RoleMath

glossary

What is a SOC (security operations center)?

The team that monitors, detects, and responds to security threats — the common entry point for the SOC Analyst role.

Build my personalized career plan

The team that monitors, detects, and responds to security threats — the common entry point for the SOC Analyst role.

What it means

A security operations center (SOC) is, per Microsoft, "a centralized function or team responsible for improving an organization's cybersecurity posture and preventing, detecting, and responding to threats." (NIST's CSRC glossary also defines the term.)

One job title inside a SOC is SOC Analyst. Tier 1 work is described as monitoring alerts and logs and escalating real incidents, using tools that can include a SIEM.

Definitional only; see the SOC Analyst role page for the cited skills and roadmap.

These pages draw on the same sourced data, and are the closest to what you just read.

Zoom out

related glossaryWhat is a registered apprenticeship?related glossaryWhat a SOC code is

Core source records

This table lists the page’s core content records and when they were checked. Claim-specific citations appear beside the relevant text and may not be repeated here.

IDSupportsSourceChecked
CIT-01Microsoft — definition of a security operations centerMicrosoft — What is a security operations center (SOC)?2026-06-15
CIT-02NIST CSRC glossary — security operations centerNational Institute of Standards and Technology — NIST CSRC Glossary2026-06-15

Ready to turn this decision into a plan?

RoleMath planner