SOC Analyst Roadmap

Become the analyst who detects, triages and responds to threats in a modern Security Operations Center.

This path takes you from IT and networking fundamentals to a confident L1 to L2 SOC analyst who can read alerts, investigate incidents in a SIEM and respond using real playbooks. Every stage is hands-on and mapped to the way our own NUEXUS SOC and NUEXUS Defender platform operate.

Start this path See related trainings

Duration: 6 to 9 months
Level: Beginner to job-ready
Stages: 6
Field: Cybersecurity

By the end

What you will be able to do

Read and triage alerts across a SIEM with confidence

Investigate suspicious activity using logs, network and endpoint data

Map detections to MITRE ATT&CK and write basic detection rules

Run incident response playbooks from triage to containment

The roadmap

Your step-by-step path

Follow the stages in order. Each one builds on the last, from fundamentals to job-ready.

01
IT & Networking Foundations
Build the base every analyst needs: how computers, networks and protocols actually work.
- TCP/IP and the OSI model
- DNS, HTTP and common ports
- Operating systems: Windows & Linux
- Command line basics
02
Security Fundamentals
Learn the core concepts, threats and controls that frame the whole field.
- CIA triad and security controls
- Common attacks and malware types
- Cryptography basics
- Defense in depth
Certification checkpoint CompTIA Security+ (target)
03
Logging, SIEM & Monitoring
Get hands-on with the tools a SOC lives in every day.
- Log sources and normalization
- SIEM search and dashboards
- Alert triage workflow
- Writing simple detection rules
04
Threat Detection & MITRE ATT&CK
Turn raw data into detections that catch real attacker behavior.
- MITRE ATT&CK tactics & techniques
- Detection engineering basics
- Threat intelligence and IOCs
- Use-case development
05
Incident Response & SOAR
Respond the way a real team does: structured, fast and documented.
- IR lifecycle and playbooks
- Triage to containment
- SOAR automation basics
- Case documentation and handover
06
Job-Ready: L1 to L2
Pull it all together in a live-fire environment and step into the role.
- Full alert-to-resolution drills
- Shift handover and reporting
- Hunting basics (L2)
- Building your analyst portfolio
Certification checkpoint NUEXUS SOC Analyst (Verified)