NOC vs. SOC
NewBoth are 24x7 rooms of screens and shift teams, and the acronyms differ by one letter. A NOC (network operations centre) watches whether networks and systems are up and performing. A SOC (security operations centre) watches for attacks and investigates security alerts. The tools, skills and career paths differ: NOC work leads towards network engineering, SOC work towards cybersecurity.
How to tell them apart on a resume
NOC (network operations)
Uptime, link and device alerts, SolarWinds, PRTG, Nagios, escalations to network teams, ticket SLAs: network and infrastructure support.
SOC (security operations)
SIEM alerts, Splunk, QRadar, Sentinel, threat triage, incident investigation, phishing analysis: SOC analyst and security roles.
The question that settles it
“On your shifts, were you watching whether systems were up and performing, or looking for attacks and security threats?”
Each term in plain English
- NOC
The team that watches a company's (or its clients') networks and systems around the clock, responds to alerts and outages, and escalates to specialist engineers.
Ask “In your NOC role, what could you fix yourself and what did you have to escalate? Give me an example of each.”
- SOC
A team (or role) responsible for continuously monitoring and responding to security threats and incidents.
Ask “Walk me through how you triaged an alert, from first notice to resolution.”
- Network Monitoring Tools
Tools that watch network devices and servers: whether they're up, how busy each link is, and alerts when something fails.
Ask “Did you set up the monitoring or only watch it? How did you cut down alerts nobody needed?”
Open the full tool for the other look-alike pairs, role profiles, and the JD decoder.