TecHub

Security Operations / SOC

Security Operations / SOC is an individual-contributor career path within Cybersecurity & Trust. Professionals progress from guided execution to independent delivery, senior problem solving, cross-team leadership and enterprise-level expertise without requiring people management.

Archetype
Operations
Highest level
L6 · Senior Principal Security Operations & SOC Specialist

Why it exists

Enables the organization to deliver reliable outcomes in security operations / soc by building progressively deeper expertise, judgment, ownership and business impact.

Typical responsibilities

Execute discipline-specific work; apply professional standards; solve increasingly complex problems; collaborate with stakeholders; improve quality and efficiency; share expertise; at senior levels, shape practices and decisions beyond the immediate team.

Where the work happens

Common in Cybersecurity & Trust teams across technology companies, shared-services organizations, consulting firms, multinational operations and other employers that require security operations / soc capability.

How the career progresses

Associate Security Operations & SOC Specialist → Security Operations & SOC Specialist → Senior Security Operations & SOC Specialist → Lead Security Operations & SOC Specialist → Principal Security Operations & SOC Specialist → Senior Principal Security Operations & SOC Specialist

Levels in this career

Six standard stages. The seventh exists only where the career provides for it.

  1. L1Associate Security Operations & SOC Specialist
  2. L2Security Operations & SOC Specialist
  3. L3Senior Security Operations & SOC Specialist
  4. L4Lead Security Operations & SOC Specialist
  5. L5Principal Security Operations & SOC Specialist
  6. L6Senior Principal Security Operations & SOC Specialist

What is expected at L5 · Principal Security Operations & SOC Specialist

Principal-level authority; shapes standards, methods, architecture or operating practice across a function/domain. The focus is successful individual contribution at this stage, not people management.

The five dimensions that change

Autonomy
Defines approaches and exercises significant professional judgment.
Scope
Major domain, platform, portfolio or business capability.
Complexity
Highly complex/systemic problems.
Influence
Influences leaders and sets domain direction.
Business impact
Strategic domain outcomes and durable organizational capability.
Ambiguity
High; often defines the problem as well as the solution.

What good looks like

Principal Security Operations & SOC Specialist consistently demonstrates the expected autonomy and judgment for L5, delivers outcomes appropriate to the scope of the role, applies required Human, Professional and Technical skills at the mapped proficiency, and produces evidence of impact rather than relying on tenure alone.

Typical evidence

Completed work with measurable quality/outcome; stakeholder feedback; examples of problems solved and decisions made; reusable artifacts or improvements; demonstrated skill proficiency; mentoring/influence evidence at senior levels.

Skills expected at L5

Grouped as human, professional and technical. Target proficiency uses the P1–P7 scale, and each row says what that level means for that particular skill.

Human21

HumanPSupporting
AccountabilityExecution & Self-ManagementP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Active listeningCommunication & LanguageP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
AdaptabilityExecution & Self-ManagementP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Clear verbal communicationCommunication & LanguageP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Clear written communicationCommunication & LanguageP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
CollaborationCollaboration & RelationshipsP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Continuous learningExecution & Self-ManagementP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Critical thinkingThinking & Problem SolvingP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Cross-functional collaborationCollaboration & RelationshipsP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Decision makingThinking & Problem SolvingP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Executive communicationCommunication & LanguageP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Influencing without authorityInfluence & Leadership Without AuthorityP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
ProfessionalismEthics & Professional ConductP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Stakeholder alignmentInfluence & Leadership Without AuthorityP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Strategic thinkingThinking & Problem SolvingP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Structured problem solvingThinking & Problem SolvingP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Time managementExecution & Self-ManagementP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Giving constructive feedbackCommunication & LanguageP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Knowledge sharingCollaboration & RelationshipsP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
MentoringCollaboration & RelationshipsP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
NegotiationInfluence & Leadership Without AuthorityP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.

Professional19

ProfessionalPSupporting
Vulnerability management processCybersecurity, Privacy & Data Governance StandardsP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Architecture governanceIT Service Management & GovernanceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
COBIT governanceIT Service Management & GovernanceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Information security governanceCybersecurity, Privacy & Data Governance StandardsP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
NIST Cybersecurity FrameworkCybersecurity, Privacy & Data Governance StandardsP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
PMO governanceProject, Program & Portfolio ManagementP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Project governanceProject, Program & Portfolio ManagementP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Project risk managementProject, Program & Portfolio ManagementP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Risk assessmentRisk, Controls, Audit & ComplianceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
SOC 2 security complianceCybersecurity, Privacy & Data Governance StandardsP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Scope managementProject, Program & Portfolio ManagementP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Service level managementIT Service Management & GovernanceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Service request managementIT Service Management & GovernanceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Status reportingProject, Program & Portfolio ManagementP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Technical debt managementIT Service Management & GovernanceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Technology governanceIT Service Management & GovernanceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Third-party risk managementRisk, Controls, Audit & ComplianceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Vendor risk managementRisk, Controls, Audit & ComplianceP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Zero Trust principlesCybersecurity, Privacy & Data Governance StandardsP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.

Technical15

TechnicalPSupporting
Vulnerability scanningCybersecurity Tools & EngineeringP6ExpertCoreEnterprise expert who sets standards, shapes strategy and develops capability across functions.
Cloud security configurationCloud PlatformsP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Email security toolsCybersecurity Tools & EngineeringP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Google Compute EngineCloud PlatformsP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Google Kubernetes EngineCloud PlatformsP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Microsoft AzureCloud PlatformsP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Security orchestration automation and response (SOAR)Cybersecurity Tools & EngineeringP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
ServiceNow HRSDEnterprise IT & Service PlatformsP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
ServiceNow ITSMEnterprise IT & Service PlatformsP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
ServiceNow SecOpsEnterprise IT & Service PlatformsP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
ServiceNow administrationEnterprise IT & Service PlatformsP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
Splunk SecurityCybersecurity Tools & EngineeringP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
VPN technologiesNetworking & InfrastructureP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
VirtualizationNetworking & InfrastructureP5AdvancedSupportingRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.
WiresharkCybersecurity Tools & EngineeringP5AdvancedCoreRecognized advanced practitioner who defines approaches and solves ambiguous cross-team problems.

What changes from L5 to L6

Moving from Principal Security Operations & SOC Specialist to Senior Principal Security Operations & SOC Specialist means demonstrating sustained performance at a larger scope with greater autonomy, complexity, influence and business impact—not simply spending more time in role.

How readiness is shown

Repeatedly performs key aspects of Senior Principal Security Operations & SOC Specialist before promotion; demonstrates the required skill increases; handles systemic, novel and high-consequence challenges.; receives credible stakeholder evidence; shows measurable outcomes at the next-level scope.

How to prepare

Take stretch assignments at the next-level scope; deepen the listed skill gaps; seek feedback from experienced practitioners; document measurable outcomes and decisions; mentor/share knowledge where appropriate; pursue relevant learning or certification when it strengthens capability.

Adjacent careers

Computed from shared skills. It is a signal for exploring, not a hiring or eligibility guarantee.

Career framework v21, active since August 17, 2026.