---
title: "Purpose"
source: Open Source SOC Documentation
source_url: https://github.com/madirish/ossocdocs
licence: MIT
domain: engineering
subdomain: soc-docs
date_added: 2026-04-25
---

## Purpose
The purpose of this policy is to establish a structured and supportive framework for evaluating the performance of Security Operations Center (SOC) Analysts. The success of the SOC is built upon teamwork, support, and psychological safety, fostering an environment where analysts can develop, share knowledge, and conduct high-quality investigations.

Performance evaluations will be continuous and collaborative, ensuring that SOC Analysts receive guidance, opportunities for career growth, and constructive feedback. The policy emphasizes quality investigations, knowledge sharing, mentorship, and career development, reinforcing the SOC’s mission to adapt to emerging cybersecurity threats through ongoing learning and skill enhancement.

This policy should supplement any additional Human Resources (HR) policy for the organization.
## Scope
This policy applies to all SOC personnel, including:

- SOC Analysts (All Levels)
- SOC Managers
- SOC Director

It governs all performance evaluation processes, including:

- Investigation quality assessments
- Knowledge sharing contributions
- Formal and informal training efforts
- Career development planning
- Annual performance reviews
- Record-keeping and review processes

This policy is designed to align with the organization’s broader HR policies and performance management guidelines.
## Roles and Responsibilities

| Role          | Responsibility                                                                                                                                                                                                                              |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SOC Analyst   | Conducts quality investigations, participates in knowledge-sharing efforts, supports peers, and engages in professional development.                                                                                                        |
| SOC Manager   | Provides regular feedback, supports career development, sets performance goals, ensures evaluations are conducted fairly, and maintains records.Review performance reports developed by other managers to identify and remedy any bias. |
| SOC Director  | Oversees evaluation consistency, reviews all performance evaluations, and ensures alignment with organizational policies.                                                                                                                   |
| HR Department | Ensures compliance with broader performance evaluation policies and record retention requirements.                                                                                                                                          |

## Policy Statement
The SOC recognizes that quality investigations, collaboration, and knowledge sharing are critical to operational success. Performance evaluations are not merely about individual achievements but also about fostering an environment of continuous learning, mentorship, and mutual support.

To achieve this:

1. Investigation quality will be a core metric in performance evaluations, ensuring that analysts are conducting thorough, accurate, and timely investigations.
2. Knowledge sharing and mentorship will be integral to SOC performance assessments, encouraging analysts to research, share resources, mentor peers, and conduct training sessions that are recorded for those on different shifts.
3. Regular 1:1 meetings between SOC Analysts and Managers will include ongoing performance discussions, career development planning, and skill-building opportunities.
4. Performance evaluations will be conducted at least quarterly to formally assess progress and adjust goals as needed.
5. Annual performance evaluations will include a self-evaluation, a manager evaluation, and a review meeting, with cross-manager review to prevent bias and ensure fairness.
6. All performance records will be maintained in an accessible archive and organizational HR system, ensuring transparency, compliance, and continuity.
### Policy Elements
### **1. Quality of Investigations**

- Each SOC Analyst’s performance will be assessed based on the **quality score** of their investigations, as determined by:
    - **Accuracy** of threat assessment
    - **Thoroughness** of investigation documentation
    - **Appropriate escalation and response actions**
    - **Ability to differentiate between false positives and genuine threats**
- Investigation reviews will be conducted regularly, with feedback provided to analysts to support continuous improvement.

### **2. Knowledge Sharing and Mentorship**

- Analysts are expected and encouraged to:
    - Conduct cybersecurity research and share relevant findings.
    - Participate in formal and informal training sessions for colleagues.
    - Mentor junior analysts and contribute to knowledge transfer efforts.
    - Engage in SOC discussions, shift handoffs, and online collaboration channels to foster camaraderie and shared learning.
- Contributions to knowledge sharing will be documented and considered in performance evaluations.

### **3 Regular 1:1 Meetings and Career Development**

- SOC Managers and Analysts will meet weekly for at least 30 minutes to:
    - Discuss ongoing performance.
    - Identify training opportunities.
    - Align career goals with potential projects and collaborations within the SOC.
    - Provide structured feedback and support for professional growth.
- SOC Managers will develop and document a formal career development roadmap for each analyst, where feasible.
- Managers will advise on:
    - Potential career pathways within cybersecurity.
    - Requirements and expectations for promotion.
    - Feasible plans for achieving promotions if desired.

### 4.Principle of No Surprises

* SOC Managers will identify and communicate performance issues immediately and address them with Analysts as rapidly as possible.
* No rating less than Meeting Expectations can be given to an Analyst without prior, documented, evidence of performance issues.
* Performance issues should be accompanied by a performance improvement plan with the goal to support SOC Analysts to meet expectations.
* SOC Managers must immediately discuss any performance issues with other SOC Managers who can provide support and guidance.
* The SOC Director must be made aware of any performance issues and be provided with documentation of all performance improvement plans.

### **5. Performance Goal Setting**

- Performance goals will be collaboratively set between the SOC Analyst and SOC Manager using SMART criteria:
    - Specific – Clearly defined objectives.
    - Measurable – Quantifiable success metrics.
    - Achievable – Realistic based on role and experience.
    - Relevant – Aligning with SOC objectives.
    - Time-bound – With clear deadlines for completion.
- Goals should include support for colleagues, such as:
    - Providing formal feedback on investigations.
    - Participating in shift handoffs.
    - Contributing to SOC culture, discussions, and forums.

### **6. Quarterly and Annual Performance Evaluations**

- Quarterly Performance Review:
    - Every three months, at least one full 1:1 meeting will be dedicated to a formal performance evaluation.
    - Performance progress will be assessed against established goals.
    - Feedback will be documented for ongoing improvement.
- Annual Performance Evaluation Process:
    - Conducted once per year, following the organization’s formal HR process.
    - Includes:
        - Self-evaluation by the SOC Analyst.
        - Manager evaluation of performance.
        - Evaluation review meeting to discuss strengths, areas for growth, and career progression.
    - Evaluations will be cross-reviewed by other SOC Managers to ensure fairness.
    - The SOC Director will review and approve all evaluations before submission.

### **7. Performance Record Retention and Compliance**

- All performance evaluations and related records will be:
    - Stored in an accessible and centralized repository.
    - Retained according to organizational HR policies.
    - Subject to cross-manager review to reduce bias and ensure fair assessments.

## Enforcement and Compliance
The SOC Director and the HR Department are responsible for enforcing this policy.  This policy ensures fair, structured, and development-oriented performance evaluations, reinforcing the importance of investigation quality, collaboration, and career growth in the SOC.  Failure to comply with this policy could degrade performance and reduce psychological safety in the SOC and may result in disciplinary action.

## Policy Review
This policy will be reviewed annually by all employees to ensure its continued relevance and effectiveness. Feedback and suggestions for improvement are welcome and should be directed to the SOC Leadership.

Effective Date:

|Last Reviewed By     | Date    |
| --- | --- |
|     |     |
