What is a SOC analyst and what do they actually do?
A SOC (Security Operations Center) is the team that continuously monitors an organisation's security: workstations, servers, network, cloud and user accounts. The SOC analyst is its central link. The job is to spot suspicious events among thousands of logs, decide whether they are a real threat or a false positive, then trigger the right response before the incident grows.
In Morocco, this is one of the most accessible entry points into cybersecurity. It requires rigour and solid technical foundations rather than long experience, and it offers a clear progression, from first-level triage to threat hunting. It is also a role where you learn fast, because every day you see real attacks, real misconfigurations and real user behaviour.
SOC analyst L1, L2, L3: how do the roles differ?
Most SOCs organise their teams into three tiers. Job titles vary from one organisation to another, but the logic is the same: the higher you go, the deeper the analysis and the less the work is driven by procedures.
- Tier 1 (L1): monitoring consoles, triaging alerts, qualifying them according to playbooks, escalating confirmed cases to tier 2. This is the usual entry-level role.
- Tier 2 (L2): in-depth investigation of escalated incidents, correlation of multiple sources, containment (isolating a host, blocking an account), remediation recommendations.
- Tier 3 (L3): complex incidents, threat hunting, malware analysis, forensics, and building and tuning detection rules.
- Around these tiers: SIEM and detection engineers, threat intelligence analysts, team leads and SOC managers.
What does a SOC analyst's day look like?
The heart of the job is alert triage. An alert appears in the SIEM or EDR console: a login from an unusual country, suspicious PowerShell execution, traffic to a known malicious domain. The analyst checks the context, reviews related logs, compares with threat intelligence sources, then decides: close as a false positive, document, or escalate.
When an incident is confirmed, the response begins: isolating the machine, resetting credentials, looking for other affected hosts, communicating with IT teams. Every step is recorded in a ticketing tool, because documentation then feeds rule improvement and, where applicable, notification obligations.
These are the main tool families found in most SOCs. Vendors vary between organisations; what matters is understanding what each family does.
- SIEM: collecting, correlating and searching logs from the whole infrastructure.
- EDR / XDR: visibility and response on workstations and servers.
- SOAR: automating repetitive tasks and orchestrating the response.
- Threat intelligence platforms: indicators of compromise, IP address and domain reputation.
- Network analysis (IDS/IPS, NDR, packet captures) and sandboxes for analysing suspicious files.
- Ticketing and incident management tools.
What skills do you need to become a SOC analyst?
Recruiters look first for a solid technical foundation and genuine analytical ability. Tools are learned on the job; understanding what is normal or abnormal in a system takes much longer.
- Networking: TCP/IP, DNS, HTTP, common protocols, reading firewall and proxy logs.
- Systems: Windows event logs, Active Directory, how Linux works.
- Attack knowledge: phishing, ransomware, lateral movement, and the MITRE ATT&CK framework.
- Query languages and scripting: writing a SIEM search, automating a task in Python or PowerShell.
- Soft skills: rigour, calm under pressure, clear writing in French and English, teamwork and clean shift handovers.
Which certifications help you become a SOC analyst in Morocco?
No certification is mandatory, but they help you pass HR screening and give structure to your learning. A logical path, from beginner to experienced analyst, could look like this:
- CompTIA Security+ (SY0-701): the core security fundamentals, often requested for an L1 role. 5-day training, from 10,900 MAD with the voucher included.
- Certified Network Defender v3 (CND, exam 312-38): network defence, monitoring and infrastructure-side incident response. 5 days, from 15,900 MAD.
- CompTIA CySA+ (CS0-003): the analyst certification par excellence, focused on detection, behaviour analysis and vulnerability management. 5 days, from 12,900 MAD.
- CHFI v11 (exam 312-49): digital investigation and forensics, useful for moving to L3 or incident response. 5 days, from 19,900 MAD.
Where can you find SOC jobs in Casablanca, Rabat and elsewhere in Morocco?
SOC roles are concentrated mainly along the Casablanca–Rabat axis, with opportunities in Tangier, Fez or Marrakech too, and increasingly with partial remote work. Several types of employers hire analysts: banks and insurers, which often run their own SOC; telecom operators; managed security service providers (MSSPs), which monitor several clients at once; offshoring and shared-services centres operating SOCs for European clients; and the public sector and critical infrastructure operators covered by Law 05-20 and the DGSSI framework.
One thing to know before applying: a SOC often runs 24/7. L1 roles therefore frequently involve rotating shifts, nights or weekends, with arrangements that vary between employers. For a SOC serving European clients from Morocco, fluency in French and English is a major asset.
How do you land your first SOC analyst job?
The first job is often the hardest to get, because many postings already ask for experience. The key is to show that you can do the work, even without professional SOC experience.
- Build a small home lab: an open-source SIEM, two virtual machines, then generate and analyse your own attacks.
- Practise on defensive training platforms (blue team exercises, log analysis challenges).
- Document your analyses on a blog or GitHub repository: a portfolio recruiters can actually look at.
- Aim for a recognised certification, such as Security+ to start, then CySA+.
- Target MSSPs and offshoring centres, which regularly hire junior profiles, as well as end-of-studies internships.
- Prepare for the interview: you will often be asked to analyse an alert or a log live and explain your reasoning.
Training for a SOC analyst career with GATech
GATech offers the whole path in Morocco: Security+, CND v3, CySA+ and CHFI v11, in the classroom in Casablanca and Rabat or live online, with the official exam voucher included. Our advisers can assess your level and tell you which certification to start with.
To ease the budget: 10% off for early registration, 15% for groups of at least three colleagues from the same company, 15% for students and recent graduates, or three interest-free instalments for individuals (discounts cannot be combined). Request your quote and launch your SOC career.
Frequently asked questions
Can you become a SOC analyst without a cybersecurity degree?
Yes. Many analysts come from system administration, networking or IT support. A solid technical foundation, a documented home lab and a certification such as Security+ or CySA+ can make up for the lack of a specialised degree.
Which certification should you choose for a first SOC job?
CompTIA Security+ is often the best starting point for an L1 role, as it covers the fundamentals recruiters ask for. CySA+ comes next to validate analyst skills, and CND v3 strengthens the network defence side.
Does SOC work involve night shifts?
Often, yes, especially at L1. Many SOCs run 24/7, which means rotating shifts, nights or weekends. Arrangements vary by employer, so ask during the interview.
What is the difference between a SOC analyst and a pentester?
A SOC analyst works on the defensive side (blue team), detecting and handling ongoing attacks. A pentester works on the offensive side (red team), simulating attacks to find weaknesses before attackers do. The two roles complement each other, and some professionals move from one to the other.
Where are SOC jobs located in Morocco?
Mainly in Casablanca and Rabat, in banks, insurers, telecom operators, managed security service providers (MSSPs), offshoring centres and the public sector. Roles also exist in Tangier, Fez or Marrakech, sometimes with partial remote work.
GATech teaching team
Cybersecurity trainers and consultants preparing professionals in Morocco for CEH, OSCP+, CISSP, CompTIA and ISO 27001.
Published
