Who Does What in a Security Operation Centre? Tier 1, 2 and 3 Analysts Compared 

A Security Operation Centre (SOC) helps businesses monitor their IT environments, detect suspicious activity and respond to cybersecurity threats. Behind these operations are security analysts working in different roles, so every potential threat gets the right level of attention. 

Tier 1 analysts monitor and review alerts, Tier 2 analysts investigate suspicious activity, and Tier 3 analysts handle complex threats and advanced threat hunting. Each tier adds to a more structured approach to cybersecurity monitoring and incident response. 

For businesses considering SOC services, understanding these roles shows how security teams work together to protect systems, users and business data. 

1. Tier 1 Analysts: Monitoring and Initial Triage

Tier 1 analysts are usually the first to review security alerts raised by monitoring tools. Their job is to spot suspicious activity, check alerts against set procedures and decide whether further investigation is needed. 

Their responsibilities include: 

• Monitoring security alerts and dashboards. 

• Reviewing alerts to separate real threats from false positives. 

• Recording relevant findings and incident details. 

• Following set procedures for initial assessment. 

• Escalating suspicious activity that needs further investigation. 

For example, a Tier 1 analyst may receive an alert about multiple failed login attempts on an employee account. The analyst reviews the available information and escalates the case if it meets the criteria for further investigation. 

For businesses, this first layer of monitoring makes sure security alerts are actually reviewed instead of being left unattended. 

2. Tier 2 Analysts: Investigation and Incident Response

When an alert needs deeper analysis, Tier 2 analysts investigate to find out whether a security incident has happened and how far it may have spread. 

They examine information from security tools, review system and network logs, and connect related events to understand what happened. 

Their responsibilities include: 

• Investigating escalated security alerts. 

• Analysing activity across endpoints, networks and user accounts. 

• Assessing the potential scope and impact of an incident. 

• Supporting containment and remediation. 

• Documenting findings and recommending next steps. 

For example, if a suspicious login is followed by unusual file access, a Tier 2 analyst may investigate whether the account has been compromised and whether other systems are affected. Behaviour-based tools such as user and entity behavioural analytics help analysts spot this kind of unusual activity faster. 

This stage matters because spotting a suspicious event is only the beginning. Businesses also need to understand its impact and decide what action comes next. 

3. Tier 3 Analysts: Advanced Threat Hunting and Complex Incidents

Tier 3 analysts usually take on complex security investigations that need advanced technical expertise. They may also actively search for threats that existing monitoring tools have missed. 

Their responsibilities include: 

• Conducting advanced threat hunting. 

• Investigating sophisticated attacks and persistent threats. 

• Analysing complex attack patterns and malware behaviour where required. 

• Developing or improving security detection rules. 

• Identifying gaps in existing monitoring and response processes. 

• Providing technical guidance during major security incidents. 

For example, if an attacker moves between systems without triggering obvious alerts, a Tier 3 analyst may investigate the activity, find weaknesses in existing detections and recommend improvements. 

This level of expertise helps businesses go beyond responding to individual alerts and get better at catching more complex threats. 

4. How the Three Tiers Work Together

The three tiers form a connected process. Each stage builds on the work done by the one before it. 

Not every alert needs to pass through all three tiers. Simple cases may be resolved at Tier 1, while serious incidents may need experienced analysts involved straight away. To see this escalation in action, read our guide on how a Security Operation Centre responds to a cyber crisis. 

For businesses, effective escalation is just as important as threat detection. A clear process makes sure potential threats get the right attention at the right time. 

5. Do Businesses Need Three Separate SOC Tiers?

Not necessarily. The right SOC structure depends on the organisation’s size, risk exposure, security requirements and available resources. 

Smaller businesses may find it more practical to use a managed SOC provider than to hire separate analysts for every tier. Larger organisations may run dedicated teams for monitoring, incident investigation, threat hunting and incident response. MITRE’s widely referenced guide, 11 Strategies of a World-Class Cybersecurity Operations Center, covers how to choose a SOC structure that fits your organisation. 

When evaluating SOC services, look beyond the number of analysts. Important factors include monitoring coverage, response procedures, escalation arrangements, reporting and the provider’s ability to investigate different types of threats. 

This is where a provider with broader cybersecurity capabilities adds value. SOC monitoring needs to work alongside network security, endpoint protection and other security controls to give businesses a clearer view of potential threats. 

How ACEiT Supports SOC and Cybersecurity Operations 

ACEiT brings together cybersecurity and IT capabilities through its services, including Security Operation Centre services, threat intelligence, managed security services and network security solutions. 

Through AceTeam Connect, the group’s managed cybersecurity arm, ACEiT supports businesses that want to strengthen their security monitoring and protection. These capabilities cover the full SOC workflow, from spotting suspicious activity to investigating potential threats and improving security controls. 

For businesses assessing their cybersecurity needs, understanding the SOC structure is a useful first step. It clarifies what happens when an alert is detected, how incidents are escalated and what level of investigation may be needed. 

Looking for better visibility into your organisation’s cybersecurity risks? Talk to ACEiT and explore how its SOC and cybersecurity services can support your security requirements and help you build a more structured approach to threat monitoring and response.