Roles in Incident Response: CSIRTs and SOCs

Vocabulary flashcards defining the structures, tiers, and roles found within Computer Security Incident Response Teams (CSIRTs) and Security Operations Centers (SOCs).

NIST Incident Response Lifecycle

A framework for incident response consisting of four phases: Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-incident activity.

Computer Security Incident Response Team (CSIRT)

A specialized group of security professionals trained in incident management and response that can exist as a dedicated team or a task force.

Command (Incident Response)

The component of effective response that refers to having the appropriate leadership and direction to oversee the incident response.

Control (Incident Response)

The component of incident response referring to the ability to manage technical aspects, such as coordinating resources and assigning tasks.

Communication (Incident Response)

The component of incident response referring to the ability to keep stakeholders informed throughout the situation.

Security Analyst (CSIRT)

A security professional who continuously monitors an environment for security threats by analyzing and triaging alerts, performing root-cause investigations, and escalating or resolving alerts.

Technical Lead

A CSIRT role responsible for managing all technical aspects of incident response (e.g., software patches), determining root causes, and creating and implementing containment, eradication, and recovery strategies.

Incident Coordinator

A role responsible for coordinating with external nonsecurity departments (such as legal, HR, or PR) during a security incident to maintain clear communication lines and share incident status.

Security Operations Center (SOC)

An organizational unit dedicated to monitoring networks, systems, and devices for security threats or attacks, operating as its own unit or within a CSIRT.

Blue Team

The security professionals who are responsible for defending against all security threats and attacks at an organization.

SOC Organizational Structure

A tiered operational hierarchy consisting of Tier 1 (SOC Analyst, L1) at the base, Tier 2 (SOC Analyst, L2), Tier 3 (SOC Lead, L3), and the Manager at the top.

Tier 1 SOC Analyst (L1)

The least experienced SOC analysts, responsible for monitoring, reviewing, and prioritizing alerts based on criticality or severity, managing ticketing workflows, and escalating alerts to Tier 2 or Tier 3.

Tier 2 SOC Analyst (L2)

Experienced SOC analysts responsible for receiving escalated tickets from L1 analysts, conducting deeper investigations, configuring and refining security tools, and reporting to the SOC Lead.

Tier 3 SOC Lead (L3)

Highly experienced professionals responsible for managing team operations, exploring detection methods through advanced techniques like malware and forensics analysis, and reporting to the SOC manager.

SOC Manager

The role at the top of the SOC hierarchy responsible for hiring, training, evaluating staff, creating performance metrics, producing compliance and incident reports, and communicating findings to executive management.

Forensic Investigators

Specialized roles within a SOC (commonly L2s and L3s) who collect, preserve, and analyze digital evidence related to security incidents to determine what occurred.

Threat Hunters

Specialized SOC professionals (typically L3s) who use threat intelligence to detect, analyze, and defend against new and advanced cybersecurity threats.