Okuzeka
Cybersecurity vocabulary · Security Operations and Monitoring

SOC

Meaning in cybersecurity, with examples

abbreviationCore term

In cybersecurity, SOC means: Security operations centre: the team, and often the room, that monitors an organisation's systems around the clock and responds to security alerts.

In Turkish: güvenlik operasyon merkezi, SOC

How it is used

Pronounced 'sock'. Analysts are often grouped as Tier 1 (triage), Tier 2 (investigation) and Tier 3 (hunting and expert work). Companies may run their own SOC or buy it as a service from an MSSP. American texts spell it 'center'.

Example sentences

  1. The SOC escalated the alert to the incident response team at 3 a.m.

  2. She started as a Tier 1 SOC analyst and now leads threat hunting.

Common collocations

  • SOC analyst
  • 24/7 SOC
  • managed SOC
  • SOC team
  • SOC playbook
  • SIEMSecurity information and event management: a platform that collects logs from many systems, correlates them and raises alerts about possible attacks.
  • alertA notification from a security tool saying that something suspicious or important has happened and may need a person to look at it.
  • escalateTo pass an alert, incident or problem to a more senior person or team because it is serious or beyond your own authority or skills.
  • threat huntingActively searching through systems and logs for signs of attackers who have not yet been detected by automated alerts, often starting from a hypothesis.
  • blue teamThe defenders in a security exercise, or more generally the people who protect, monitor and respond, such as SOC analysts and incident responders.

More terms: Security Operations and Monitoring

Practise with graded reading

Reading at the right level is the fastest way to make new words stick. Pick free English books by level: