SOC: Security Operations Center vs. SOC 2
Three letters, two unrelated jobs. A Security Operations Center is a staffed team watching alerts around the clock. SOC 2 is an audit report about a company's controls, produced once a year with auditors and evidence. Searching for "SOC" returns both, and they hire completely different people.
How to tell them apart on a resume
Security Operations Center
Sits next to shift work, alert triage, and tool names — SIEM, EDR, threat intel. Often reads "Tier 1/Tier 2 SOC analyst" and describes what they escalated.
SOC 2 (the audit report)
Sits next to compliance language — access reviews, evidence collection, ISO 27001, auditors, Type I and Type II. Describes preparing for an audit, not responding to attacks.
The question that settles it
“When you say SOC, do you mean sitting in a security operations centre triaging alerts, or getting the company through a SOC 2 audit?”
Read the full definitions
Open the full tool for the other look-alike pairs, role profiles, and the JD decoder.