsoft's own guidance as references, and we don't make up salaries or timelines.

What are SOC tiers?

A security operations center (SOC) gets more alerts than any one person can dig into. Tiers are a way to split the work: the first line sorts alerts quickly, and the harder ones are passed to people with more experience.

SANS describes it this way: in many SOCs, three tiers of analysts handle distinct tasks. Notice the "many". Not every SOC uses three tiers, and a small team may have one group doing everything. You will also see L1, L2 and L3, which mean the same thing as Tier 1, 2 and 3.

What does a Tier 1 (L1) SOC analyst do?

Tier 1 is the front line. SANS calls these analysts triage specialists: they "monitor an organization's security systems and pass suspicious activity to Tier 2 analysts for review."

Microsoft's guidance for the Defender portal describes Tier 1 in similar terms. The work is to triage incidents, identify priority items, assign ownership, update status and severity, add tags and comments, follow standard response procedures, and escalate when needed.

In practice, a day looks like this:

• Working an alert queue, one alert at a time
• Deciding whether each one is a real problem or a false alarm (see our post on true vs false positive triage)
• Writing down what you found so the next person doesn't redo it
• Escalating the ones you can't close, with enough detail to be useful

The skills this asks for are basic ones done well: reading logs, understanding what normal looks like on Windows and Linux, networking fundamentals, using a SIEM, and writing clearly. For a closer look at the first job, read our guide to your first SOC job.

What does a Tier 2 (L2) SOC analyst do?

Tier 2 picks up what Tier 1 escalates. SANS calls them incident responders: more experienced analysts who "investigate issues referred to them by Tier 1 analysts", with duties that "often include gathering more data, threat hunting, detection engineering, and tool creation."

Microsoft's role description is a security investigator or analyst who investigates incidents, reviews alerts and evidence, analyzes impacted assets, validates automated investigation results, performs containment or remediation actions, and documents findings.

The shift from Tier 1 is from "is this bad?" to "how bad, how far did it spread, and what do we do?" That means:

• Pulling more data than the alert gave you
• Building a timeline across hosts, users and logs
• Containing a threat, for example isolating a device or disabling an account, as part of the response
• Writing up what happened so others can act on it

A Tier 2 analyst also needs deeper skills: endpoint and network forensics, query languages like SPL or KQL, and the ability to explain a technical finding to a non-technical reader.

What does a Tier 3 (L3) SOC analyst do?

Tier 3 is the top of the analyst ladder. SANS calls them threat hunters, sitting "at the top of the analyst hierarchy", who "may study cybersecurity trends to improve the network over time."

Microsoft's description is an advanced security analyst or threat hunter who investigates complex or high-impact incidents, uses advanced hunting and threat analytics, identifies related activity, improves detections and updates incident response playbooks.

So Tier 3 is less about the next alert and more about the next thing nobody has alerted on yet:

• Hunting through data for activity that no rule caught
• Handling complex or high-impact incidents
• Turning what was learned into better detections (see detection engineering 101) and playbooks
• Often helping others learn, though how that works depends on the team

Not every SOC has this tier as a separate role. Some give those jobs to a senior Tier 2 analyst, or to a separate detection engineering or threat hunting team.

Where do the sources disagree?

Names are the messy part.

SANS labels Tier 1 as triage, Tier 2 as incident response and Tier 3 as threat hunting. Microsoft's guidance calls the Tier 1 role the incident responder and puts hunting at Tier 3. Both describe the same three layers with slightly different labels.

So when a job says "Tier 2", read the duties, not the number. A listing that says "investigate escalated incidents" is Tier 2 work. One that says "monitor the queue" is Tier 1, whatever it is called. Ask in interviews how the SOC splits the work.

How do people move up?

There is no standard timeline, and we won't give you one. Experienced analysts can also move into senior leadership roles, and SANS notes each step brings more responsibility, more specialized expertise and more chances to lead. What tends to matter is what you can show:

• From Tier 1 toward Tier 2: escalations that need no follow-up questions. You find the answer yourself more often than not. You write a clear investigation summary.
• From Tier 2 toward Tier 3: you improve the system, not just the ticket. You write or tune detections, build playbooks, and hunt without being asked.
• Along the way: learn a query language properly, learn how one host's story connects to another's, and keep a record of what you did and why.

Certifications can help show fundamentals, but they don't replace the work. If you are studying for CompTIA Security+ to get to Tier 1, the EpicDetect Atlas has a Security Principles path that covers Security+ concepts.

How do you practice for each tier?

You can practice the thinking of each tier before you have the job.

Tier 1 practice:

• Work a case where you must decide what an alert means. Our free Cases cover email analysis, SIEM correlation, endpoint forensics and threat intelligence, and the first ones are marked easy
• Play Adventures Season Zero, a free story-driven SOC investigation, from the first alert to containment across five episodes

Tier 2 practice:

• Practice building a timeline from several sources, and writing down your reasoning
• Rehearse explaining your reasoning out loud. Our SOC analyst interview questions include scenario questions for this

Tier 3 practice:

• Pick a technique, write down what it would look like in the logs, and then search for it
• Practice turning a finding into a detection rule

FAQs

What is the difference between Tier 1 and Tier 2 SOC analysts?

Tier 1 triages alerts and escalates what it can't close. Tier 2 takes the escalated incidents and investigates them in depth, including gathering more data and carrying out containment steps.

Is L1 the same as Tier 1?

Yes. L1, L2 and L3 are another way of writing Tier 1, 2 and 3.

Does every SOC have a Tier 3?

No. SANS says many SOCs use three tiers, not all of them, and a smaller SOC may have fewer. Some teams give Tier 3 work to senior Tier 2 analysts or a separate hunting team.

Do I need to start at Tier 1?

Most people start there, because it is where the work is mostly alert triage. But titles vary, so read what the job actually does.

How long does it take to get from Tier 1 to Tier 2?

There is no fixed answer, and we haven't found a source worth quoting. It depends on the team, how much you learn, and what openings exist.

TL;DR

Tier 1 triages alerts and escalates. Tier 2 investigates escalated incidents in depth and helps contain them. Tier 3 handles complex incidents, hunts for threats nobody alerted on and improves detections. The tiers are a convention, not a standard, so read job duties rather than the number. Moving up comes from showing the skills of the next tier in your current work.

Sources:

• SANS: How to Become a SOC Analyst
• Microsoft Learn: Plan an incident response workflow in the Microsoft Defender portal

How EpicDetect Can Help

Tier 1 is mostly judgment: look at the evidence, decide, explain. That is what our Cases are built around. They are free, hands-on and run in your browser.

Adventures Season Zero walks you through a full incident, and the EpicDetect Atlas lays out the learning path from foundations to SOC investigation.