SOC Analyst
Certified Industrial SOC Engineer
Become a job-ready SOC Analyst by mastering SIEM platforms, incident response, threat hunting, compliance, and real-world security operations.
The job, honestly described
A SOC analyst sits between a firehose of telemetry and a small number of humans who can act.
The value you add is triage: deciding quickly what matters, and telling the right person
with enough evidence to be believed.
That is a technical skill with a strong communication component. This track is built the way
the job actually runs — sources, then detection content, then the alert lifecycle, then
hunting, then the parts nobody teaches you (escalation, evidence handling, metrics).
What you will be able to do
- Explain what each major telemetry source gives you and what it cannot tell you
- Write and tune detections that fire on adversary behaviour rather than on noise
- Run an incident from first triage to containment, with a written timeline
- Hunt on a hypothesis across DNS, proxy, endpoint and identity data
- Handle evidence, chain of custody and disclosure obligations
- Report on SOC metrics that leadership can act on
Assumed knowledge
Networking fundamentals, Windows and Linux command lines, and basic log reading. No SIEM
product is assumed; the concepts transfer to Splunk, Elastic, Sentinel, QRadar or a text file.
Syllabus
-
1
The SOC mission and the alert lifecycle
What the function is for, what a tier means, and how an alert becomes an incident.
Locked -
2
SIEM fundamentals: sources, normalisation, correlation
Getting data in, putting it in a common shape, and joining events that belong together.
Locked -
3
Network telemetry: DNS, proxy and NetFlow
Reading the network like an incident record, and the signatures that matter.
Locked -
4
Windows and Active Directory detection
The event IDs, logons and directory changes that carry the most incident value.
Locked -
5
Linux, cloud and identity telemetry
Non-Windows estates and SaaS control planes produce the signals you cannot get anywhere else.
Locked -
6
Threat hunting and the analytical loop
Hypothesis, test, refine — and writing the hunt up so it repeats.
Locked
Final exam
Locked. Enrol in the course to unlock the final exam.