How do I write a good SOC analyst job description?

Most SOC analyst postings are written as wish lists rather than actual requirements, and this measurably shrinks the applicant pool. Research on job postings generally shows that listing more than a handful of hard requirements suppresses applications disproportionately from qualified women and career-changers, who tend to self-select out unless they meet nearly every listed qualification, while less-qualified applicants apply regardless. In a field with a documented 4 million-person global workforce gap (ISC2, 2024), that self-selection effect actively works against you.

Separate required from preferred explicitly, and keep the required list short. For a Tier 1 SOC role, a defensible required list is: CompTIA Security+ or equivalent, basic networking knowledge, and willingness to work rotating or on-call shifts if applicable. Everything else, specific SIEM experience, a particular scripting language, a second certification, belongs under 'preferred' or 'nice to have,' clearly labeled as such.

State the actual tools and platform, not generic buzzwords. 'Experience with SIEM tools' filters weakly; 'experience with Splunk or Microsoft Sentinel (we use Sentinel)' filters precisely and lets candidates self-assess accurately before applying, saving both sides time. The same logic applies to ticketing systems, EDR platforms, and any proprietary internal tooling candidates would need to ramp up on.

Set the experience requirement to match the actual seniority. Tier 1 SOC roles do not need two-plus years of experience; that requirement, extremely common in real postings per CyberSeek (2024), directly contradicts the industry's own complaints about the entry-level pipeline being too thin. If the role is genuinely entry-level, say '0 to 2 years, career-changers welcome' and mean it.

Describe the actual day, not an idealized one. Candidates evaluating a SOC role want to know real alert volume, shift structure, escalation path, and team size. A posting that says 'fast-paced, dynamic environment' without specifics reads as evasive to experienced candidates and provides no useful signal to inexperienced ones.

Include compensation range. Pay transparency is increasingly required by law in many U.S. states and, independent of legal requirement, measurably reduces time-to-hire by filtering out mismatched expectations before the first call rather than after a multi-round process.

DecipherU for Teams pairs a well-scoped job description with a standardized skills assessment so the posting's requirements and the actual screening bar match; a posting that says '0 to 2 years, Security+ required' should be backed by an assessment that tests exactly that level, not a five-certification checklist applied inconsistently at the interview stage. See the related career entry for soc-analyst for realistic Tier 1 compensation benchmarks to include in the posting.