Would you run a tierless SOC at a 200-person firm with one in-house analyst and an overnight provider?

## What tiering actually buys and what it costs A tier model is a staffing answer to a volume problem. Its benefits are real: - **Throughput.** Cheap, well-defined work is done by people hired for it, and the expensive analyst is not reading queue noise. - **A hiring pipeline.** You can employ someone who cannot yet work a whole case and grow them, in a market where experienced analysts are scarce and expensive. - **Consistency.** Playbook-driven work produces comparable dispositions across people and shifts. The costs are equally real and are usually understated in interviews: - **Context loss at every handover.** Escalation transfers a hypothesis about a possibly live adversary through a text field. Some of the reasoning always fails to make the trip. - **Split ownership.** Nobody sees the case from alert to conclusion, so the patterns that only appear across several cases — the same account, the same subnet, three weeks apart — are nobody's job to notice. - **A role that teaches the wrong reflex.** A queue-clearing tier-1 measured on volume learns that closing keeps the numbers healthy and that no one ever comes back to complain. - **A broken feedback loop.** The people who see which detections are wrong are structurally separated from the people who can change them. The **tierless** model answers those: one analyst owns a case end to end, escalates sideways by *expertise* rather than upward by *rank* — to a forensics specialist, to the platform owner who runs the identity provider, to an incident lead — and the same people who work alerts tune the detections that generate them. Its precondition is uncomfortable: every analyst must be senior enough to finish a case, which means the alert volume per analyst has to be low enough for that to be possible. Tierless is therefore something you *earn* with automation, enrichment and detection quality, not something you declare. ## Why this firm's answer is forced At 200 people with one in-house analyst, the abstract debate is moot. There is no internal tier because there is no internal second person. Whatever the org chart says, that analyst is tierless: they own everything from queue to verdict. Pretending there is a tier-3 tier merely conceals that some cases have nowhere to go. What does exist is a boundary — the one between the provider's overnight tier-1 in another timezone and your analyst at 09:00. It is an *organisational* boundary, and it is the one that needs written authority: which conclusions the provider may reach from the telemetry it holds, which it must hand over as open cases, which actions it may take alone, and what an exported case has to contain. That is where the real design effort goes. ## The plan I would actually fund 1. **Narrow the provider's close authority** and give it a hold-and-hand-over disposition, so ambiguous cases arrive as open investigations rather than as closed ones. 2. **Buy depth rather than employ it.** An incident-response retainer covers forensics and a real intrusion; a second full-time senior analyst does not fit the budget and would still not give you 24x7 depth. 3. **Spend on enrichment and automation, not headcount.** Asset owner, criticality, account role, sign-in history and open change records attached to the alert before a human reads it. This is what makes one person's day survivable and is the same investment that would make a tierless model work at any size. 4. **Name the sideways escalation paths.** Identity, endpoint and network platform owners, plus the retainer's hotline. Expertise, not rank. 5. **Write down the accepted risk.** Context-dependent cases wait until daylight. Name the exceptions that must wake someone at any hour, and get the accountable executive to sign for the delay, because that delay is a business decision about dwell time, not a technical one. ## When I would revisit it Growth in alert volume that outpaces automation is the trigger to reconsider — but the first response is more enrichment, not a tier-1 hire. The genuine case for introducing tiers arrives when there is enough repetitive, fully-playbookable work to occupy a person, and when you can offer that person a path out of it. Introducing tiers without that path is how you produce a role people leave within a year, which costs you more than the queue did. ## What an interviewer is listening for That you treat SOC structure as a resourcing and risk decision rather than a best-practice ranking; that you can name what tiering buys as well as what it costs; that you notice tierless is a consequence of automation maturity rather than a preference; and that you close the loop by making the residual risk somebody's signed decision instead of an operational habit.