CyberDesserts Intelligence
Connect

SOC Analyst Career Roadmap

SOC analysts are the front line of cybersecurity defense, monitoring networks and systems around the clock to detect and respond to threats before they cause damage. This role blends technical analysis with rapid decision-making under pressure.

Security Engineer Security Analyst Vulnerability Analyst Vulnerability Manager

What Makes a Great SOC Analyst

The best SOC analysts combine deep curiosity with disciplined process. They don't just close tickets - they investigate root causes, spot patterns across alerts, and continuously refine detection logic to reduce noise and catch what others miss.

Related Articles

Will AI Replace SOC Analysts? SOC Analyst Interview Guide Which SIEM Should You Choose? ELK Stack Security Monitoring Tutorial

Entry Level

$55,000–$75,000

You're learning to triage alerts, distinguish true positives from false positives, and navigate SIEM platforms. Every alert is a learning opportunity as you build pattern recognition that experienced analysts rely on instinctively.

Skills

Alert triage Log analysis SIEM navigation Ticket documentation Basic network analysis Windows Event Log analysis Phishing email analysis

ATT&CK Focus Areas

Initial Access

Most SOC alerts start here - learn to spot phishing lures, credential abuse, and exploitation of public-facing services

Phishing (T1566), Valid Accounts (T1078)

Execution

Script-based payloads trigger the majority of endpoint alerts you'll triage daily

Command and Scripting Interpreter (T1059)

Certifications

CompTIA CySA+

Threat detection and analysis

250h study · 3yr validity · 50 CPE · Paid annual CE fee

Splunk Core Certified User

SIEM fundamentals

100h study · 3yr validity · Paid recertification exam

SSCP (ISC2)

Hands-on operational security across seven domains

150h study · 3yr validity · 60 CPE · Annual maintenance fee (AMF)

Tools

Wireshark Nmap Splunk Free Security Onion CrowdStrike/Defender EDR

Learning Platforms

  • TryHackMe (SOC Level 1 path)
  • Splunk free training
  • Blue Team Labs Online
  • CookieJar Lab — Web Security (cyberdesserts.github.io/cookiejar-lab)

Key Questions to Explore

  • How do I triage security alerts effectively?
  • What are the essential SIEM use cases to start with?

Mid Level

$80,000–$115,000

You're leading investigations, writing detection rules, and mentoring junior analysts. Your shift from reactive alert handling to proactive threat hunting marks the transition from operator to analyst.

Skills

Sigma rule writing Threat hunting SIEM correlation rules Incident escalation procedures KQL/SPL queries MITRE ATT&CK mapping Malware triage basics

ATT&CK Focus Areas

Credential Access

Detecting credential theft separates reactive triage from proactive threat hunting

OS Credential Dumping (T1003), Kerberoasting (T1558.003)

Lateral Movement

Spotting east-west movement is where SOC analysts catch attackers mid-operation

Remote Desktop Protocol (T1021.001), SMB/Windows Admin Shares (T1021.002)

Certifications

GCIA

Network traffic analysis and intrusion detection

350h study · 4yr validity · 36 CPE · Paid renewal every 4 yrs

Splunk Core Certified Power User

Advanced SIEM queries and dashboards

150h study · 3yr validity · Paid recertification exam

SC-200 (Microsoft Security Operations Analyst)

Threat detection and response with Microsoft Sentinel and Defender

60h study · 1yr validity · Free (annual renewal assessment)

Tools

Sigma YARA Elastic SIEM TheHive MITRE ATT&CK Navigator osquery

Learning Platforms

  • SANS SEC555
  • HackTheBox Sherlocks
  • CyberDefenders

Key Questions to Explore

  • How do I write effective detection rules?
  • What's a threat hunting methodology?

Senior Level

$120,000–$160,000

You're designing detection strategies, defining SOC metrics, and building automation that multiplies your team's effectiveness. You bridge the gap between executive risk concerns and technical operations.

Skills

Detection engineering program design SOC metrics and KPIs Purple team exercises SOAR playbook development Automation and scripting (Python) Stakeholder reporting

ATT&CK Focus Areas

Defense Evasion

Advanced attackers hide their tracks - detecting timestomping, log clearing, and process hollowing requires deep system knowledge

Indicator Removal (T1070), Process Injection (T1055)

Persistence

Designing detection for persistent implants ensures threats are caught even after initial containment

Scheduled Task/Job (T1053), Boot or Logon Autostart (T1547)

Certifications

GSOM

Security operations management

300h study · 4yr validity · 36 CPE · Paid renewal every 4 yrs

CISSP

Security leadership and governance

400h study · 3yr validity · 120 CPE · Annual maintenance fee (AMF)

Tools

Velociraptor SOAR platforms Custom Python Cortex XSOAR

Learning Platforms

  • SANS MGT551
  • SOAR vendor training
  • Detection engineering workshops

Key Questions to Explore

  • How do I measure SOC analyst performance?
  • How do I design a detection engineering program?

Resources

Books

  • Blue Team Handbook by Don Murdoch
  • The Practice of Network Security Monitoring by Richard Bejtlich
  • Crafting the InfoSec Playbook by Jeff Bollinger, Brandon Enright & Matthew Valites

Communities

  • r/blueteamsec
  • SANS Discord
  • CyberDefenders Discord

Podcasts

  • Darknet Diaries
  • CyberWire Daily
  • Detection at Scale

Related Career Paths

Threat Intelligence Analyst Incident Responder Detection Engineer Network Security Engineer Threat Hunter