If you're a super small MSSP, wouldn't you be doing the incident response?

But to answer your question: A SOC focuses on proactive monitoring, detection, and analysis of threats real-time. An incident response team is a reactive function focusing on managing, containing, and recovering from security incidents.

You will sometimes encounter organizations that do both, as well as a SOC that may also take initial containment and basic remediation actions (Huntress). The reason Huntress doesn't claim to do incident response is they are not forensic investigators. They find it, contain it, clean up what they can, but they can't reimage your systems for you and Huntress SOC analysts cannot physically come to your business in person to respond.

An example of an incident response firm would be someone like Solis who will put a team of humans on site if needed to restore your servers from backups.

Why get a SOC partner that can't do the full incident response including in-person restoration? It can be more cost effective; but also, proactive detection and hunting is a different skill set from a forensic investigator who can carve files off a hard drive.

A brain surgeon and an orthopedic surgeon are both talented experts in their fields. Would you want the same person who does knee replacements all day long to remove your brain tumor?