SOC Analyst
You watch the alerts, work out which ones matter, and investigate the ones that do.
No degree needed Medium — harder as a direct entry than help desk, and we are not going to pretend otherwise.
Can I actually do this?
Realistic without a degree, but usually reached via IT support or networking rather than as a first job. Direct entry happens with Security+ and genuine lab evidence.
Who it suits. People who enjoy investigation: noticing the odd detail, chasing it down, and writing up what happened clearly enough that someone else can act on it.
Runway. Realistic with Security+ plus documented home-lab investigation work.
Already working help desk or in networking? Those are the two confirmed feeder roles — you are partway in already. Help Desk / IT Support
Also advertised as
The route
Four stations, in order. Each one is a thing you finish before the next matters.
-
Station one
Learn it free
Only the best few, deliberately. Every one of these is free to use — the pill on each card says exactly what is and isn't free.
Professor Messer Security+ SY0-701 full video course
Free to learn · no certificate
Complete free course covering the current exam objectives.
Verified 2026-07-25
LetsDefend — SOC simulation
Free to learn · no certificate
Alert investigation and log analysis against simulated incidents. Free tier is live; paid tiers exist and are not counted here.
Verified 2026-07-25
TryHackMe free rooms
Free to learn · no certificate
The SOC Level 1 path contains free rooms. A subscription exists — only the free rooms are counted here.
Verified 2026-07-25
-
Station two
Attest strategically
Security+ is the one that opens doors for this role. Buy it when you can also show investigation write-ups — the certificate alone competes with thousands of identical résumés.
CompTIA Security+
CompTIA · SY0-701
Free to learn · paid certificate Recognized
The honest cost Cost $439
Raised to $439 on 2026-06-01. Figures below that are pre-hike and stale.Validity 3 years. Renewal 50 continuing-education units plus about $50/yr (~$150 per cycle), or renew automatically via a higher certificate such as CySA+, PenTest+ or SecurityX. Assessment Proctored exam — 90 questions, 90 minutes, pass mark 750/900 Proctored Yes Verify via Credly Cost per active year $196/yr(439 + 150) ÷ 3 Named repeatedly as the foot-in-the-door credential for defensive security roles, and used as a DoD 8570 baseline.
Read this before you buyThis is a worked example of why we date everything: an apparent three-way price conflict was really one price change with stale copies downstream.
Verified 2026-07-25 · Official page
-
Station three
Prove it
A certificate says you passed a test. These say you can do the job.
Home SOC lab
Run Sysmon with a free-tier Splunk or an Elastic stack, simulate attacks against it, and produce three documented investigation write-ups. Note: the commonly recommended 'Splunk Fundamentals 1/2/3' was retired — use Splunk's current learning paths instead.
LetsDefend investigation reports
Keep your free-tier investigations as portfolio artifacts. Real alert triage you can talk through in an interview.
Blue-team CTF write-ups
Public, dated write-ups of defensive challenges.
-
Station four
Get hired
Search these exact titles
Who hires for this. Managed security service providers, in-house security operations centres, financial services, government contractors.
The write-ups are the differentiator. A certificate is easy to compare against other applicants; an investigation you can walk an interviewer through is not. That is our reasoning, not a measured statistic about applicant pools.
On salaryWe don't publish salary estimates. Numbers copied between blogs drift from reality, and a wrong number costs you real negotiating power. When we have a verified public source, it goes here with its date.
Where this route continues
- AI Security Engineer — the AI-facing continuation
This page last verified 2026-07-25 · How we verify
Ladder researched 2026-07-25 via live sources; resource URLs spot-checked (HTTP 200); Security+ price corrected the same day.