Skip to content

SOC Analyst Certification Roadmap

A SOC (security operations center) analyst watches alerts, decides which are real, and starts the response. It is the most common first job in security, and the one where practice counts for more than any single certificate.

This roadmap uses only the study guides on this site. It sits beside the Security Engineer roadmap and shares its early steps.

What the job is

  • Tier 1: triage alerts and user reports, close false positives, escalate real ones. See Phishing report triage.
  • Tier 2: investigate escalations, scope the incident, contain. See the playbooks.
  • Tier 3 and detection engineering: hunt for threats, write and tune detections, improve the pipeline.

Titles: SOC analyst, security analyst, incident responder, threat hunter, detection engineer.

flowchart LR
  A[Foundations:<br/>networking, Linux, Windows] --> B[ISC2 CC or<br/>Security+]
  B --> C[SC-900<br/>optional]
  B --> D[CySA+]
  D --> E[SC-200]
  E --> F[Detection engineering,<br/>threat hunting, or CISSP]

The suggested order. Security+ then CySA+ is the vendor-neutral spine; SC-200 adds the Microsoft tools most SOCs run.

Stage 1 - foundations (0 to 3 months)

Skills: how a packet travels, DNS, HTTP, the Linux command line, Windows event logs, and what a normal day on a network looks like. You cannot spot odd until you know normal.

Read: Network security basics, Logging and detection, Security from Scratch.

Stage 2 - first certificate

Pick one:

Stage 3 - analyst skills

  • CompTIA CySA+ - the analyst-focused exam: log analysis, threat intelligence, vulnerability management, incident response. The guide notes the version change; read it before you book.
  • Microsoft SC-900 - optional vocabulary for Microsoft's security stack.
  • Microsoft SC-200 Security Operations Analyst - hands-on with Sentinel, Defender and KQL, the toolset many employers run.

Stage 4 - specialise

  • Cloud detection: the cloud security exams in the Security Engineer roadmap.
  • Management and breadth: CISSP once you meet the experience requirement.
  • Offensive knowledge for threat hunters: OSCP is optional and hard. It teaches how attackers think, which helps with detection.

Skills that matter more than certificates

Skill How to practise
Reading logs Centralized logging and alerting
Triage method Work the playbooks on paper with sample alerts
ATT&CK vocabulary 📖 MITRE ATT&CK Enterprise matrix - the shared language for attacker behaviour
Endpoint view Endpoint security: EDR and XDR
Writing Write a one-page incident summary after every lab
Query language KQL or SPL: write five searches a week against a free dataset

Pipeline reference: SOC detection and response pipeline.

Getting the first job

  • Build a small home lab that collects logs and fires five tested alerts, then write it up.
  • Keep a short portfolio of incident write-ups with the sensitive details removed.
  • Practise the interview: SOC analyst interview prep.
  • Be ready for shift work, a noisy queue and a lot of writing. Those are the job.

Next steps