What is L1, L2, L3 SOC analyst?

Understanding SOC Analyst Tiers: L1, L2, and L3

In a Security Operations Center (SOC), analysts are typically organized into three tiers—L1, L2, and L3—each with distinct responsibilities that work together to protect an organization’s digital assets. This tiered structure ensures that threats are detected, analyzed, and mitigated efficiently and effectively.

L1 analysts are the first line of defense. They monitor security tools, review alerts, and perform initial triage. Their main goal is to filter out false positives and escalate legitimate security incidents to the next level. While they may not dive deep into technical analysis, their vigilance keeps the system running smoothly by ensuring only relevant alerts move forward.

L2 analysts take over from there. These are typically more experienced professionals who investigate escalated incidents, perform log analysis, enrich alerts with threat intelligence, and determine the scope of potential breaches. They often coordinate initial responses, such as isolating compromised systems or recommending patching procedures. Their role bridges the gap between detection and deeper forensic analysis.

L3 analysts are the experts—the elite within the SOC. They specialize in advanced threat hunting, reverse engineering malware, analyzing complex attack patterns, and improving detection logic across systems. Often involved in incident response leadership, they also design custom detection rules and mentor junior staff. Their work is less about volume and more about depth, focusing on uncovering stealthy threats that evade standard protocols.

Together, these tiers create a layered defense strategy. As cyber threats grow more sophisticated, the collaboration between L1, L2, and L3 analysts becomes crucial. Each tier builds on the other, turning raw data into actionable intelligence and ensuring organizations stay resilient in the face of evolving cyber risks.