Hire remote SOC analysts for your MSP or MSSP, tested on a live alert

Buy MDR or staff your own queue

Buying MDR instead of building a SOC is a real option, and for some MSPs it's the right call. If your security book is small, your log sources are thin, or you can't yet write the runbooks an analyst would work from, a provider with a rotation already staffed will beat anything you hire. An analyst with no playbook and several clients' worth of noise is an expensive way to find that out.

Hiring analysts starts to make sense when the math or the control changes. You sell a security service and the per-endpoint MDR fee is squeezing its margin. You want triage inside your own SIEM and EDR consoles, with escalations landing as tickets on your PSA board in wording your service desk already uses. You're an MSSP and the SOC is the product. Or you keep MDR for overnight containment and want daytime analysts who tune detections and turn alerts into notes a client can read.

Run the comparison on your own book. Count the seats a rotation takes for the hours you promise, price each one, and set that against the MDR fee across your endpoints and users. Dokimo places analysts, so the rotation side of that sum is the one it can help you price. It doesn't sell detection and it doesn't take on incident response for your clients, and if MDR wins the sum, buy MDR.

Tier 1 through Tier 3, and what each seat touches

A Tier 1 analyst works the queue: reads the alert, pulls the surrounding telemetry, decides between noise, a ticket and an escalation, and writes the note the next shift reads. Tier 2 owns the investigation, which means scoping a compromised account, checking whether the same behavior shows up on other endpoints, and recommending containment. Tier 3 hunts, tunes detection content, and owns the escalations nobody below can close. Declaring an incident and calling the client stay with a person at your MSP.

The analyst is dedicated to your queue and works through your tools. No candidate is assumed to know what you run. Hours are whatever you agree with us: a day block, an evening block, an overnight block. A rotation is several people, so a coverage plan is written seat by seat, one seat per shift block.

What moves the price

The level of the work, such as how much investigation the seat owns, sets where a seat lands, and the calculator on the pricing page shows the price for each role and level. The price pays the analyst and the employer costs local law requires, year-end pay included. It also covers the search and screening, their employment and payroll in their own country through Dokimo's employer of record (EOR) partner, and one monthly invoice. Tool licenses are yours. That's a fraction of a comparable US hire.

The test is an alert with no answer key

Every candidate is tested on the real work before you meet them. On a SOC seat the candidate gets an alert to work: the raw detection, the surrounding telemetry, and no answer key. Some alerts are real and some are noise, and telling them apart is part of the test.

Three questions tell you how an analyst worked it. What did the candidate escalate, and was it worth escalating? What did they dismiss, and would you have dismissed it? How did they write it up, and could a Tier 2 analyst act on that note at 3am without calling anyone? An analyst who escalates everything wrecks your queue. One who closes everything hides the incident.

Dokimo won't quote a time to shortlist, and says so plainly. A firm that forwards resumes can put names in front of you sooner. You'd rather interview a few people who can work an alert.

Where a remote SOC seat is the wrong answer

Some client environments should stay with US staff, and you decide which. An analyst working a queue sees usernames, hostnames, file names and sometimes message content, so reading a client's alerts is access to that client's environment. Dokimo will not place an analyst on a client environment with export-controlled defense data or on a criminal justice system. Past those, the limits are contract or insurance terms that vary by client. HIPAA doesn't itself ban work from outside the US, but if your MSP can reach health data you have agreements and a risk analysis to weigh, and many clients' agreements go further.

Your agreements set the line, and Dokimo fits the seat to your answer. In practice that can mean splitting the queue: alerts from cleared tenants go to the remote analysts, and alerts from regulated tenants stay in a US-side queue. Build the split into your SIEM or PSA rules rather than trusting people to remember it. Analysts should work through your own tools on named accounts, following the access checklist on the page about offshore techs and client contracts. Nothing here is legal advice. Your agreements and your counsel decide.

Two more cases are outside what these seats do. Anything that needs a person on site, like pulling a drive or imaging a machine in a client's office, stays with someone local. Surge cover is the wrong use too, such as overflow after a breach or an incident response retainer you call when something is already burning. A seat takes time to recruit and ramp, so it doesn't suit a short spike.