A service account with admin rights is taking a flood of failed logins, all from one outside IP. You pull the logs, check the IP against threat intel, confirm it’s a brute-force attempt, block it, escalate and write it up. That’s a normal morning in a Security Operations Center (SOC).
The SOC is where attacks get caught before they become breaches. This roadmap is the order we’d learn it in, and it starts with a free hands-on investigation: Cover6: First Watch is free.
What SOC analysts actually do
- Monitor: watch SIEM alerts and sort real threats from noise, across firewall, endpoint, identity, cloud and network logs.
- Investigate: build the timeline, find the affected systems and accounts, and map the activity to MITRE ATT&CK.
- Respond: escalate or contain. Block an IP, isolate an endpoint, reset credentials, call in incident response.
- Document: incident reports, runbooks and after-action reviews. If it isn’t written down, it didn’t happen.
The SOC ladder
- Tier 1 alert analyst. Triage alerts, do the first pass and escalate. That’s not a knock. It’s where you learn to read logs at volume and work under pressure.
- Tier 2 incident responder. Dig deep, contain the incident and coordinate the response.
- Tier 3 threat hunter / forensics. Hunt for threats nobody has alerted on, build detections and analyze the evidence.
The SOC roadmap, phase by phase
Phase 1: Learn the foundation and work your first incident (free)
Learn how networks work (TCP/IP, DNS, DHCP, HTTP/S, ports), how Windows and Linux log activity, and the security basics: the CIA triad, authentication, encryption and firewalls. You need to know what normal looks like before you can spot what isn’t.
Then do the job. Cover6: First Watch is free. You get seven days and your own Splunk login to work a fictional intrusion at Odapeeka State University, from the first scan to the ransom note, with packet captures.
Phase 2: Learn to read the attacker in your logs
Learn the MITRE ATT&CK tactics and what each one looks like in logs. Learn the common patterns: phishing, pass-the-hash, Kerberoasting, lateral movement and living-off-the-land tools. Learn the Windows logon event IDs (4624, 4625, 4648, 4768, 4769, 4776) and enough Splunk search language to find them. Splunk’s free training is a good start.
SOC Analyst Prep Labs ($249) is the hands-on step: investigations in a live Splunk lab, then alert triage, log analysis, threat-intel enrichment, reporting and threat hunting. It includes 90+ lessons, lifetime course access, 12 months of Splunk lab access and practice exams.
Phase 3: Lead the investigation
Tier 2 work means owning an incident from start to finish. Incident Response: Lead the Investigation From Alert to Recovery ($399) has you work a full intrusion in a Splunk lab: triage, scope, contain and eradicate it, then write the report leadership reads. It includes 60+ lessons, 365 days of lab access, lifetime course access and 22.5 CPE hours. NIST’s free SP 800-61 is the standard guide to read alongside it.
Phase 4: Collect and analyze the evidence (coming soon)
Digital Forensics: Collect and Analyze the Evidence ($149) has you work three forensic cases end to end, from chain of custody and acquisition to a timeline and a report that holds up, then a fourth case alone. It isn’t open yet.
Prove it
Cover6 IR Challenge ($299): work a multi-stage intrusion alone in Splunk on a 72-hour clock, answer 60 questions only your incident can answer, write the incident report, then defend it in writing. One attempt and one retake are included. Planning to take both? The Incident Response + IR Challenge bundle ($599) puts them together.
Keep practicing on your own, too. Add Wazuh to a home lab, work the PCAP exercises on Brad Duncan’s Malware-Traffic-Analysis.net, and play the monthly Cover6 CTF. Write up what you find in as few words as possible: what happened, what you did and what should happen next. We walked through how in SOC Analyst Fundamentals: How to Get Hands-On Experience.
Certifications on this path
You don’t need a certification to start. They help you get past résumé filters once you’re applying. Professor Messer’s free CompTIA video courses pair well with the CompTIA preps.
- ISC2 CC: security fundamentals. CC Exam Prep + Study Guide (free)
- CompTIA Security+: the baseline many federal and contractor roles ask for. Security+ (SY0-701) Exam Prep ($39)
- CompTIA CySA+: the SOC-specific certification. CySA+ (CS0-004) Exam Prep ($39)
- ISC2 SSCP: hands-on security operations and administration. SSCP Exam Prep + Study Guide ($39)
- ISC2 CISSP: later, when you have the experience. CISSP Exam Prep + Study Guide ($49)
Each prep includes a 25-question practice quiz, a timed practice exam, a study guide and unlimited retakes.
SOC or pentest? How to choose
SOC work leads to incident response, forensics, threat hunting and detection engineering, and later to running the team. From there the path continues into security leadership and the vCISO path.
If you’d rather be the one finding the weaknesses than catching the attack, look at the Penetration Tester Roadmap. If you’d rather read the requirement and write the finding, look at the GRC Analyst Roadmap. Still not sure? Take the free career path assessment.
Start here
Cover6: First Watch is free. Enroll on that page and work your first incident in your own Splunk lab. When you’re ready for more, SOC Analyst Prep Labs is the next step.