SOC Staffing Calculator

Turn a coverage schedule, analyst time off and your alert volume into a SOC headcount and annual cost, with every assumption on the page.

Inputs

Coverage

Hours per day

Days per week

Pick a schedule or type your own hours, e.g. 10 hours × 6 days.

Analysts on shift at all times (seats)

Analysts watching the queue at every hour of coverage. One seat is the minimum for a staffed SOC.

Productive hours per analyst

Paid hours per week

PTO days

Holidays

Training

Sick days

Days per person per year. A day off counts as one fifth of the weekly hours. The defaults (15 PTO, 10 holidays, 10 training, 5 sick) are planning assumptions, not published figures: use your own policy.

Workload (optional)

Alerts per day that an analyst must look at

After automated filtering and suppression: the alerts that reach a person. Leave at 0 to size on coverage alone.

Minutes to triage an alert

Average time an L1 analyst spends per alert, including documentation and escalation.

Share of productive time on queue work

The rest goes to meetings, handovers, breaks and project work. 70% is a planning assumption.

Escalation tiers (optional)

One L2 analyst per

One L3 analyst per

How many L1 analysts each senior person supports, e.g. 5 means one per five. Leave at 0 for none. These are headcount ratios; they don't add round-the-clock coverage for the senior tiers.

Loaded annual cost per person, USD (optional)

Salary plus benefits, payroll taxes, tools and overhead, averaged across tiers. Leave at 0 to skip cost.

Result

Enter the coverage and seats to see the SOC headcount.

Related Tools

NOC Staffing Calculator
Work out how many engineers you need to watch your network and infrastructure for the hours you need covered.
Help Desk Staffing Calculator
Work out how many help desk technicians you need for your ticket volume and the hours you’re open.
Downtime Cost Calculator
Put a dollar figure on IT downtime per hour, per outage and per year, using your own revenue and staff costs.

How the calculation works

Coverage. Hours to cover a year = hours per day × days per week × 365 ÷ 7. A 24×7 SOC covers 8,760 hours; a 12×5 one covers 3,128.6.

Productive hours per analyst = paid hours per week × 52 − days off × (paid hours per week ÷ 5). Days off are PTO + holidays + training + sick days, and a day counts as one fifth of the weekly hours. The defaults (40 hours a week; 15 PTO, 10 holidays, 10 training and 5 sick days) give 2,080 − 40 × 8 = 1,760 hours. They are planning assumptions, not published figures: use your own policy.

People per seat = coverage hours ÷ productive hours. Nothing is hard-coded: the familiar “about five people per 24×7 seat” comes out of these inputs and moves when they change. Coverage FTE = seats × people per seat.

Alert workload (optional). Triage hours a year = alerts per day × minutes per alert ÷ 60 × days covered a year. Workload FTE = triage hours ÷ (productive hours × the share of time on queue work, 70% by default). Alerts are assumed to arrive while the SOC is staffed, spread over the shift; bursts during an incident are not modeled.

L1 analysts = the larger of coverage FTE and workload FTE, rounded up to whole people. L2 and L3 = L1 ÷ the ratio you set (one per N), rounded up. Annual cost = total headcount × the loaded cost per person you enter. The calculator has no salary data of its own.

Worked example

A 24×7 SOC with two analysts on shift, the default time-off assumptions, 300 alerts a day that reach a person at 10 minutes each, one L2 per five L1, one L3 per ten L1, and $140,000 loaded cost per person (an example input, not a market rate):

Productive hours: 2,080 − 40 × 8 = 1,760 per analyst
People per seat: 8,760 ÷ 1,760 = 4.98, so coverage alone needs 2 × 4.98 = 9.95 FTE
Triage: 300 × 10 min = 50 hours a day × 365 = 18,250 hours a year ÷ (1,760 × 70% = 1,232) = 14.81 FTE, about 3 analysts on shift on average
The workload is larger, so 15 L1 analysts; L2: 15 ÷ 5 = 3; L3: 15 ÷ 10 = 1.5, rounded up to 2
Total: 20 people, × $140,000 = $2,800,000 a year

With only 20 alerts a day the triage load is under 1 FTE, coverage sets the number, and the two seats need 10 L1 analysts.

In-house SOC or MDR

Building a 24×7 SOC means hiring and keeping around five people for every seat, plus a SIEM, endpoint tools and someone to run them. Managed detection and response is the usual alternative: the provider staffs the shifts and you keep the decisions. Some teams split the work, with an internal analyst or two in business hours and a provider covering nights and weekends. Run this calculator for the coverage you would keep in-house and compare the cost with quotes for the rest.

Frequently Asked Questions

How many analysts does a 24×7 SOC need?

For each analyst seat you want filled around the clock, divide the 8,760 hours in a year by the productive hours one analyst works. With a 40-hour week and 40 days off a year (PTO, holidays, training and sick days), that is 8,760 ÷ 1,760 = 4.98, so about five people per seat before alert volume, escalation tiers or management. One seat is the floor: it leaves nobody to cover a break or a second incident, and the alert load may call for more.

How do alert volume and triage time change the headcount?

The calculator turns alerts per day × minutes per alert into hours of triage a year and divides by the productive hours each analyst spends on the queue. When that is more than the coverage headcount, the workload sets the number of L1 analysts. Counting only alerts that reach a person, after tuning and suppression, keeps the figure honest; cutting triage minutes or false positives lowers it directly.

What is a fair share of an analyst's time for queue work?

There is no published standard. The calculator starts at 70% as a planning assumption, leaving the rest for shift handovers, meetings, threat hunting, tuning and breaks. Use your own figure from time tracking if you have it. Setting it to 100% assumes analysts triage every productive minute, which understates the team you need.

Should we build a SOC or use managed detection and response?

Managed detection and response (MDR) is the usual alternative to staffing a 24×7 SOC yourself: the provider supplies the analysts, the shifts and usually the tooling. Compare the annual cost from this calculator, plus your SIEM, EDR and tooling spend, against MDR quotes for the same scope. The calculator doesn't estimate MDR prices; quotes depend on endpoints, log sources and response scope.

Does the headcount include a SOC manager or engineers?

No. It counts L1 analysts on the coverage schedule and, if you set ratios, L2 and L3 analysts as a share of L1. Add a manager, detection engineers or SIEM administrators separately. The L2 and L3 ratios are headcount, not extra round-the-clock seats, so if senior analysts must also be on shift at night, size them as seats on their own run of the calculator.

Related Episodes

Episode 229 · October 13, 2026

What AI Is Doing in Your Company (That You Don't Know About)

Episode 223 · September 1, 2026

How to Tell If Your MDR Provider Will Actually Stop an Attack

Episode 220 · August 12, 2026

Are Your Security Tools Actually Protecting You?

More Security episodes

Weighing an in-house SOC against MDR?

30 minutes. No pitch. Just an honest conversation about where you are, what you need, and whether working together makes sense.

SOC Staffing Calculator

Inputs

Coverage

Productive hours per analyst

Workload (optional)

Escalation tiers (optional)

Result

Email me this result

Related Tools

How the calculation works

Worked example

In-house SOC or MDR

Frequently Asked Questions

Related Solutions

Security Operations Center (SOC)

Managed Detection and Response (MDR)

Security Information and Event Management (SIEM)

Related Articles

How to Tell If Your Managed Cybersecurity Provider Will Actually Respond During an Attack

Your MDR Provider May Detect Threats but Doesn't Stop Them.

The Vendor Said Your Cyber Insurance Requires Their Product. Go Check.