Junior SOC Analyst
Tier-1 alert triage. Close the false positives, escalate the rest, learn the playbooks.
The realistic entry into security, with all the SOC warnings applied early. Take it knowing what comes with it.
- Domain
- Cybersecurity
- Entry
- £32–52k
- Senior
- £95–135k
- You want into security and don't have an internal mover's advantage
- You've actually checked you can handle shifts, not just assumed
- You're targeting detection, IR or threat hunting within two years
- You can write a clean ticket under pressure
- You haven't done any structured study, the bar is real even for tier 1
- You can't bear repetitive triage even in moderation
- You picture yourself in offensive work, this isn't the right on-ramp
What "doing well" looks like in the seat
- Your closed tickets stay closed
- You start spotting the false positives others miss
- You're volunteering for purple-team exercises and IR shadowing
- You're studying detection logic, not just consuming alerts
The first eighteen months are unforgiving. Repetitive triage, rotating shifts, and a constant feeling of running just to stay still. The analysts who progress are the ones who treat the seat as a deliberate apprenticeship: study during quiet shifts, volunteer outside the queue, write something every week. The ones who don't end up senior SOC analysts at the same employer five years later, with the same skills and the same sleep deficit.
Tradeoffs at a glance
Hover any chip for the calibrated meaning. Ratings are directional, not absolute.
Promotion ceiling
Promotes to SOC Analyst / Tier-2 in 12–24 months; ceiling depends on detection or IR pivot.
Who actually gets in
- +Help desk
- +Desktop support
- +Self-taught (TryHackMe SOC path)
Common misconceptions
- −That junior SOC means doing exciting investigations. It means triaging Defender alerts on a shift rota.
Where this leads
- SOC Analyst
- Detection Engineering
- DFIR
Certifications people pair with this
Listed because the graph connects them to this role, not because you need all of them. Most practitioners pick one or two.
Pathways that pass through here
What this is based on
Practitioner assessment checked against published external evidence.
Last reviewed: September 2026 · UK market · Confidence: indicative
The next step
You've read about the role. The harder question is whether it's the right one for you.
A Career Verdict is the written, practitioner-authored call on your specific route into and out of this role. Six primitives, same format every time.
A route shows what is possible. A Career Verdict makes the call.
Career Verdict
Helpdesk → Security Architect
- 01The callA clear judgement on whether your route is realistic, and under what conditions.
- 02Where the route breaksThe most likely point to stall, and why it happens in practice.
- 03What to do nextSpecific priorities for the next 6–24 months, and what to drop.
Career Verdict
- The callA single written judgement on whether the route is realistic for you.
- Plateaus and failure modesThe flat years and the specific ways this route tends to stall.
- Where you standThe strongest and weakest parts of your current position, named.
- Salary realityWhat this route actually pays, set against what you've been told it pays.
Usually within minutes of payment. Kept 24 months, then deleted. Deletion on request at any time.
Built on POST's practitioner-authored assessment framework, informed by two decades across helpdesk, infrastructure and security. The verdict applies that framework to your inputs.