Cybersecurity Roles Explained: SOC, Web Security and IT Security Support
Compare the responsibilities and beginner evidence behind three role families.
Part of the Cybersecurity track: modules, projects and first roles →
By the GullyMentor team · 5 min read · Published 2026-10-18 · Updated 2026-11-06 · Sources listed at the end. Not a promise about mentorship outcomes.
SOC analysts investigate alerts, web-security specialists examine how applications handle identity, access and input, and IT security-support staff run the controls around accounts and devices. The roles overlap but start from different skills and produce different evidence. Try one small task from each before choosing a direction.
What does the work look like in practice?
These are short illustrations of the kind of task each role handles. Real jobs vary by employer.
- SOC: An alert shows many failed logins for one account, followed by a success. You check times, locations and whether the user changed their password, write a timeline and decide whether to escalate.
- Web security: In a training application you run yourself, you check whether one fictional user can open another fictional user's order. You document the expected rule, what you saw and a fix.
- IT security support: A staff member leaves. You work through a checklist to disable accounts, revoke access and record who approved each step.
Notice that each task produces a written record. Clear writing matters in all three families.
SOC: investigate signals
A security operations centre monitors signals, triages alerts and escalates potential incidents. A beginner may help build timelines, inspect logs and collect context under supervision.
Useful preparation includes networking, authentication events and clear incident notes. A portfolio can use synthetic logs to show how you distinguish suspicious behaviour from an ordinary retry.
Web security: examine application boundaries
Web-security work studies how an application handles identity, access, input and sensitive information. Testing must occur within explicit authorisation and scope.
Prepare with HTTP, browser/server behaviour and application fundamentals. An isolated lab report can demonstrate evidence, impact, remediation and retesting. Knowing a tool's interface does not establish permission or testing judgement.
IT security support: maintain protective controls
This work can include account lifecycle, endpoint configuration, access reviews and helping users follow secure processes. It requires careful operational habits and communication.
A fictional access matrix and onboarding/offboarding checklist can show how you apply least privilege and document exceptions.
Compare the evidence
| Role family | Typical focus | Beginner portfolio evidence |
|---|---|---|
| SOC | Alerts, timelines and escalation | Synthetic event-triage report |
| Web security | Application behaviour and controls | Authorised-lab finding and retest |
| IT security support | Accounts, endpoints and configuration | Access review and control checklist |
How to choose
Try one bounded task from each family. Notice whether you enjoy interpreting logs, understanding application behaviour or improving operational controls. Build the foundational knowledge those tasks reveal you are missing.
Job titles differ between employers. Read the responsibilities, required experience and working conditions rather than assuming the title alone defines the work.
Do not present a learning lab as a professional penetration test or claim production incident experience from synthetic logs. Clearly labelled practice can still demonstrate useful reasoning and responsible conduct.
Where do freshers in India usually begin?
Paths differ. A student may begin with a college lab or club project. A working professional in IT support, testing or development may move sideways by taking on security tasks in their current team, such as reviewing access or reading authentication logs. Either way, start with bounded practice and keep a short record of what you did. Do not describe practice as professional experience, and do not wait for a perfect plan before trying one task.
What are the common mistakes?
- Choosing a role from a job title alone. Titles differ between IT services companies, product companies and in-house teams, so read the actual responsibilities.
- Learning tool names before fundamentals such as networking, operating systems and HTTP.
- Practising on a website you do not own. Public access is not permission.
- Treating a certificate or a platform badge as proof of judgement.
How do I check I got it?
Describe each role in two sentences without using a tool name. Then name one piece of beginner evidence you could produce for each, and say which of the three you would be curious enough to do for an evening. If you cannot explain why, do the bounded task and try again.
What should I build next?
Pick one role family and build a small lab project. Cybersecurity projects students can build in an authorised lab gives three scoped options, and the cybersecurity roadmap shows how to sequence the fundamentals. The cybersecurity track describes mentor-led practice in this area.
Sources & further reading
Examples and practice recommendations are educational illustrations. Tool documentation and programme inclusions should be checked for your intended use.