SOC Staffing Cost 2026: Tier 1-3 Salaries, 24/7 FTE Math
Staffing is 65-70 percent of total in-house SOC cost per the Ponemon SOC Performance Report. The non-obvious driver is the FTE-per-shift-position math: 24/7 coverage of a single tier-1 analyst position requires 5-6 FTEs, which is why a $75K-$95K base salary translates to $480K-$730K loaded cost for one 24/7 seat.
The 24/7 coverage math
One FTE provides 1,800 productive hours per year (52 weeks at 40 hours minus 12 days PTO minus 10 sick days minus 12 days training minus 12 federal holidays). 24/7 coverage requires 8,760 hours per year.
8,760 / 1,800 = 4.87 -> round up to 5 FTEs per shift position
Most SOCs add a 6th FTE for resilience against vacancies, sick leave concentrations, and surge capacity. This is the FTE-per-position math that drives the entire SOC staffing budget and is why "24/7 SOC" is a dramatically more expensive ask than "8x5 SOC".
SOC analyst salary bands (BLS OEWS occupation 15-1212)
| Role | Base salary band | Loaded cost (1.28x) | Typical experience |
|---|---|---|---|
| Tier 1 SOC analyst | $75K - $95K | $96K - $122K | 0-2 years, Security+ / CompTIA CySA+ certifications |
| Tier 2 SOC analyst | $95K - $130K | $122K - $166K | 2-5 years, GCIA / GCIH / Splunk certifications |
| Tier 3 SOC analyst / threat hunter | $130K - $160K | $166K - $205K | 5+ years, GREM / GCFA / OSCP / threat-hunt experience |
| SOC manager | $140K - $180K | $179K - $230K | 8+ years, CISSP / management track |
| Detection engineer / SOAR engineer | $130K - $170K | $166K - $218K | 5+ years, Python / KQL / SPL / Sigma rule authorship |
Salary bands anchor to BLS Occupational Employment and Wage Statistics for Information Security Analysts (occupation 15-1212). Loaded multiplier 1.28x per BLS-published Information sector employer cost ratio (covers employer payroll taxes, benefits, training, and equipment). Region-specific adjustments apply: Bay Area +30-40 percent, NYC metro +20-30 percent.
Minimum viable 24/7 SOC headcount
A minimum viable 24/7 SOC needs 8-12 staff:
- 5-6 Tier 1 analysts for round-the-clock coverage of the single tier-1 alert-triage seat.
- 2-3 Tier 2 analysts for escalation and named-incident handling.
- 1 Tier 3 analyst or threat hunter for advanced investigation and proactive hunting.
- 1 SOC manager for operations, hiring, retention, and executive interface.
Total loaded cost: 5 Tier-1 at $96K-$122K + 2 Tier-2 at $122K-$166K + 1 Tier-3 at $166K-$205K + 1 manager at $179K-$230K = $1.07M-$1.59M annually for a minimum-viable 24/7 SOC at the lower coverage end.
The 12-FTE upper bound adds a second tier-1 seat (5-6 more FTEs to keep parallel-incident-triage capacity), a detection engineer, and a SOAR engineer. This is the typical staffing for a mature mid-market 24/7 SOC handling 1,000+ daily alerts with named MTTD / MTTC SLAs.
Annual turnover and continuity cost
SOC analyst annual turnover runs 20-30 percent industry-wide per the Ponemon SOC Performance Report multi-year average. At 25 percent turnover, an 8-FTE SOC loses 2 analysts per year and has 2 hiring cycles in flight. Each hire carries:
- Recruitment cost: $15K-$30K (agency fees, recruiter time, candidate travel)
- Onboarding cost: 3-6 months at reduced productivity (60-80 percent of full output)
- Training cost: $5K-$15K per analyst for vendor certifications and SOC-specific tooling
- Continuity gap: 1-2 months between departure and replacement onboarding
Total turnover cost per departing analyst, including productivity gap: $40K-$80K. At 25 percent annual turnover on an 8-FTE SOC, that is $80K-$160K/year of turnover overhead baked into the staffing budget. Retention investment (recognition, training budget, career path) typically pays back at 1.5-3x.
Related cost references
Salary bands anchor to US Bureau of Labor Statistics Occupational Employment and Wage Statistics for Information Security Analysts (SOC 15-1212). FTE-per-shift math derived from 1,800 productive hours per FTE annually divided into 8,760 hours of 24/7 coverage. Turnover bands cite Ponemon SOC Performance Report multi-year average.