What is L1, L2, L3 SOC analyst and how do responsibilities differ across tiers?

L1 analysts perform initial triage, monitor SIEM dashboards, and escalate confirmed incidents—think ticket validation and basic containment at Bangalore SOCs like HCL or Wipro. L2 analysts investigate escalated alerts, correlate threat intel, write Sigma rules, and map incidents to MITRE ATT&CK techniques—deeper forensics and response coordination. L3 analysts handle advanced threat hunting, zero-day analysis, playbook development, and architect detection logic—often ex-L2s at Akamai or Razorpay with 5+ years. Interview tip: Bangalore employers expect L1 candidates to explain a real alert they triaged; L2 roles test Sigma rule syntax and ATT&CK mapping on the spot.