The real staffing math for running a SOC 24/7, for growing MSSPs and teams about to go round the clock.
This post is for MSSPs and in-house SOCs that are growing and planning to run 24/7 for the first time, and need to check whether their current headcount really holds up.
The exact number depends on your SOC, the number of clients, Workload, Days off provided ( annual leave, sick leave, study leaves etc.. ) & how they can be utilized considering that 24/7 coverage can be met by the rest of the Analysts.
This post focuses on the minimum you need to keep one seat staffed around the clock.
In short, you need roughly 5 to 6 full-time analysts per 24/7 seat. The exact figure shifts a little with the rotation you run. For example, 12-hour shifts on a 2-2-3 pattern and 8-hour shifts on a three-shift pattern each fit team sizes differently.
We'll use the 2-2-3 rotation to model it. Like other 12-hour rotations, it covers a 24/7 seat with just four people on paper, which makes it the clearest way to show where the extra analysts come from.
The schedule below is covered by four analysts on a 2-2-3 rotation over two weeks. Two analysts alternate day shifts, and two alternate night shifts.
D = day shift (07:00–19:00)
N = night shift (19:00–07:00) – = off
| Analyst | Mon | Tue | Wed | Thu | Fri | Sat | Sun | Mon | Tue | Wed | Thu | Fri | Sat | Sun | Hours |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| A | D | D | – | – | D | D | D | – | – | D | D | – | – | – | 84 |
| B | – | – | D | D | – | – | – | D | D | – | – | D | D | D | 84 |
| C | N | N | – | – | N | N | N | – | – | N | N | – | – | – | 84 |
| D | – | – | N | N | – | – | – | N | N | – | – | N | N | N | 84 |
Every day and every night is covered exactly once. Each shift is 12 hours long (07:00–19:00 or 19:00–07:00). If you count the D's or N's in any analyst's row, each one works 7 shifts every two weeks: 2 + 3 in week one, then 2 in week two. That's 7 shifts × 12 hours = 84 hours per two weeks, the number in the Hours column. Split across two weeks, 84 ÷ 2 gives an average of 42 hours a week per analyst, comfortably under the EU's 48-hour limit. The 2-2-3 pattern repeats every 14 days, so a 28-day month is exactly two full cycles. In those 28 days, one seat needs 28 days × 24 hours = 672 hours of coverage. Each analyst works 14 shifts × 12 hours = 168 hours in the same period, so the four of them work 4 × 168 = 672 hours in total.
The hours needed and the hours worked are both 672, which means there is zero slack. The moment anyone is off, a shift goes uncovered.
Now Analyst A takes the first week off. A's week-one shifts are Mon, Tue, Fri, Sat and Sun: 5 shifts × 12 hours = 60 hours with nobody on them. The only way to fill them is overtime. Either B works nine days in a row (all of week one, plus B's own Mon and Tue in week two), or C and D swing from nights onto days, which quickly breaks the 11-hour daily rest rule.
Now scale that to a full year. Using the assumptions in the math section below, each analyst spends about 340 hours a year off the rota: 160 hours of paid time off + 40 of sick leave + 40 of training + 100 of meetings and admin. Across four analysts, that's 4 × 340 = 1,360 hours of coverage with nobody on it. At about 1,700 available hours per analyst, 1,360 ÷ 1,700 = 0.8 of an extra person. Add a buffer for turnover, onboarding and unplanned absences, and you land at 5 to 6 analysts per seat.
The calculation has two parts, how many hours you need to cover, and how many hours one analyst can actually cover.
Hours to cover. One seat staffed 24/7 needs 24 × 365 = 8,760 hours per year.
Hours one analyst can cover. A full-time contract is about 2,080 hours a year (40 hours × 52 weeks). But not all of those hours can go on the rota:
| Deduction | Typical assumption | Hours per year |
|---|---|---|
| Paid time off | About 20 working days | 160 |
| Sick leave | About 5 days | 40 |
| Training and certifications | About 5 days | 40 |
| Meetings, admin, 1:1s, mentoring | About 2 hours a week | 100 |
| Available for the rota | about 1,740 |
Round down to about 1,700 to leave room for the unexpected. Then:
Analysts per seat = hours to cover ÷ available hours per analyst
8,760 ÷ 1,700 ≈ 5.2 analysts per seatSwap in your own numbers. More or less PTO, leave, training, or a heavy meeting culture.
Using 1,700 available hours per analyst, and rounding up separately for each tier (an L1 can't cover an L2 gap):
| Coverage model | Hours to cover per year | Analysts needed |
|---|---|---|
| 1 analyst on shift 24/7 | 1 × 8,760 = 8,760 | 8,760 ÷ 1,700 = 5.2 → 6 |
| 2 analysts on shift 24/7 | 2 × 8,760 = 17,520 | 17,520 ÷ 1,700 = 10.3 → 11 |
| 2 analysts 24/7, plus 2 extra on weekday days (08:00–18:00) | 17,520 + (2 × 10 h × 5 days × 52 weeks) = 22,720 | 22,720 ÷ 1,700 = 13.4 → 14 |
| 2 L1 + 1 L2 on shift 24/7 | L1: 17,520 + L2: 8,760 = 26,280 | L1: 10.3 → 11, L2: 5.2 → 6, 17 total |
| 3 L1 + 1 L2 on shift 24/7, plus 1 threat hunter on weekdays (8 h) | L1: 26,280 + L2: 8,760 + hunter: 8 h × 5 × 52 = 2,080, total 37,120 | L1: 15.5 → 16, L2: 5.2 → 6, hunter: 1.2 → 2, 24 total |
Two things stand out. First, a single analyst on shift at night is a risk of its own. They have nobody to cover their breaks, no second pair of eyes during an incident, and nobody to escalate to on the spot. It can work if that analyst is experienced and/or backed by a proper on-call escalation for real incidents or sudden spikes in workload.
Second, every tier you add needs its own 24/7 pool. Adding one L2 seat around the clock costs about six hires, not one.
Most SOCs don't staff evenly. Days carry more alerts, client calls and project work, so it's common to run 3 or more on days and only 1 or 2 overnight. The math still works, count the hours for each shift separately, then add them up.
| Shift | Analysts on shift | Hours to cover per year |
|---|---|---|
| Day (07:00–19:00) | 3 | 3 × 12 h × 365 days = 13,140 |
| Night (19:00–07:00) | 1 | 1 × 12 h × 365 days = 4,380 |
| Total | 13,140 + 4,380 = 17,520 |
17,520 ÷ 1,700 ≈ 10.3, so you still need about 11 analysts. That's the same headcount as two analysts on shift around the clock, just distributed differently. Keep at least two people on nights if you can, for the reasons above.
Not much. Hours are hours: 8,760 hours of coverage divided by 1,700 available hours gives the same answer whether you cut the day into three 8-hour shifts or two 12-hour shifts.
What shift length does change is how the team feels and works
| 8-hour shifts | 12-hour shifts | |
|---|---|---|
| Handoffs per day | 3 | 2 |
| Days on shift per year | More | Fewer, with longer blocks off |
| Fatigue late in the shift | Lower | Higher, especially on nights |
| Breaks | Simpler to plan | Must be built in and covered |
| Rest-rule risk | Backward rotations can break the 11-hour rest | Swaps can stack too many long shifts in a row |
The real effect on headcount comes from how neatly a pattern fits your team size. Some rotations only work with multiples of 4 or 5 people, so an awkward headcount can force you to hire one more analyst just to make the pattern close.
The formula gives you the floor. In practice, these factors add headcount on top:
Tiers and escalation paths - Every tier that must be reachable 24/7 needs its own pool. One L2 seat around the clock is 8,760 hours ÷ 1,700 available hours per analyst = 5.2, so about 6 more analysts. A paid on-call rota can cost fewer people, but only if rest after call-outs is built in.
Client SLAs - Tight response times or dedicated-analyst contracts add seats on top of your base coverage. One extra analyst on weekday days (08:00–18:00) to handle peak SLA load is 10 hours × 5 days × 52 weeks = 2,600 hours ÷ 1,700 = 1.5, so 2 more analysts. A client that needs a dedicated analyst 24/7 is a full seat: another 6.
Skills coverage. If a client needs someone who knows their SIEM, EDR or OT environment on every shift, that skill needs a 24/7 seat of its own. That means about 6 analysts with that skill in the rotation, whether you hire them or cross-train existing analysts. Two OT specialists in a team of 11 won't cover it.
Attrition and ramp-up. SOC analyst turnover is high, and a new hire can take months to work a shift alone. If a replacement needs 3 months before joining the rota, that's about 1,700 ÷ 12 × 3 ≈ 425 hours of coverage the rest of the team absorbs per departure. A buffer of one extra analyst per 10 to 15 (so 12 instead of 11 for two seats) keeps a single resignation from breaking the rota.
Labour rules. Overtime can't close the gap. An analyst on a 2-2-3 rotation already averages 42 hours a week, and the EU Working Time Directive caps the average at 48. That leaves at most 6 extra hours a week, or 6 × 52 = 312 hours a year per analyst, before rest rules cut it further. Four analysts on one seat can absorb at most 4 × 312 = 1,248 hours, less than the 1,360 hours of leave and training they need covered.
The rule of thumb is 5 to 6 analysts per 24/7 seat, calculated separately for every tier. Start from 8,760 hours, divide by the hours your analysts can really cover, and round up.
The harder part is keeping that number true as the SOC changes, new clients, new tiers, people leaving, holidays colliding. That's where spreadsheets fall behind.
SOC Rotate builds your rota from your real coverage requirements and flags gaps before they turn into missed SLAs or burned-out analysts.
Coming soon: workload forecasting and capacity planning built for SOCs, so you can see when workload is outgrowing your team and know when it's time to hire.
Book a demo to see your own staffing numbers in minutes.
Bring the rotation you run today. We'll build it in SOC Rotate and walk through where coverage and fairness land.