SOC Staffing Guide: Analyst Tiers, Headcount Models, and 24x7 Shift Coverage

Tier 1 Analyst (Alert Triage Analyst): Tier 1 is the first responder for incoming SIEM alerts and security tool notifications. Responsibilities: review and classify alerts from SIEM, EDR, DLP, email gateway, and other security tools; determine whether an alert is a true positive, false positive, or requires escalation; perform initial enrichment (IOC lookup, asset classification, user context); escalate confirmed or suspected true positives to Tier 2 within defined SLA (typically 15 to 30 minutes); document findings in the ticketing system. Tier 1 analysts typically have 1 to 3 years of experience, hold or are pursuing CompTIA Security+ and CySA+, and handle 20 to 40 alerts per shift depending on SIEM noise level.

Tier 2 Analyst (Incident Investigator): Tier 2 handles escalated incidents requiring deeper investigation. Responsibilities: scope the incident by determining affected systems, user accounts, and data; review endpoint forensics (process trees, file system activity, memory), network logs (firewall, proxy, DNS), and identity logs (authentication, privilege use); contain the incident by isolating affected systems and disabling compromised accounts; coordinate with IT operations for remediation; document the incident timeline and root cause; contribute to post-incident review. Tier 2 analysts have 3 to 5 years of experience, hold SANS GCIA or GCIH, and handle 3 to 8 incidents per shift depending on complexity.

Tier 3 Analyst (Threat Hunter and Senior Investigator): Tier 3 handles the most complex incidents, proactive threat hunting, and detection engineering. Responsibilities: investigate incidents where Tier 2 cannot determine scope or root cause; conduct proactive threat hunts based on threat intelligence (looking for attacker presence without a triggering alert); develop and tune SIEM detection rules; perform malware analysis and digital forensics on complex incidents; mentor Tier 1 and Tier 2 analysts. Tier 3 analysts have 5 or more years of experience, hold SANS GCFE, GCFA, or GREM, and often work irregular hours driven by incident severity rather than shift schedules.

The most reliable SOC headcount formula starts with your SIEM alert volume and works backward through analyst capacity:

Tier 1 capacity: One Tier 1 analyst can handle 20 to 35 actionable alerts per 8-hour shift in a mature environment with good SIEM tuning. A high-noise environment with poor tuning drops this to 10 to 15 actionable alerts per shift. If your SIEM fires 200 alerts per 24-hour period (approximately 8.3 per hour) and each requires 15 minutes of Tier 1 attention, you need 200 x 15/60 = 50 analyst-hours of Tier 1 time per day, or 6.25 FTEs for 24x7 coverage (before absence buffering).

24x7 coverage math: Covering a single seat (one analyst on shift) 24 hours a day, 365 days a year requires approximately 4.2 FTEs when accounting for vacation (15 days), sick leave (10 days), training (10 days), and holidays (10 days). Most organizations budget 5 FTEs per 24x7 seat to cover all absence scenarios without overtime.

Tier 2 to Tier 1 ratio: Industry benchmarks range from 1:3 to 1:5 (one Tier 2 for every 3 to 5 Tier 1 analysts). A 1:4 ratio is the most common starting point. In a high-detection-quality environment with effective SIEM tuning, the ratio can be as high as 1:6.

Tier 3 to Tier 2 ratio: 1:3 to 1:4 is typical for organizations with active threat hunting programs. Tier 3 roles are often filled by senior Tier 2 analysts who grow into the role, and many smaller SOCs handle Tier 3 functions through retainer agreements with IR firms or MDR service providers.

Sample model for a 24x7 SOC with 150 SIEM alerts per day: 4 to 5 Tier 1 FTEs (covering 2 shifts plus on-call), 1 to 2 Tier 2 FTEs (business hours primary plus on-call for overnight escalations), and 1 Tier 3 FTE (business hours, on-call for major incidents). SOC Manager covering this team of 6 to 8 analysts falls within the 1:8 span of control guideline.

SOC coverage models range from business-hours-only to true 24x7x365 staffing. The right model depends on your risk tolerance for overnight incident detection latency and your budget.

Business hours only (8 to 12 hours, 5 days): The lowest-cost model. After-hours incidents are handled via on-call analyst rotation. Alert queue is reviewed at shift start. The risk: a ransomware deployment that begins at 2am Friday is not detected until 8am Monday, giving attackers a 54-hour dwell window in the worst case. Acceptable for low-risk organizations; unacceptable for those in sectors targeted by ransomware or nation-state actors.

Follow-the-sun (two 12-hour shifts, weekdays; reduced coverage weekends): Covers most business-hours risk across time zones. On-call or reduced staff covers nights and weekends. Commonly used by organizations with SOC staff in multiple geographies (US + UK, US + Asia-Pacific). Requires clear shift handover procedures to prevent incident context loss between shifts.

True 24x7 (three 8-hour shifts or two 12-hour shifts, all 7 days): Provides minimum latency for incident detection and response at all hours. Requires 4.2 to 5 FTEs per staffed seat. Shift handover, alert fatigue management on overnight shifts, and maintaining Tier 2 escalation coverage for overnight incidents are the primary operational challenges.

MDR augmentation model: Many organizations use a Managed Detection and Response (MDR) service for 24x7 Tier 1 coverage and maintain an internal Tier 2/3 team for investigation and response. MDR services handle alert triage and initial escalation; internal analysts handle incident scoping, remediation, and threat hunting. This model is cost-effective for organizations that cannot staff a full internal 24x7 team.

SOC headcount justification requires connecting analyst capacity to business risk in terms leadership understands. Three frameworks work consistently:

Alert volume to incident detection latency: Present your current alert volume, the analyst capacity required to process it at target SLA (15 to 30 minute Tier 1 response time), and the headcount gap. Translate the headcount gap into detection latency impact: 'At current staffing, our Tier 1 queue builds to 4-hour backlog by end of shift, meaning incidents that begin at shift start may not be detected until the following shift.' Leadership understands the 4-hour dwell time risk better than the abstract headcount number.

MDR vs. in-house cost comparison: Build the 5-year TCO for internal 24x7 staffing (salary, benefits, training, tooling, turnover cost) versus an MDR service contract covering equivalent coverage hours. For organizations needing 24x7 Tier 1 coverage without Tier 2/3 depth, MDR is frequently more cost-effective and the comparison justifies either investment.

Incident cost basis: Reference Ponemon and IBM research showing that mean time to detect (MTTD) is the strongest predictor of breach cost. Each additional hour of undetected attacker access costs an estimated $100,000 to $500,000 depending on industry and data sensitivity. SOC headcount that reduces MTTD by 8 hours per major incident justifies significant investment at these rates.