SOC Analyst job description template

Last updated 2026-10-22

Short answer

A good SOC analyst job description lists concrete responsibilities, separates required from preferred skills, names the tools and states contract type, location and work authorization. Use the template below and edit the bracketed fields.

Staffing teams write or rewrite job descriptions all the time: to post a requirement, to brief a recruiter or to tailor a resume. This SOC analyst template is a starting point built from the skills and tools that decide a fit.

Copy-ready job description

Edit the bracketed fields for your requirement.

SOC Analyst

About the role
We are looking for a SOC Analyst to join our team. You will monitor security alerts around the clock or in shifts.

Responsibilities
- Monitor security alerts around the clock or in shifts.
- Triage and investigate events.
- Escalate confirmed incidents.
- Document findings.
- Tune detections with engineers.

Required
- SIEM monitoring (Splunk, Sentinel, QRadar)
- Alert triage and escalation
- Incident response basics
- Network and endpoint fundamentals
- Ticketing and documentation

Preferred
- EDR tools
- MITRE ATT&CK
- Scripting
- Threat hunting
- Security+ or similar certification

Tools and stack
Splunk, Sentinel or QRadar, EDR tools, Ticketing, MITRE ATT&CK, Threat intelligence, Playbooks

Employment type: [Contract / W2 / C2C / Full-time]
Location: [City, ST / Remote]
Duration: [months]
Work authorization: [accepted types]

Responsibilities explained

Each responsibility maps to something a candidate should be able to describe.

  • Monitor security alerts around the clock or in shifts.
  • Triage and investigate events.
  • Escalate confirmed incidents.
  • Document findings.
  • Tune detections with engineers.

Required skills

Treat these as the screen. If a candidate cannot speak to them, they are rarely a fit.

  • SIEM monitoring (Splunk, Sentinel, QRadar)
  • Alert triage and escalation
  • Incident response basics
  • Network and endpoint fundamentals
  • Ticketing and documentation

Preferred skills

Use these to rank candidates who meet the required list.

  • EDR tools
  • MITRE ATT&CK
  • Scripting
  • Threat hunting
  • Security+ or similar certification

Other titles this role appears under

Search and post under the variants your clients use.

  • SOC Analyst
  • Security Operations Analyst
  • Cyber Defense Analyst
  • Tier 1/2 SOC Analyst

Seniority guide

Pick the level you need and state it plainly in the posting.

  • Tier 1: triages alerts using runbooks.
  • Tier 2: investigates and contains.
  • Tier 3: hunts threats and improves detections.

Tailoring a resume to this description

When you submit a consultant, mirror the required skills and tools in the summary and the most recent role, using only experience the candidate really has. MatchWire’s resume tailoring drafts this from the candidate’s stored work history and the posting.

Frequently asked questions

How long should a job description be?

Long enough to list the responsibilities, required and preferred skills, tools and logistics, usually 300 to 500 words.

Should I list a rate in the description?

If the client allows it, a range helps candidates self-select. Otherwise state it as “rate to be discussed” and confirm it before submitting.