Visible linkage between page claims, source rows, citation IDs, freshness, and review state.
role
SOC Analyst
Explore SOC Analyst with BLS/O*NET wage, outlook, skill, and task evidence plus source-backed certification options.
See my realistic path to SOC AnalystNext source review 2026-10-12.
Certification details change. Always confirm final pricing, availability, and credential terms on the official provider page linked in the sources below before you pay for anything.
What the numbers say about this work
Government occupation data for the role this maps to — Information Security Analysts (SOC 15-1212). This is planning context for the occupation, not a salary or a job this role guarantees you.
- Median pay (occupation)
- $129,180 / yr · $75,090 to $199,850 (10th–90th percentile)
- Projected change (2024–34)
- +28.5% · ~16k openings/yr
- Typical entry education
- Bachelor's degree
BLS OEWS — occupation-level, national · checked BLS Employment Projections 2024–34 · checked This role has a high-confidence mapping to the listed O*NET-SOC/BLS occupation.
What it pays by metro
The national median hides a wide geographic spread. Below is the occupation’s median in some of the highest-paying and largest-employment metros, adjusted for local prices — regional price-level context, not take-home pay or a salary this role guarantees you.
| Metro | Nominal median | Cost-adjusted |
|---|---|---|
| San Jose, CA | $176,120 | $159,496 |
| Raleigh, NC | $143,640 | $146,337 |
| Seattle, WA | $161,780 | $145,573 |
| San Francisco, CA | $162,310 | $140,391 |
| Huntsville, AL | $130,330 | $140,031 |
| Washington, DC | $148,950 | $136,797 |
See all metros and how this is calculated → Sources: BLS OEWS (May 2025), occupation-level metro median ÷ BEA Regional Price Parities (2024, US=100).
What this work involves
The tasks the U.S. Department of Labor’s O*NET lists most central to this occupation — role-fit evidence to weigh against your background, not a measure of employer demand.
- Develop plans to safeguard computer files against accidental or unauthorized modification, destruction, or disclosure and to meet emergency data processing needs.
- Monitor current reports of computer viruses to determine when to update virus protection systems.
- Encrypt data transmissions and erect firewalls to conceal confidential information as it is being transmitted and to keep out tainted digital transfers.
- Perform risk assessments and execute tests of data processing system to ensure functioning of data processing activities and security measures.
- Modify computer security files to incorporate new software, correct errors, or change individual access status.
- Review violations of computer security procedures and discuss procedures with violators to ensure violations are not repeated.
Skills that matter
The skills O*NET rates most important for this occupation. A starting map for what to build — weigh it against the specific job you’re targeting.
- Reading Comprehension
- Critical Thinking
- Active Listening
- Speaking
- Writing
- Monitoring
- Active Learning
- Learning Strategies
Evidence stack
How we know this
Evidence chips, posture, citations, and blocked-claim boundary.
3 visible citations
Whether a page has current, partial, stale, missing, or blocked source coverage.
How recently the source must be checked before a claim or page can render as current.
Transparent explanation of claims Learnerside refuses to make without exact support.
What this page will never claim
- Exam pass rates
- Job placement rates
- Any job guarantee
- A salary figure attributed to this certification
- A salary prediction for you personally
- Return on investment or a payback period
View table fallback
| Section | Value | Source layer | Caveat |
|---|---|---|---|
| Posture | no_certification_source_links | source posture | Draft status; source posture must pass before public launch. |
| Visible citation count | 3 | claim source map | Citation count does not imply page is public-ready. |
Certification decision support
Certifications mapped to SOC Analyst
Certifications mapped to this role from cited OEM target-role data and the Learnerside role mapping, ordered by relationship strength and then Difficulty Score. This is planning context — not a guarantee, not an employer requirement, and not a claim that any one certification is best for everyone. Your fit depends on your background; pay/outlook context is occupation-level on the role page.
Start here signalCompTIA Security+CompTIA recommends Network+ plus two years in a security or systems-administrator role (preparation guidance, not a registration requirement).
SOC foundations
2 mappedEntry and foundation credentials before deeper SOC tooling and response work.
| Credential | Experience expected | Cost | Relationship | Why it appears here |
|---|---|---|---|---|
CompTIA Security+CompTIA | Vendor-recommended backgroundCompTIA recommends Network+ plus two years in a security or systems-administrator role (preparation guidance, not a registration requirement). | $439 exam | strong signal | Security+ is a common baseline for SOC analyst preparation, but learners still need hands-on SIEM, networking, and incident triage practice.Official source |
| Vendor-recommended backgroundCisco recommends understanding the exam topics before taking the exam. | $125 exam | pre entry foundation | CCST Cybersecurity is useful for cyber fit exploration before deeper SOC preparation.Official source |
Network defense
2 mappedNetwork security, traffic analysis, and defensive infrastructure credentials.
| Credential | Experience expected | Cost | Relationship | Why it appears here |
|---|---|---|---|---|
Cisco CCNA CybersecurityCisco | Registration accessThe reviewed eligibility record says registration is open. | $300 exam | strong signal after foundation | Cisco CCNA Cybersecurity covers security monitoring host analysis network intrusion analysis and policies for cyber operations routes.Official source |
CompTIA CySA+CompTIA | Vendor-recommended backgroundAbout 4 years in a SOC analyst or vulnerability analyst role. | $439 exam | strong signal after foundation | CySA+ maps more directly to analyst and monitoring work after Security+ or equivalent foundations.Official source |
Experience expected is what the vendor publishes about the background it asks for or recommends — never a pass rate, and never a Learnerside rating of how hard an exam is. Certification mappings are planning context, not employer requirements, job guarantees, salary claims, or ROI claims.
BLS wage context
National salary context
BLS wage range with explicit occupation-level caveat.
Occupation-level onlyNot a certification salary, personal prediction, ROI, placement, or guarantee.
BLS wage dataSOC mapping caveatSource posture
View salary table fallback
| Measure | Value | Source layer | Caveat |
|---|---|---|---|
| 10th percentile | $75,090 | bls occupation context | U.S. national occupation-level wage context only. |
| Median | $129,180 | bls occupation context | Not a certification salary or personal prediction. |
| 90th percentile | $199,850 | bls occupation context | Requires SOC mapping caveat; use metro pages for local wages. |
Transition evidence
Transition map
Node-edge transition map with relationship-confidence guardrail.
Relevance, not promise
Current pageHow to become a SOC Analyst O*NET/BLS role context only; not a guaranteed progression.
O*NET role evidenceRelated roleSOC Analyst Role mapping is source context, not a hiring or salary guarantee.
O*NET role evidenceCredential optionCompTIA Security+ Credential facts come from official/vendor sources; employer use varies.
Official certification sourceNext actionCompare fit, cost, study time, and local labor context Personalized sequencing requires intake answers and review.
Role-cert relationship evidence
Tasks, skills, knowledge, work activities, job zone, and role-fit inputs.
Exam name, credential level, exam objectives, prerequisites, renewal, official resources.
Why a certification is related to a role, skill, task, or transition stage.
Title variants, wording, common tools, and resume/quiz phrasing.
Does not support: Salary, demand, certification requirement, individual fit guarantee, ROI, placement, pass rate, job guarantee, Employer requirement proof, guaranteed hiring advantage, salary increase, probability of hire, certification requirement unless officially stated.
Not claimed here
- Exam pass rates
- Job placement rates
- Any job guarantee
- A salary figure attributed to this certification
- A salary prediction for you personally
- Return on investment or a payback period
View transition table fallback
| Node | Value | Source layer | Caveat |
|---|---|---|---|
| Current page | How to become a SOC Analyst | onet role feature | O*NET/BLS role context only; not a guaranteed progression. |
| Related role | SOC Analyst | onet role feature | Role mapping is source context, not a hiring or salary guarantee. |
| Credential option | CompTIA Security+ | oem credential fact | Credential facts come from official/vendor sources; employer use varies. |
| Next action | Compare fit, cost, study time, and local labor context | role cert relationship | Personalized sequencing requires intake answers and review. |
Answer blocks
Common Questions
Will AI replace cybersecurity / SOC analysts?
We won't mint a replacement number or date. AI changes tasks inside security operations (alert triage, summarization, detection tuning) — task shift, not role elimination. BLS projects strong growth for the related occupation through 2034, though BLS does not model rapid AI, so that growth is not an AI forecast either.
Tier B (factual): BLS puts Information security analysts (SOC 15-1212) at a 2024–2034 projected change of +28.5% (from 182,800 jobs in 2024 to 234,900 in 2034), with ~16,000 annual openings a year — a forecast, not a guarantee. AI appears among demand drivers cited for the broader computer & mathematical group, but BLS disclaims precise long-term AI impact, so we attach no AI causation. Task exposure means the work shifts toward judgment and oversight, not that the role disappears. Tier A (research): a cited exposure index would need registered research sources we don't yet carry; we decline to forecast.
Citations: U.S. BLS — Employment Projections 2024–2034, SOC 15-1212 (bls.gov).
Plan a security path with eyes open on how the work is changing. Build my personalized career plan.
Quick Verdict
A SOC analyst monitors security alerts, triages incidents, and escalates threats using SIEM workflows. A realistic career-changer path: build networking and security fundamentals, then a baseline credential like CompTIA Security+ (CompTIA recommends Network+ plus about two years of experience - a recommendation, not a requirement). BLS reports a $129,180 median wage (2025) for Information Security Analysts - occupation context, not a guarantee.
Cited Detail
SOC analyst shares its occupation with cybersecurity analyst: Information Security Analysts (SOC 15-1212). Top skills: monitoring, critical thinking, reading comprehension, clear writing. Realistic sequence (planning context, not a promise): start with CompTIA Security+ (SY0-701) as a baseline, then hands-on SIEM, networking, and incident-triage practice. CompTIA CySA+ (CS0-003) maps more directly to analyst work after foundations - CompTIA points to about four years in a SOC or vulnerability-analyst role. Cisco's CCST Cybersecurity (100-160) is a useful pre-entry fit-check; Cisco CCNA Cybersecurity (200-201) is a stronger signal once you've built foundations. Outlook: BLS projects Information Security Analysts to grow 28.5% over 2024-2034, ~16,000 openings/yr - a multi-year occupation-level projection, not live postings, not a guarantee for this title or for you.
AI & this career
What we can — and can’t — tell you about AI and this role
Cited context only: an occupation-level outlook, descriptive usage data, an employer-language sample, and attributed research — kept separate. No Learnerside AI score, no automation timeline, no job-loss prediction. How we source this →
Occupation outlook · BLS
Where the occupation is projected to go
BLS projects Information security analysts at 28.5% employment change for 2024-2034, with 16 thousand annual openings. U.S. Bureau of Labor Statistics · checked
A forecast, not a guarantee; occupation-level, not about you - and BLS does not model rapid AI adoption, so this is never an AI prediction.
How AI shows up in the work
Descriptive usage, not demand or loss
For this O*NET detail, the May 2026 usage sample reports 23.90% of Claude conversations augmenting the person's work and 76.10% automating a task. Anthropic · checked Anthropic Economic Index dataset, CC-BY.
Across all occupations the same dataset splits 51.4% augmentation / 48.6% automation (May 2026) — shown so a single role’s number is never read as an outlier.
Descriptive Claude usage data, not employment demand, not job loss, and not a personal forecast; CC-BY attribution required.
Employer language · sample
What a posting sample mentions
a sample of 11 postings (as of 2026-07-09) mentions these AI-related terms
Employer-language sample only; not official demand, market-size, salary, or certification ROI evidence.
Published research · attributed
What independent research says (not Learnerside’s claim)
- Eloundou et al. estimate that about 80% of U.S. workers have at least 10% of their work tasks exposed to large language model capabilities (Science 2024). American Association for the Advancement of Science · checked exposure = task overlap, not job loss.
- Eloundou et al. estimate that about 19% of U.S. workers have at least 50% of their work tasks exposed to large language model capabilities (Science 2024). American Association for the Advancement of Science · checked exposure = task overlap, not job loss.
- Eloundou et al. explicitly disclaim any forecast of AI adoption or timing, describing their measure as capability overlap with tasks rather than a prediction of job loss (Science 2024). American Association for the Advancement of Science · checked exposure = task overlap, not job loss.
- OECD reports that high-skill occupations are the most exposed to AI on task-overlap measures (OECD Employment Outlook 2023). Organisation for Economic Co-operation and Development · checked exposure = task overlap, not job loss.
- OECD reports that, as of 2023, there is little empirical evidence of negative employment effects from AI (OECD Employment Outlook 2023). Organisation for Economic Co-operation and Development · checked exposure = task overlap, not job loss.
- OECD and the AIOE research find that AI exposure and automation risk often run in opposite directions, with the most-exposed high-skill occupations tending to be the least at risk of automation. Organisation for Economic Co-operation and Development · checked exposure = task overlap, not job loss.
- Felten, Raj and Seamans construct an occupation-level AI Occupational Exposure index by linking AI capabilities to O*NET occupational abilities (Strategic Management Journal). Strategic Management Journal (Wiley) · checked exposure = task overlap, not job loss.
- Stanford Digital Economy Lab researchers find a roughly 16% relative decline in employment for workers ages 22-25 in the most AI-exposed occupations, based on high-frequency ADP payroll data (Canaries in the Coal Mine, working paper). Stanford Digital Economy Lab · checked correlational usage data, not proof.
- The ILO notes that AI-exposure indicators measure potential task overlap and cannot by themselves establish job loss (Workers' exposure to AI). International Labour Organization · checked exposure = task overlap, not job loss.
- The Anthropic Economic Index reports no measured systematic rise in unemployment attributable to AI in its usage data. Anthropic · checked correlational usage data, not proof.
Tier A research stays attributed and separate from BLS outlook and employer-language samples.
Core source records
This table lists the page’s core content records and when they were checked. Claim-specific citations appear beside the relevant text and may not be repeated here.
| ID | Supports | Source | Checked |
|---|---|---|---|
| CIT-01 | Supports occupation-level wage context for SOC Analyst. | SOC Analyst BLS OEWS wage source | 2026-06-25T08:28:38+00:00 |
| CIT-02 | Supports occupation-level outlook context for SOC Analyst. | SOC Analyst BLS Employment Projections source | 2026-06-25T08:27:06+00:00 |
| CIT-03 | Supports skills, tasks, interests, and fit context for SOC Analyst. | SOC Analyst O*NET source | 2026-07-14T04:32:12+00:00 |
Ready to turn this decision into a plan?
Build my personalized career plan.