Tier 5 security engineer or architect is usually a specialist in software or hardware who recommends, implements, maintains and updates tools and systems. An important area of their responsibility, naturally, is SIEM platforms, but they can also help with the development and implementation of enterprise cybersecurity architecture.

In addition to the above tasks, security engineers develop documents with requirements, procedures, protocols, etc. which might be required by other cybersecurity specialists or users. Those documents are constantly updated to meet ever-changing industrial and internal frameworks. Security engineers or architects will sometimes be employed within the SOC, sometimes outside, and just support it as part of the security operations team, but either way, their role is essential for the overall success of SOC.

The skills set for security engineers is somewhat different to Tier 1–3 analysts, and usually suggest a degree in computer science or engineering, plus some cybersecurity certification like CISSP.

Read more about SOC team composition and SOC-as-a-Service