In the SOC three-tier model, which role is assigned to Tier 1?

In the SOC three-tier model, which role is assigned to Tier 1?

• A. Tier 1: Junior Security Analyst - Triage Specialist
• B. Tier 2: Security Operations Analyst - Incident Responder
• C. Tier 3: Security Operations Analyst - Threat Hunter
• D. Tier 1: Security Operations Analyst - Incident Responder

Answer: (A)

The key idea is that in a three-tier SOC, Tier 1 is the frontline that handles alert triage and initial data gathering. A Junior Security Analyst focused on Triage Specialist fits that role perfectly, because Tier 1’s responsibilities are to quickly validate alerts, perform basic analysis, categorize and prioritize them, and then escalate to Tier 2 as needed. The other options place incident response or threat hunting at Tier 1, or assign Tier 3 a role that doesn’t reflect its proactive, in-depth duties, which doesn’t align with how the tiers are typically organized.

The key idea is that in a three-tier SOC, Tier 1 is the frontline that handles alert triage and initial data gathering. A Junior Security Analyst focused on Triage Specialist fits that role perfectly, because Tier 1’s responsibilities are to quickly validate alerts, perform basic analysis, categorize and prioritize them, and then escalate to Tier 2 as needed. The other options place incident response or threat hunting at Tier 1, or assign Tier 3 a role that doesn’t reflect its proactive, in-depth duties, which doesn’t align with how the tiers are typically organized.