SOC tiers are the levels a security operations center (SOC) uses to sort analyst work by difficulty. Tier 1 analysts triage incoming alerts and decide which ones are real. Tier 2 analysts investigate what Tier 1 escalates and decide how to contain an incident. Tier 3 analysts hunt for threats no alert has flagged and handle the most serious incidents. A SOC manager oversees the whole chain.
SOC tiers are the three analyst levels, often called L1, L2, and L3, that divide security operations work by complexity and authority.
The escalation path between tiers keeps experienced analysts off alerts that turn out to be noise, and it keeps junior analysts from making high-consequence calls alone. When a Tier 1 analyst is unsure, the case moves to someone with more context and authority.
Tier numbers come from industry convention, and no standards body defines them. The NICE Framework, available through CISA's NICCS portal, describes cybersecurity work as roles defined by tasks, knowledge, and skills, and SOC managers can use it as a practical reference when writing each tier's job description. SOC tiers are also unrelated to SOC 1, SOC 2, and SOC 3, which are System and Organization Controls audit reports about a service provider's controls.
A Tier 1 analyst watches the alert queue, usually in a SIEM, and decides whether each alert is a real threat or a false positive. The work runs on runbooks, also called playbooks, that tell the analyst which checks to run for each alert type. Typical checks include looking up a flagged IP address against threat intelligence or confirming whether a login came from a known device. The analyst records the decision in a ticket, and either closes the alert or escalates it.
Escalation criteria usually live in the runbook. A Tier 1 analyst escalates when an alert matches a confirmed indicator of compromise, involves a critical asset or privileged account, or falls outside the runbook's scope.
Tier 1 is the SOC's entry point, typically staffed by analysts with up to two years of experience. CompTIA's cybersecurity career pathway places Security+ at the foundational level, and it is a common baseline for the role. The steps inside triage, from enrichment to the close-or-escalate decision, are covered in the SOC alert triage guide.
A Tier 2 analyst investigates alerts Tier 1 escalates and decides whether they constitute an incident. That means correlating evidence across sources such as endpoint telemetry, identity logs, network traffic, and cloud audit trails to build a timeline of what happened. From that timeline, Tier 2 scopes the incident by working out which hosts, accounts, and data are involved.
Tier 2 usually holds containment authority. When the evidence shows an active compromise, a Tier 2 analyst can isolate an endpoint, disable an account, or block a domain, normally following the organization's incident response plan. Cases that are novel, widespread, or tied to a sophisticated attacker go up to Tier 3. Analysts at this level typically bring two to five years of experience.
Tier 3 analysts look for threats that no alert has caught. Threat hunting starts from a hypothesis, such as an attacker using a legitimate admin tool to move between servers, and tests it against the environment's data. Tier 3 also leads response to major incidents and performs deep forensics on compromised systems. Its analysts write detection rules, a practice called detection engineering, so the next attack triggers a Tier 1 alert.
The tier also carries the SOC's mentoring load. Tier 3 analysts typically have five or more years of experience, review difficult Tier 2 cases, and train the analysts below them.
The SOC manager sits above the three-tier escalation chain and owns the people and processes that make escalation work. That includes hiring, training, and evaluating analysts; writing and updating runbooks; reviewing incident reports; and running crisis communication during a major incident.
The SOC manager typically reports to the CISO and is accountable for the SOC's budget, audit readiness, and shift staffing. When a case spans more than one tier or team, the manager decides who owns it and ensures a smooth handoff.
The tier model assumes each tier can keep up with the work coming from the tier below. That assumption fails first at Tier 1, where alert volume grows with every new data source and detection rule while headcount stays flat. The 2025 ISC2 Cybersecurity Workforce Study found that 49% of enterprise organizations with 10,000 or more staff are still implementing cybersecurity hiring freezes. When the queue outpaces staffing, Tier 1 closes alerts faster on thinner evidence, and Tier 2 inherits incomplete escalations.
Many analysts also investigate with only partial data. In our 2026 agentic security survey, 84% said their current tools cannot access all their log data, and 65% said at least one investigation stalled because data was trapped in a system their tools couldn't reach.
Partial access breaks escalation at both handoffs. A Tier 1 analyst who cannot see the relevant identity or firewall logs may close a real intrusion as benign, and that case never reaches Tier 2. A Tier 2 analyst whose timeline depends on logs in an unreachable archive has to wait, ask another team for an export, or close the case with a gap. Stalled escalations also stretch detection time, and the guide on reducing mean time to detect covers that metric.
The SANS 2026 SOC Survey found that 79% of SOCs use AI or ML tools, yet only 36% have built them into a defined SOC workflow. An AI tool that triages on the same partial data inherits the same blind spots. A tool with no defined place in the escalation chain adds another output stream for an already stretched analyst to check.
One response to this strain is the tierless SOC, where a single analyst carries a case from first alert to closure with no handoffs between levels. We keep the tiers because the escalation chain still stops junior analysts from making high-consequence calls alone, and the pressure points above come from alert volume and partial data, which agents and full log access fix inside the structure SOC teams already run.
AI agents fit within existing tiers by taking on repetitive triage and investigation work at Tier 1 and Tier 2, plus coordinating escalations. Humans keep Tier 3 for hunting and approve any action with real-world consequences.
Our Pre-Built SOC Package is modeled on a modern SOC team. It covers alert assessment, root cause analysis, forensic collection, and SOC management, coordinated by a team of micro agents.
A micro agent is an AI agent with one bounded job, a defined knowledge graph, and access only to the tools that job requires. Our software controls that tool access through Model Context Protocol (MCP) connectors. Coordinator agents split a case into tasks and route results between specialist agents, much as a shift lead hands work from one analyst to the next.
The package integrates with the SIEM, SOAR, and observability tools a SOC already runs. These are analyst tiers, which are separate from the maturity stages described in this piece on agentic SOC automation tiers. Providers running these tiers across many clients can see how the model extends to multi-tenant SOC automation for MSSPs.
The SOC Level 1 Agent’s knowledge graph structures the entities and relationships triage depends on, such as which hosts, users, and earlier alerts connect to the one in front of it. The MCP connectors expose only the lookups triage needs. The agent's workflow mixes deterministic steps, like a fixed sequence of reputation and asset checks, with cognitive steps where the agent reasons about whether the activity fits the user's normal pattern.
But AI agents can hallucinate, so deterministic steps and logged reasoning let reviewers catch a wrong verdict. A Tier 1 analyst reviewing a sample of agent-closed alerts can see exactly which checks ran and why the agent reached its verdict.
The SOC Level 2 Agent receives escalated cases from the coordinator agent. Manual enrichment and correlation is where human Tier 2 time goes before scoping can start, and this agent absorbs that work.
The agent enriches each escalated alert with context from threat intelligence, user behavior, and historical data, then runs root-cause analysis. It groups related alerts into a single case through alert-to-incident correlation, so many firings from one intrusion become one incident with one timeline. The human Tier 2 analyst starts with that correlated case and a proposed root cause, and retains scoping judgment and the containment decision.
The SOC Manager Agent tracks each case through triage, investigation, and handoff, and routes work to the right specialist agent or human queue. It logs every action in a verifiable audit trail. That keeps escalations from stalling between layers and gives the human SOC manager a record of where each case went and why.
The human manager handles everything that requires judgment and accountability: staffing, runbook and process changes, incident report review, crisis communication, and CISO reporting. They also oversee the agents, review audit trails after an incident, and decide which verdict categories need more human review.
Human-in-the-loop means explicit human approval gates placed in front of actions with real-world consequences.
In the SOC package, these actions sit behind a gate:
Agents investigate autonomously up to that point and prepare the case, evidence, and a recommended action; a human then approves or rejects it before anything executes. The approval and its reasoning go into the same audit trail as the agents' work.
A hunt starts from a hypothesis about how an attacker might operate in one specific environment. Forming that hypothesis requires judgment about the business, its systems, and current attacker behavior, and a micro agent with one bounded job isn't designed to hold that breadth. Major incident response and detection engineering carry similar weight, because a bad call or a bad rule affects the whole SOC.
Agents do change the material hunters work with. When Tier 1 and Tier 2 cases arrive correlated, enriched, and logged, Tier 3 analysts spend less time reconstructing what happened below them and more time on hunts and detection work.
No. Agents take over repetitive work in Tier 1 and Tier 2, and analysts keep decisions that depend on business knowledge and accountability for outcomes. The table above shows that split tier by tier.
Security leaders are not ready to hand those decisions to agents. In the same 2026 survey of 100 security leaders, just over half of respondents cited distrust of agent outputs as a barrier to adoption. Human approval gates directly address that concern. An agent can assemble the evidence for isolating an endpoint, but the isolation runs only after an analyst approves it.
What changes is how analysts spend a shift. In a SOC running triage agents, a Tier 1 analyst works less of the raw queue and spends more time checking agent verdicts against the audit trail and correcting runbooks when a verdict is wrong. A Tier 2 analyst starts from a correlated case and a proposed root cause rather than building the timeline by hand.
Tier 1 has always been where future Tier 3 hunters learn the job, so a manager who hands triage to agents has to decide how they'll learn instead.
In a May 2026 ISC2 survey of 856 professionals who use AI at work, 56% said AI has reduced the need for entry-level positions over the past year.
Cutting Tier 1 headcount saves salary now and leaves the SOC short of trained Tier 2 candidates later. The alternative is to change what Tier 1 analysts do. As agents take over first-pass triage, existing Tier 1 analysts can oversee and validate agent workflows, keeping them close to real alerts.
A workable plan includes these practices:
The SANS 2026 survey found meaningful work was the top SOC retention driver for the third year running, so validation work designed as real learning also helps the SOC keep the analysts it trains. The SOC modernization roadmap covers how to sequence this staffing change alongside tooling and process updates.
Start where volume is highest, and decisions are easiest to check. Tier 1 triage usually comes first, because the work is repetitive, runbook-driven, and straightforward to validate against a sample of closed alerts. Tier 2 enrichment and correlation follows once the team trusts the Level 1 verdicts, and escalation coordination comes with it.
Before handing any tier's work to agents, confirm they can access the logs those investigations depend on. Then ask which data sources the agent can query, how its reasoning is logged, where its approval gates sit, and what your Tier 1 analysts will do once it runs.
Our Pre-Built Agent Packages place the SOC Level 1, SOC Level 2, and SOC Manager agents within the tiers you already staff, with human approval for isolation, lockout, and remediation, plus an audit trail for every action.
To see how they would handle your own Tier 1 and Tier 2 queue, request a demo. The session is a live agent demonstration with honest Q&A, so bring your toughest questions about what "agentic" means in practice.
Yes. Tier 1 is the usual entry point into a SOC, typically filled by analysts with up to two years of experience who work from runbooks and escalate what they cannot resolve. In SOCs that hand first-pass triage to agents, Tier 1 work can shift toward validating agent verdicts, which still gives new analysts exposure to real alerts.
No. Agents take over the repetitive parts of Tier 1 triage and Tier 2 enrichment and correlation, and human analysts keep threat hunting, detection engineering, major incident response, and approval over any action with real-world consequences. The analyst role does change. In a 2026 ISC2 survey, 56% of professionals who use AI at work said it has reduced the need for entry-level positions. In SOCs that run triage agents, Tier 1 analysts spend more of their shift validating agent verdicts and correcting runbooks.
They are audit reports and have nothing to do with analyst tiers. Here, SOC stands for System and Organization Controls. A SOC 1 report covers controls relevant to a client's financial reporting, and a SOC 2 report covers controls related to security, availability, processing integrity, confidentiality, and privacy. SOC 3 is a shorter, general-use summary of SOC 2 results.
Expectations vary by employer. Tier 1 analysts often hold CompTIA Security+. Tier 2 analysts often add an analyst or incident-handling certification such as CompTIA CySA+, GIAC GCIH, or EC-Council ECIH. Tier 3 analysts tend to hold specialized credentials in forensics, threat hunting, or detection engineering.
Five or more years is typical. Common experience bands are up to two years at Tier 1, two to five years at Tier 2, and five or more at Tier 3. Analysts with early hands-on investigation and hunting exposure can move faster.
Mostly, yes. Managed security service providers (MSSPs) use the same Tier 1, 2, and 3 escalation chain, but each tier works across many client environments at once. Runbooks, escalation criteria, and approval contacts differ for each client, making Tier 1 volume heavier and inter-tier coordination more complex than in a single-company SOC.
