The SOC analyst path
You watch the alerts, work out which ones matter, and investigate the ones that do. It is shift-based work, usually reached via IT support or networking rather than straight off the street. It suits people who enjoy investigation — noticing the odd detail, chasing it down, and writing up what happened clearly enough that someone else can act on it.
Published 2026-10-09 · generated from the lesson data · serves SOC analyst
Work the groups in order. Each checkpoint is a gate: do not move on until you can do it unaided. The capstone is level 4 — original work, made public, verifiable by a stranger.
Foundations
1. Linux command line for security work
Stage A · Foundations
2. TCP/IP and ports
Stage A · Foundations
3. DNS in depth
Stage A · Foundations
4. HTTP in depth
Stage A · Foundations
5. Windows concepts for security
Stage A · Foundations
Lighter on cryptography internals than the pentester path — you need the vocabulary, not the math.
Detection basics
Deeper
10. DFIR deep: disk, memory, network forensics
Stage D · Specialist
11. Red team operations: concepts
Stage D · Specialist
ATT&CK is the vocabulary every alert and report on this path is written in.
Checkpoints
- Triage a labeled set of simulated alerts and write a disposition for each: true positive, false positive, or benign — with a one-line reason a stranger could check.
- Run a home SOC lab on your own machines and produce three investigation write-ups a stranger can follow end to end.
- Write a Sigma rule, trigger it deliberately, and document what it misses — the blind spots are part of the deliverable.
The capstone
Level 4 — Extend: Published detection-engineering project. A Sigma rule package for one ATT&CK technique, with test evidence, plus a written investigation of a simulated intrusion mapped to ATT&CK — in a public repository, reproducible by a stranger. That is the artifact a hiring stranger checks.