A county SOC manager is filling a night-shift opening. The job poster lists triaging notables on Incident Review, assigning dispositions, and opening investigations. Which SOC role owns that work?
Select an answer to reveal the explanation.
Short Explanation
Think of the night shift like a 911 dispatcher: take the call, label what it is, and open a case. That person is not rewriting the phone system or drawing next year's org chart. Triage, disposition, and investigations on Incident Review are Analyst work.
Full Explanation
In a county SOC, the night-shift opening that lists triage on Incident Review, disposition assignment, and opening investigations is Analyst work: first-line cyber defense consumes detections rather than authoring them. Civic framing matters because municipal SOCs still separate who works the queue from who builds content and who designs the multi-year program. The correct choice assigns that poster to the SOC Analyst because those duties are operational case handling on Enterprise Security surfaces Analysts actually use.
Assigning the opening to the SOC Engineer fails by concept: Engineers own correlation searches, CIM mappings, and tuning that generate notables, but generating content is not the same job as triaging the queue those searches create. Assigning it to the SOC Architect fails by concept: Architects own coverage strategy and platform maturity over years, not opening a single night-shift investigation. Treating Enterprise Security administration as the owner fails by concept: app ownership and configuration are not interchangeable with working Incident Review as an on-duty defender.
Exam caveat: SPLK-5001 role questions expect Analyst = consume and investigate, Engineer = content and automation, Architect = program design—do not collapse those hats because one person wears two in a small city.
Operational check: Before posting the role, map each bullet on the job description to Analyst Queue or Incident Review workflows versus content apps and architecture deliverables, and keep night-shift hiring language aligned to triage, disposition, and investigation only.