A written version of the interactive roadmap above — every station, what you'll learn, and a small thing to build — laid out for reading, reference and search.
Security Foundations Start here
F1. What a SOC Does
Beginner · 35 min
A security operations center is the team that watches an organization’s systems for attacks and responds when they happen — the defensive, blue-team core of security. Learn how a SOC is structured (tier 1 triage, tier 2 investigation, tier 3 hunting and response), what the daily job actually looks like, and the mission: detect fast, respond faster, and reduce the time an attacker has inside. This is where most people enter security.
Skills: Blue team vs red team · SOC tiers (1/2/3) · The detect-and-respond mission · The daily reality of the job
Build it: An alert fires at 2am for a possible compromise. Walk through who touches it first in a SOC and what "good" triage looks like.
F2. Networking & Systems for Defenders
Beginner · 55 min
You can’t defend what you don’t understand. Learn the networking and systems fundamentals a defender needs: TCP/IP, DNS, HTTP, ports and protocols, plus how operating systems, processes, and authentication actually work. This is the mental model you match every alert against — knowing what normal looks like is what lets you spot the abnormal.
Skills: TCP/IP, DNS, HTTP · Ports and protocols · OS processes and auth · Knowing normal to spot abnormal
Build it: An alert shows a server making DNS requests to a random domain every 60 seconds. Explain why that pattern is suspicious.
F3. The Attacker Playbook
Beginner · 50 min
To catch attackers you have to think like one — defensively. Learn the attack lifecycle (the kill chain) and the MITRE ATT&CK framework: the common tactics and techniques adversaries use, from initial access and persistence to lateral movement and exfiltration. Understanding how intrusions actually unfold is what turns a list of alerts into a story you can follow and interrupt.
Skills: The cyber kill chain · MITRE ATT&CK tactics/techniques · Initial access → exfiltration · Alerts as a story
Build it: You see a phishing click, then a new admin account, then large outbound transfers. Map these to the attack lifecycle.
F4. Logs & Telemetry
Beginner · 50 min
Detection runs on data — the logs and telemetry from endpoints, networks, servers, and cloud. Learn the key sources (authentication logs, process creation, network flows, DNS, cloud audit trails), what each reveals, and how to read them. A SOC analyst who knows which log answers which question investigates fast; one who doesn’t drowns.
Skills: Key log sources · Endpoint, network, cloud telemetry · What each log reveals · Reading logs fast
Build it: You suspect an account was misused. List the specific logs you’d pull and what each would confirm or rule out.
F5. SIEM Basics
Intermediate · 55 min
The SIEM (security information and event management platform) is the SOC analyst’s main workspace — it aggregates logs, correlates events, and raises alerts. Learn how a SIEM ingests and normalizes data, how correlation rules turn raw events into alerts, and how to write queries to investigate. Fluency in your SIEM (Splunk, Sentinel, Elastic, and their kind) is the core day-one skill.
Skills: Log ingestion and normalization · Correlation rules → alerts · Investigation queries · SIEM fluency (Splunk/Sentinel/Elastic)
Build it: Write, in plain terms, a correlation rule that would alert on many failed logins followed by one success from a new location.
F6. Detection Engineering
Intermediate · 50 min
Modern SOCs don’t just consume alerts — they engineer their own detections. Learn to write detection rules that catch real attacker behavior (mapped to ATT&CK), to balance true positives against false positives, and to test and version detections like code. Detection engineering is one of the highest-value SOC skills and a major step up from pure alert-watching.
Skills: Writing detection rules · Mapping to ATT&CK · True vs false positive balance · Detections as code
Build it: A detection catches the attack but also fires 200 times a day on benign activity. Explain how you’d tune it without missing the real thing.
Detection & Response Do the work
T1. Alert Triage
Intermediate · 50 min
Triage is the SOC’s front line: deciding fast whether an alert is a false positive, a benign true positive, or a real incident that needs escalation. Learn a repeatable triage process — gather context, check the indicators, judge severity and scope — and how to make good calls quickly under a flood of alerts. Sharp triage judgment is what a tier-1 analyst lives on, and it’s exactly the judgment AI assists but can’t fully own.
Skills: False positive vs real incident · A repeatable triage process · Judging severity and scope · Fast, good calls under load
Build it: You get 300 alerts in a shift and can deeply investigate 20. Describe how you’d prioritize which ones actually matter.
T2. Investigation & Threat Hunting
Advanced · 55 min
Beyond reacting to alerts, strong analysts investigate deeply and hunt proactively for threats that slipped past detections. Learn to pivot through data to reconstruct what happened, to form and test hypotheses about attacker activity, and to hunt for the subtle signs of compromise no alert fired on. Investigation and hunting are where SOC work becomes genuinely skilled and hard to automate.
Skills: Pivoting through data · Reconstructing the incident · Hypothesis-driven hunting · Finding what no alert caught
Build it: No alert fired, but you suspect a quiet intrusion. Describe a threat hunt: what hypothesis, what data, what would confirm it.
T3. Incident Response
Advanced · 55 min
When triage confirms a real incident, response begins: contain, eradicate, recover, and learn. Learn the IR lifecycle, how to contain an active threat without tipping off the attacker or destroying evidence, coordination under pressure, and the post-incident review that turns a bad day into better defenses. Calm, structured response under stress is a defining SOC skill.
Skills: The IR lifecycle · Containment without tipping off · Preserving evidence · Post-incident review
Build it: You confirm an attacker has active access right now. Explain the first containment decisions and the trade-offs in each.
T4. Endpoint & EDR
Intermediate · 45 min
Endpoints — laptops and servers — are where much of the action is, and EDR (endpoint detection and response) tools are how a SOC sees and acts on them. Learn what EDR gives you (process trees, file and registry activity, the ability to isolate a host), how to investigate on the endpoint, and how to respond — isolating a compromised machine while preserving what you need to understand the attack.
Skills: EDR capabilities · Process trees and host activity · Isolating a compromised host · Endpoint investigation
Build it: EDR shows a Word document spawning PowerShell spawning a network connection. Explain why that chain is a red flag.
T5. Threat Intelligence
Advanced · 45 min
Threat intelligence puts alerts in context — who the adversaries are, what they target, and the indicators and techniques associated with them. Learn to consume and apply intel (indicators of compromise, adversary TTPs), to enrich an investigation with it, and to judge intel critically rather than chasing every indicator. Good use of threat intel turns isolated events into an understanding of who is actually after you.
Skills: Indicators of compromise · Adversary TTPs · Enriching investigations · Judging intel critically
Build it: Threat intel says a group targeting your industry uses a specific technique. Describe how you’d turn that into a proactive check.
T6. Tuning & Reducing Noise
Advanced · 40 min
The quiet killer of SOCs is alert fatigue — thousands of low-value alerts burying the real ones and burning out analysts. Learn to tune detections to cut false positives without creating blind spots, to prioritize by real risk, and to continuously improve signal-to-noise. Reducing noise is both a technical skill and the thing that keeps a SOC (and its people) actually effective.
Skills: Cutting false positives safely · Avoiding blind spots · Risk-based prioritization · Improving signal-to-noise
Build it: Analysts ignore a whole alert category because it’s 99% noise — including the 1% that’s real. Explain how you’d fix that safely.
Modern & AI-Era SOC Own the future
P1. SOAR & Automation
Advanced · 50 min
Modern SOCs automate the repetitive parts of response with SOAR (security orchestration, automation, and response) — playbooks that enrich alerts, gather context, and take routine actions automatically. Learn to build automation playbooks, to decide what should be automated versus kept human, and to use automation to free analysts for the judgment work. Automation is how a SOC scales without burning out its people.
Skills: SOAR playbooks · Automating enrichment and routine actions · Automate vs keep human · Scaling the SOC
Build it: Analysts spend hours a day copy-pasting context into every alert. Describe the playbook you’d automate first and why.
P2. The AI-Assisted SOC
Advanced · 50 min
AI is reshaping the SOC: summarizing alerts, drafting investigation steps, correlating events, and triaging tier-1 volume. Learn to use AI as a force multiplier — it can accelerate triage and investigation — while owning what it can’t: the judgment on ambiguous cases, the decision to declare an incident, and catching where the AI is confidently wrong. The analyst who supervises and improves the AI stays essential; the one who only did rote triage is exposed.
Skills: AI for alert summarization and triage · AI-assisted investigation · Judging AI conclusions · Supervising, not trusting blindly
Build it: An AI triage tool auto-closes an alert as benign, but something feels off. Explain how you’d verify and why that catch is your value.
P3. Detecting AI-Era Threats
Advanced · 50 min
The threats themselves are changing: AI-generated phishing that’s flawless, deepfake-driven social engineering, faster and more adaptive attacks, and entirely new targets like the company’s own AI systems (prompt injection, model abuse). Learn what these AI-era threats look like and how detection must adapt — including monitoring the organization’s AI applications as a new part of the attack surface. Defending in the AI era means defending against and around AI.
Skills: AI-generated phishing and deepfakes · Faster, adaptive attacks · Monitoring the org’s AI systems · Detection that adapts
Build it: Your company deploys a customer-facing AI agent. Describe what new attacks a SOC now has to watch for and how.
P4. Purple Teaming
Advanced · 40 min
Purple teaming is where defense (blue) and offense (red) collaborate: attackers simulate real techniques so defenders can validate and improve detections against them. Learn to run and learn from purple-team exercises, to turn "the red team got in undetected here" into concrete new detections, and to continuously test your coverage against real adversary behavior. This closes the loop between how attacks work and how you catch them.
Skills: Blue + red collaboration · Validating detections · Turning gaps into detections · Testing coverage vs real TTPs
Build it: A purple-team exercise shows the red team moved laterally with zero alerts. Describe how you’d turn that gap into detection.
P5. Metrics & Sustainable Ops
Advanced · 35 min
A SOC is judged on outcomes and only lasts if its people do. Learn the metrics that actually matter (time to detect, time to respond, and honest coverage — not vanity alert counts), how to measure and improve them, and how to fight the burnout that plagues the field through automation, tuning, and sane processes. A sustainable SOC that measures the right things beats a heroic one that grinds its analysts down.
Skills: MTTD / MTTR and coverage · Metrics that matter vs vanity · Fighting alert fatigue · Sustainable operations
Build it: Leadership tracks "alerts closed per analyst." Explain why that metric can make the SOC worse and what you’d measure instead.
P6. The SOC Career
Advanced · 40 min
The SOC is a launchpad into much of security. Learn where the path goes — from tier-1 analyst up through detection engineer, incident responder, threat hunter, and SOC lead, and outward into red teaming, threat intel, security engineering, or the AI-security specialties. Understand how AI is reshaping entry-level SOC work (rote triage automates; judgment and engineering grow in value), and how to build the skills and portfolio that move you up and out.
Skills: Analyst → detection eng / IR / hunter / lead · Pivots: red team, intel, security eng · AI’s effect on entry-level SOC · Skills and portfolio to grow
Build it: Write the six-month plan that moves you from tier-1 alert triage to detection engineering or incident response.