Security Analyst career path: from SOC analyst to CISO
Each step up the security operations ladder, from junior security analyst through senior analyst, SOC team lead and security manager to head of security operations and CISO: what changes in the job, the gap to close, how to show it on your CV and in interviews, and a plan.
The cvscored team
Contents
The ladder at a glance
| Step | What you are measured on next | Typical time |
|---|---|---|
| Junior security analyst to security analyst | Investigations you finish on your own | 1 to 2 years |
| Security analyst to senior security analyst | Major incidents, hunting and new detections | 2 to 3 years |
| Senior security analyst to SOC team lead | A shift's people and quality | 2 to 3 years |
| SOC team lead to security manager | The SOC's plan, budget and partners | 3 or more years |
| Security manager to head of security operations | Detection and response for a whole company | Several years |
| Head of security operations to CISO | Security strategy, risk and the board | When a company asks |
Security has two roads that run side by side. This page follows detection and response; the road of designing and building defences, from security engineer to security architect, is on the security engineer career paths. Both reach CISO, and many people cross between them early in their careers.
When an incident touches personal data, analysts work closely with the data protection officer, whose road from coordinator to chief privacy officer is on the data protection officer career paths.
Analysts who learn why attacks succeed sometimes move on to designing the defences; the design ladder, from security architect to chief security architect, is on the security architect career paths.
From junior analyst to SOC team lead
Junior security analyst to security analyst
What changes: you no longer only sort alerts; you investigate them to the end and decide, with fewer questions to senior colleagues.
The gap: confident use of the SIEMSearch and correlate logs in a SIEM, tune detection rules, and tell a real alert from noise. and EDRRead what an endpoint tool saw on a laptop or server, isolate a machine, and collect evidence., WindowsWindows events, Active Directory and group policy: where most office attacks leave traces. and networkProtocols, ports, DNS, proxies and firewalls well enough to read network logs and traffic. traces, and clear incident notesWrite an incident note that a manager understands and an engineer can act on, under time pressure..
On the CV and in interviews: the kinds of alerts you closed, an investigation you led and a rule you helped tune. Expect a live triage exercise.
Plan (6 to 12 months): take the investigations nobody wants; ask a senior colleague to review your notes; learn one log source in depth each quarter.
Security analyst to senior security analyst
What changes: you handle major incidents, hunt for threats, write new detections and coach junior analysts.
The gap: threat intelligenceUse reports on attackers and their methods to decide what to look for and what to block. and attacker techniques, leading an incidentRun an incident from first alert to closure: contain, communicate, recover and record., evidence handlingPreserve and examine evidence from disks, memory and logs so that the findings hold up later. and automatingShort scripts to parse logs, call tool interfaces and automate repeated steps of triage. repeated work.
On the CV and in interviews: incidents you led, hunts that found something, detections you wrote and their effect. Expect a case on a ransomware outbreak.
Plan (12 to 24 months): lead one incident end to end with support; run a monthly hunt; automate one step of triage; mentor a new analyst.
Senior security analyst to SOC team lead
What changes: you lead a shift or a team: its rota, quality, training and wellbeing, and the escalations it sends up.
The gap: leading peopleLead a shift or a SOC team: rota, reviews, training and calm decisions during incidents. in shifts, reviewing others' work fairly, planning cover and keeping alert fatigue down.
On the CV and in interviews: the team you led, how quality and response times changed, and the people you trained. Expect questions on a tired team and a missed incident.
Plan (12 months): run handovers and shift reviews; own the training of new analysts; measure and cut the noisiest alerts with the engineers.
Security manager, head of security operations and CISO
SOC team lead to security manager
What changes: you run the SOC or a security function: its plan, budget, tools, partners and reports to management.
The gap: budgets and contracts with service providers, metrics for management, ISO 27001The international standard for information security management, and the evidence an audit asks for. and audit evidence, and presentingPresent incidents, risks and the SOC's results to management in plain business terms. risk in business terms.
On the CV and in interviews: the SOC you ran, the tools you introduced or replaced, and what improved. Expect a case on choosing between building a SOC and buying the service.
Plan (2 to 3 years): own the SOC's yearly plan; lead a tool change; report monthly to management with a few clear measures.
Security manager to head of security operations
What changes: you answer for detection and response across the company, often with several teams, outside partners and on-call cover around the clock.
The gap: organisation design, crisis management with leadership and legal, exercises at company level, and reporting duties in several countries.
On the CV and in interviews: the size of the operation, major incidents you led at company level and the maturity you built. Expect questions from legal and the board.
Plan (several years): run a company-wide crisis exercise; build relations with legal, communications and insurers; grow team leads into managers.
Head of security operations to CISO
What changes: you own the company's security strategy and risk, from operations and engineering to governance, and you speak for security to the board.
The gap: security architecture and governance beyond operations, regulation, budgets at company level and board communication.
On the CV and in interviews: the security programme you led, the risks you reduced and how you reported them. Expect a talk with the board or the chief executive.
Plan (when a company asks): take on governance and engineering topics next to operations; present to the board's risk committee; build a deputy.
Certificates and reporting rules are described here in plain words. This is not legal advice; the rules for incidents differ by country and sector.
Your CV for the next step
Moving up in security operations shows on a CV as a wider responsibility: from alerts, to incidents, to a shift, to a company's detection and response. Three rules:
- Write each title as the company used it. Tier names differ, so add one line on what you really did.
- Speak the next level's language. Analyst ads say "triage", "SIEM", "EDR"; senior ads say "incident response", "threat hunting", "detection engineering"; manager ads say "SOC operations", "service providers", "metrics".
- Tie a result to every line. Faster response, fewer false positives, attacks stopped, people trained.
| Skill | Weak line | Strong line, with proof |
|---|---|---|
| SOC team leadLead a shift or a SOC team: rota, reviews, training and calm decisions during incidents. | Led the SOC team. | Led a shift of six analysts; quality reviews of closed alerts rose and nobody left the team that year. |
| Major incidentRun an incident from first alert to closure: contain, communicate, recover and record. | Responsible for incident response. | Coordinated the response to a breach of a partner's account across IT, legal and communications; customers were informed on time. |
| Audit evidenceThe international standard for information security management, and the evidence an audit asks for. | Supported audits. | Prepared the SOC's evidence for the ISO 27001 audit; the auditors raised no finding on monitoring. |
| Service provider | Managed the external SOC. | Set clear response targets with the managed SOC provider and reviewed them monthly; escalations became faster and complete. |
Key takeaways
- The ladder runs junior security analyst, security analyst, senior analyst, SOC team lead, security manager, head of security operations, then CISO.
- Analyst means finishing investigations; senior means incidents and hunting; lead means a shift's people.
- At CISO the operations road meets the engineering road of the security engineer.
- Tier names differ by company; describe what you really did.
- Certificates are optional and named neutrally; this page is not legal advice.
Frequently asked questions
- What comes after senior security analyst?
- SOC team lead and security manager on this road, or a move towards engineering, which the security engineer page describes.
- How long does it take to leave tier one?
- Often one to two years, faster for analysts who finish investigations on their own and write clear notes.
- Can a security analyst become a CISO?
- Yes. The operations road leads there through management; governance and architecture are the gap to close.
- Do I need a certificate to move up?
- No law asks for one. Some ads name GCIH or CySA+; the incidents you handled and the teams you led count for more.
- What should my CV show for a SOC team lead role?
- The shift or team you led, how quality and response changed, and the analysts you trained.