What does a SOC look like?

A security operations center (SOC) is typically organized in tiers. Tier 1 analysts triage alerts, Tier 2 runs deeper investigations, and Tier 3 handles threat hunting and forensics, with SOC managers overseeing metrics and priorities. It can be on-premises, distributed, fully managed, or a hybrid of internal and outsourced teams.