A Day in the Life of an OculusIT SOC Analyst

The cybersecurity industry relies on different teams working together to battle threats and vulnerabilities within the cyber environment. This diversified field is comprised of all types of security and technical analysts including legal analysts, finance specialists, and many more. One of the critical roles in every cybersecurity company is the Security Operations Center Analyst or the SOC Analyst.

The SOC Analyst is especially important in higher education as they are responsible for ensuring the security of the institution’s digital assets and network. They work to protect student and faculty data, institutional intellectual property, financial systems, and other proprietary information.

To learn more about the role and the important work of SOC Analysts, we interviewed Justin Paul, SOC team lead at OculusIT.

First thing first, let’s take a closer look at the SOC Analyst role.

When working as a SOC Analyst at OculusIT, your main goal should be to monitor, analyze, and protect clients (higher education) from all sorts of cyberattacks. SOC Analysts are among the first to inform and respond to cyberattacks and suggest relevant remediation and improvements directly to the impacted client.

What is the structure of the OculusIT SOC team?

Our team has professionals who manage the role such as security and threat intelligence analysts, incident responders, pentester, and threat hunters as well.

Collaborating, the team works quickly to detect, respond, and recover from security incidents. Their collaboration ensures that security controls are integrated and work together effectively to protect the institution.

What are the day-to-day duties of the SOC Analyst?

Taking a closer look at the major duties of a SOC analyst, a person has the following duties:

• Manage Alert Notifications
• Prevent Security Attacks
• Incident Respond
• Threat hunting
• Forensics
• Security Incident Monitoring
• Investigate Incidents
• Vulnerability Assessments, and much more….

How do SOC analysts prioritize and respond to daily alerts?

To prioritize any alert, the following steps are considered:

• Triage the security incidents according to the severities and impact
• Validation of the threat using an AI tool
• Detection of the severity score of all valid alerts
• Sorting as per the score
• Analyzing the extent of the impact
• Responding as per the extent of the impact

While responding to the alerts, the following steps are considered:

• Reviewing if the alert has any impact on the client’s environment
• If yes, then a review of the logs is done
• The virus and vulnerabilities are categorized
• Notification of the alert along with the detail is passed to the client

How and when do SOC analysts engage with clients?­­

Engagement with the clients in the SOC implies acknowledging and acting on client requests promptly. The SOC analysts remain in direct contact with the clients and engage with them on all weekly calls. They take the latest update on their servers and other security working and what new can be done to enhance the existing cybersecurity.

Additionally, not only the SOC Analysts, the customer success team at OculusIT remain in constant touch with our clients and check upon them for feedback.

How do SOC analysts stay up to date on the latest cybersecurity knowledge and trends?

With the ever-evolving cybersecurity playground, staying on the top of latest cybersecurity knowledge and trends has become equally important. To empower the knowledge, the following sources remain helpful to all our SOC Analyst:

• Genuine content from top publications such as the HigherEd Dive, Sophos News, and Surveys, The Chronicle, etc. imparts all the latest news from the cybersecurity world including higher education.
• Videos and podcast channels such as HAK5, SophosLabs, etc. are both entertaining and knowledgeable.
• Cybersecurity is not a one-person job. All our SOC Analysts collaborate and share their ideas and knowledge on cybersecurity and related best practices.

A message to all Higher Education Institutions in this ever-changing cybersecurity environment

It’s time for every higher education institution to make their cybersecurity a priority. In recent years we have had an ample number of cyber-attacks causing millions and dollars of financial and reputational damage to higher education institutions. The more worrying situation is when the privacy of their students is compromised. As a result of the potential implications, cybersecurity must be a priority for all higher education institutions in today’s time.

If you’re also interested in upgrading your institution’s cybersecurity habits and learning more about working with OculusIT for Security Operations Center Services, including Managed Security services, let us know.