150 lines
5.5 KiB
Markdown
150 lines
5.5 KiB
Markdown
# SOC Analyst Certification Roadmap
|
|
|
|
A structured path to becoming a Security Operations Center Analyst, from zero to landing your first SOC role. Five certifications, in order, each building on the last.
|
|
|
|
## Career Path Overview
|
|
|
|
SOC Analysts monitor, detect, investigate, and respond to cybersecurity threats. This roadmap progresses from foundational knowledge through hands-on defense and SIEM tooling, in the order that actually gets you hired: foundation first, tool skills last.
|
|
|
|
---
|
|
|
|
> **Studying for the certifications below?** [CertGames](https://certgames.com) is the platform I built to run this whole journey in one place: 25,000+ practice questions across 20 certifications (CompTIA, AWS, Cisco, ISC2), Learn lessons that teach each exam objective, guided projects you build from scratch, these career roadmaps with progress tracking, and deep analytics like an exam readiness score. Free, no credit card required. **[Start practicing free](https://certgames.com)**
|
|
|
|
---
|
|
|
|
## Certification Path
|
|
|
|
| Step | Certification | Organization | Approx. Cost | Link |
|
|
|------|--------------|--------------|--------------|------|
|
|
| **01 - Foundation** | **Security+** | CompTIA | ~$404 | [Website](https://www.comptia.org/certifications/security) |
|
|
| **02 - Analyst** | **CySA+** | CompTIA | ~$404 | [Website](https://www.comptia.org/certifications/cybersecurity-analyst) |
|
|
| **03 - Hands-On** | **Blue Team Level 1** | Security Blue Team | ~$399 | [Website](https://securityblue.team/certifications/blue-team-level-1) |
|
|
| **04 - SIEM Tool** | **Splunk Core Certified User** | Splunk | ~$130 | [Website](https://www.splunk.com/en_us/training/certification-track/splunk-core-certified-user.html) |
|
|
| **05 - Cloud SOC** | **Microsoft SC-200** | Microsoft | ~$165 | [Website](https://learn.microsoft.com/en-us/credentials/certifications/security-operations-analyst/) |
|
|
|
|
*Costs are approximate USD exam-voucher prices and change over time. Check each vendor for current pricing. Splunk and Microsoft both offer free official training.*
|
|
|
|
---
|
|
|
|
## Recommended Learning Path
|
|
|
|
### Phase 1: Foundation (3-6 months)
|
|
**Target:** Security+ (~$404, CompTIA)
|
|
|
|
Build fundamental knowledge in:
|
|
- Network security concepts
|
|
- Threat landscape and attack types
|
|
- Cryptography basics
|
|
- Security policies and compliance
|
|
- Risk management
|
|
|
|
**Resources:**
|
|
- CompTIA Security+ training materials
|
|
- Practice labs and simulations
|
|
- Security fundamentals courses
|
|
|
|
### Phase 2: Analyst Skills (4-8 months)
|
|
**Target:** CySA+ (~$404, CompTIA)
|
|
|
|
Develop analyst capabilities:
|
|
- Security operations and monitoring
|
|
- Threat intelligence analysis
|
|
- Vulnerability management
|
|
- Incident response fundamentals
|
|
- Log analysis and SIEM tools
|
|
|
|
**Resources:**
|
|
- CySA+ official study materials
|
|
- SOC analyst training platforms
|
|
- Hands-on lab environments (TryHackMe, HackTheBox)
|
|
|
|
### Phase 3: Hands-On Defense (3-6 months)
|
|
**Target:** Blue Team Level 1 (~$399, Security Blue Team)
|
|
|
|
Prove you can do the work in a live, graded investigation:
|
|
- Practical SIEM and log analysis
|
|
- Phishing analysis
|
|
- Threat intelligence
|
|
- Digital forensics fundamentals
|
|
- End-to-end incident response
|
|
|
|
**Resources:**
|
|
- Security Blue Team labs (included with the certification)
|
|
- Hands-on ranges (TryHackMe, HackTheBox)
|
|
- Real investigation practice
|
|
|
|
### Phase 4: SIEM Tooling (2-4 months)
|
|
**Target:** Splunk Core Certified User (~$130, Splunk)
|
|
|
|
Get fluent in the SIEM most SOCs run all day:
|
|
- Splunk Search Processing Language (SPL)
|
|
- Building and reading dashboards
|
|
- Field extraction and reporting
|
|
- Alerts and scheduled searches
|
|
|
|
**Resources:**
|
|
- Splunk free official training (Intro to Splunk, Search Fundamentals)
|
|
- Splunk Search Tutorial and sample data
|
|
- Hands-on practice in a free Splunk instance
|
|
|
|
### Phase 5: Cloud SOC (2-4 months)
|
|
**Target:** Microsoft SC-200 (~$165, Microsoft)
|
|
|
|
Cover the cloud SIEM side SOCs increasingly hire for:
|
|
- Microsoft Sentinel
|
|
- Microsoft Defender XDR
|
|
- Kusto Query Language (KQL)
|
|
- Cloud detection and incident response
|
|
|
|
**Resources:**
|
|
- Microsoft Learn (free SC-200 study path)
|
|
- Hands-on Azure and Sentinel labs
|
|
- KQL practice environments
|
|
|
|
---
|
|
|
|
## Skills to Develop
|
|
|
|
**Technical Skills:**
|
|
- SIEM platforms (Splunk, ELK, QRadar)
|
|
- Network traffic analysis (Wireshark, tcpdump)
|
|
- Endpoint detection and response (EDR)
|
|
- Log aggregation and correlation
|
|
- Scripting (Python, PowerShell)
|
|
- Threat intelligence platforms
|
|
|
|
**Soft Skills:**
|
|
- Critical thinking and problem-solving
|
|
- Communication (technical and non-technical)
|
|
- Documentation and reporting
|
|
- Time management under pressure
|
|
- Teamwork and collaboration
|
|
|
|
---
|
|
|
|
## Estimated Timeline
|
|
|
|
- **Foundation to Analyst (Security+ to CySA+):** 6-12 months
|
|
- **Analyst to Hands-On (CySA+ to BTL1):** 3-6 months
|
|
- **Tooling (Splunk + SC-200):** 4-8 months
|
|
|
|
Total time to job-ready: **~12-24 months** with consistent study and hands-on practice.
|
|
|
|
---
|
|
|
|
## Related Projects
|
|
|
|
Practice SOC skills with these projects:
|
|
- [SIEM Dashboard](../SYNOPSES/intermediate/SIEM.Dashboard.md)
|
|
- [Threat Intelligence Aggregator](../SYNOPSES/intermediate/Threat.Intelligence.Aggregator.md)
|
|
- [Network Traffic Analyzer](../SYNOPSES/beginner/Network.Traffic.Analyzer.md)
|
|
- [SSH Brute Force Detector](../SYNOPSES/beginner/SSH.Brute.Force.Detector.md)
|
|
|
|
---
|
|
|
|
> **The certification grind is rough.** Make it less painful with [CertGames](https://certgames.com): gamified practice where you earn XP, level up, build streaks, and compete on leaderboards, plus Learn lessons, guided projects, and roadmaps to keep you moving. 25,000+ questions across 20 certifications. Free, no credit card. **[certgames.com](https://certgames.com)**
|
|
|
|
---
|
|
|
|
[Back to All Roadmaps](./README.md)
|