SOC analyst hiring
Hire SOC analysts who can actually triage.
Before anyone gets an interview, they triage a real phishing email, hunt in a Sentinel-style KQL workspace and work a raw Windows event log. Your SOC leads spend interview time on judgement, not on finding out whether someone can read a log.
Tier 1, 2 or 3 · Real logs, real tools · Built from your job spec
Trusted by cyber security teams at
At a glance
What is a SOC analyst assessment?
A SOC analyst assessment is a hands-on test of the work the job involves: triaging alerts, reading raw logs, hunting across telemetry and deciding what to escalate. Candidates do it in the same kinds of tools, on realistic data with the noise left in, before anyone is interviewed.
- Environments
- Sentinel-style KQL workspace, Windows Event Viewer, mail client with full headers, live Linux shell, PowerShell console
- Level
- Tier 1, 2 or 3. Tell us the tier and we build it to that difficulty.
- Length
- Sized to your process. The ready-made SOC assessment is eight challenges; for a first screen, we trim it to two or three.
- Answers
- Candidates type what they found in the data. There is no list to guess from on the investigations.
- Scoring
- Automatic, against the same answer key for every candidate, broken down by skill.
- Integrity
- Three modes, up to webcam proctoring with consent. Signals sit next to every score.
- Delivery
- A link, a secure bulk upload or straight from your ATS, in your branding.
Why hiring managers use it
Interview analysts who have already shown you the work.
Your best analysts can tell in five minutes whether a candidate can triage. Let the candidate show them before the interview, not during it.
-
Every interview is with someone who can read a log.
Candidates investigate real alerts first. By the time a SOC lead gives up an hour, the person in front of them has already found the signal in actual log output.
-
Your seniors build nothing and mark nothing.
We build the assessment from your job spec and scoring is automatic, so nobody on the queue spends an evening writing tests or marking them.
-
Calibrated to the tier you are hiring.
A Tier 1 hire is not screened against a Tier 3 bar, which makes everyone fail and the market look empty. Pick the tier and the challenges are held to it.
-
Interviews that start where the assessment stopped.
Every candidate arrives with a score by skill and the questions they missed, so the conversation goes on judgement, escalation and how they handle being wrong.
What candidates work on
The ready-made SOC analyst assessment.
Eight hands-on challenges across the core of the job, set at Tier 2. We tailor it to your job spec: the challenges, the length and the tier.
Alert triage and phishing
- Phishing Analysis: Credential Harvesting Campaign
Investigation in Windows logs
- Windows Event Log - Kerberoasting Investigation
- Group Policy Security Review - Dangerous Settings Audit
Hunting and detection
- KQL Lab: Password Spray & Privilege Escalation
- MITRE Case Study - C2 and Defense Evasion
Endpoint and host investigation
- PowerShell Forensics: Malicious Script Investigation
- Linux Privilege Escalation (Terminal)
Network and data analysis
- CyberChef: DNS Exfiltration Analysis
8 challenges · about 199 minutes as listed · trim or swap any of them for your role · See every SOC challenge
One case, end to end
What a strong answer actually looks like.
A SOC alert has flagged unusual Kerberos service-ticket activity. Around 190 events sit across the Security, System, Application and PowerShell channels. Several accounts request RC4 service tickets, and some of that is legitimate. Find the account doing the Kerberoasting, then follow what happened next.
Names the roasting account from how its requests behave rather than from the encryption type alone, explains why the other bursts of ticket requests are not attacks, and follows the same machine into the next day's logons to find which service account was cracked and where it was used.
Flags every RC4 request as malicious, or finds the burst and stops there, missing the follow-on logon that turns a suspicious event into a compromised service account.
The candidate's screen
Real tools, with the noise left in.
Every case puts legitimate activity next to the malicious kind, because separating the two is the job.
Free, before you commit to anything
See it before a candidate does.
Tell us the role. We build a hands-on SOC analyst assessment for it, in your branding, and send you a private link to sit it yourself. If it is not right for your team, you have lost nothing.
- 01 Tell us the role Send the job spec or just the role title. A job description helps but is not required.
- 02 We build it for you We turn the spec into a hands-on SOC analyst assessment from real challenges, at the right level, in your branding.
- 03 Invite your applicants You get a private link to try it first. When you are happy, send it to your applicants. That is it.
What you get back
Evidence for every candidate. Read in two minutes.
Results arrive in your workspace as candidates finish, and as a hiring report you can forward to anyone on the panel, including people who never log in. Connected to your ATS, the result is written back to the candidate record.
- Ranked, scored the same way Every candidate on the same challenges and the same answer key, ranked on what they did.
- A score per skill Where each candidate is strong and where they are thin, with their actual answers underneath.
- What to probe at interview For every candidate: the skills they were weakest on and the questions behind it.
- Integrity next to every score Time away, outside pasting, fullscreen exits and second screens, flagged for you to weigh.
How it runs
From job spec to shortlist evidence.
- 01
Send us the role
Fill in the form with the job spec, or just the role title. That is all we need from you.
- 02
We build your assessment
Hands-on, built to your role and level, in your branding, and ready to send. Change anything you like, or send it exactly as it is.
- 03
Invite candidates
A link, a secure bulk upload or straight from your ATS. Direct applicants, referrals, internal movers and agency candidates all sit the same test.
- 04
Candidates do the work
In real environments, in your branding, with integrity monitoring on. Watch results arrive in your workspace.
- 05
Read the evidence
A ranked cohort, a score per skill, the questions to probe with each candidate and any integrity signals. Interview the ones who can do the job.
Questions we get asked
SOC hiring questions, answered.
What should a SOC analyst assessment include?
A small piece of the actual job: triage under ambiguity, reading raw logs, and correlating across sources such as sign-in, endpoint and email data. All three can be tested in under an hour, and none can be answered from memory or a search engine.
Can you calibrate it to Tier 1 rather than Tier 3?
Yes. Tell us the tier and we build the assessment to it, with every challenge held to that difficulty. It matters more than most teams expect: a SOC assessment written by the strongest analyst on the team tends to screen Tier 1 candidates against a Tier 3 bar, so everyone fails and the market looks empty.
How long does a SOC analyst assessment take?
As long as suits your process. The ready-made assessment is eight challenges of 15 to 30 minutes each, which suits a deep technical round. For a first screen, two or three challenges are enough to show who is worth an hour of a senior analyst's time.
What stops candidates using AI?
Mostly the task design. An AI model will define Kerberoasting instantly, but it cannot tell you which account in this specific log set is doing it, because that answer only exists in the data in front of the candidate. Time away from the test, outside pasting, fullscreen exits and second screens are recorded next to every score, and Proctor mode adds webcam snapshots with consent.
We run Sentinel. Do you cover Splunk too?
Hunting is hands-on in a Sentinel-style KQL workspace against sign-in, device and audit tables. Splunk is covered by an SPL knowledge challenge rather than a live Splunk environment. Event logs, email analysis and the Linux shell work the same whichever SIEM you run.
Do we still interview?
Yes, and the interview gets better. Instead of spending the hour finding out whether someone can read a log, you spend it on judgement, escalation and how they handle being wrong. The report tells you who to interview and what to ask each of them.
Can we assess candidates our agency sent us?
Yes. Direct applicants, referrals, internal candidates and agency submissions all go through the same assessment and are ranked on the same evidence.
Go deeper
How we think about SOC assessment
None of it is gated.
Try it on your role
See the SOC analyst assessment built for your role.
Send us the job spec. We build the assessment around it, in your branding, and you try it yourself first. Free, and with no commitment.