Career Roadmap
SOC Analyst Roadmap 2026 : Zero to Hero Guide
This roadmap guides you from security foundations to professional SOC Analyst roles. You will master SIEM operations, threat detection, incident response, and threat hunting. SC-200 validates Microsoft Sentinel and Defender expertise. GCIH validates senior incident handling capability. The roadmap covers the Tier 1 to Tier 3 progression that defines SOC careers. Use ExamOS practice quizzes to track progress at every stage.
Who is this roadmap for?
This roadmap is designed for Security Analysts transitioning into SOC roles who already have Security+ and CySA+, as well as IT Support Professionals moving into security monitoring. Additionally, it is tailored for Network Administrators adding security operations skills, as well as Recent Graduates building their first SOC credentials.
Skills You'll Develop
Operate Microsoft Sentinel or Splunk, write detection queries, and build dashboards.
Identify attack patterns, triage alerts, and tune detection rules.
Lead incidents from detection through containment and recovery.
Proactively search for threats using MITRE ATT&CK and hypothesis-driven hunting.
Analyze Windows Event Logs, Linux logs, network logs, and cloud audit logs.
Investigate disk, memory, and network artifacts for incident investigation.
Target Roles in this Roadmap
- SOC Analyst (Tier 1): Triages alerts, monitors security tools, and escalates incidents
- SOC Analyst (Tier 2): Investigates incidents, hunts for threats, and tunes detection rules
- SOC Analyst (Tier 3): Leads incident response, mentors junior analysts, and handles complex investigations
- Detection Engineer: Builds detection rules and analytics for security monitoring
- Incident Responder: Leads incident response engagements and containment efforts
- Threat Hunter: Proactively searches for undetected threats in enterprise environments
Typical Employer Categories
- Managed Security Service Providers (MSSPs): 24x7 security monitoring and incident response
- Technology & Software Firms: Internal SOC teams and product security operations
- Financial Services: Banking, insurance, fintech, and payment processors with SOCs
- Government & Defense: Federal agencies, DoD, and defense contractors
- Healthcare Organizations: HIPAA compliance and patient data protection SOCs
- Consulting & Professional Services: Incident response consulting and security monitoring engagements
The Certification Path
Recommended Path
| Cert | When | Why |
|---|---|---|
| Microsoft SC-200 (Security Operations Analyst) | Month 2-4 | The most directly relevant SOC certification. Validates Microsoft Sentinel, Defender XDR, and Defender for Cloud. |
| GIAC GCIH (Certified Incident Handler) | Month 10-14 | The most respected incident response credential. Signals genuine Tier 3 / lead analyst capability. |
Optional Foundation
| Cert | When | Why |
|---|---|---|
| Splunk Core Certified User / Power User | Month 3-5 | If your SOC runs Splunk instead of Sentinel. Vendor-specific but widely deployed. |
Specialization Path
| Cert | When | Why |
|---|---|---|
| GIAC GCFE (Forensics) | Month 12-16 | Digital forensics specialization for analysts who want to go deep on investigation work. |
| GIAC GCFA (Advanced Forensics) | Month 14-18 | Advanced forensics for senior investigators and incident responders. |
Milestones: Junior → Mid → Senior
| Level | Milestone | When |
|---|---|---|
| Entry Level — Job Ready | Security+ and CySA+ passed. Can read logs, recognize attack patterns, and understand the incident response lifecycle. | Before starting this roadmap |
| Practitioner Level — Hire Ready | SC-200 passed. Can triage alerts, write detection rules, and work a full incident. Ready for Tier 1 / Tier 2 SOC Analyst roles. | Month 4-6 |
| Specialist Level — Lead Ready | GCIH passed with real incident response experience. Can lead incidents, mentor junior analysts, and operate independently. Ready for Tier 3 / Senior SOC Analyst / Incident Response Lead roles. | Month 10-14 |
Step 0 - SIEM fundamentals and log analysis at depth
Build genuine fluency with the tool that defines SOC work—the SIEM. This is the platform where alerts arrive, investigations happen, and detection rules live.
~1-2 months~1-2 months
Step 0 - SIEM fundamentals and log analysis at depth
Build genuine fluency with the tool that defines SOC work—the SIEM. This is the platform where alerts arrive, investigations happen, and detection rules live.
- What a SIEM does: log aggregation, normalization, correlation, and alerting at scale
- Log sources that matter most: endpoint (EDR), network (firewall, IDS/IPS), identity (authentication logs), cloud (audit logs)
- Query languages: KQL (Kusto Query Language) for Microsoft Sentinel, SPL (Search Processing Language) for Splunk
- Writing detection rules: correlation logic, thresholds, false positive tuning
- Alert triage methodology: severity assessment, initial scoping, escalation criteria
- Building and reading dashboards: what a useful SOC dashboard shows versus a vanity dashboard
💡 Pick one SIEM to go deep on rather than learning three shallowly. Microsoft Sentinel (via SC-200) and Splunk are the two most commonly required in job postings.
💡 KQL and SPL are conceptually similar (filter, aggregate, join) but syntactically different. Once you know one well, learning the second is faster.
🏁 Entry Level Checkpoint: You can write basic detection queries, triage alerts, and build operational dashboards.
🛠 Project Ideas
- ▸Set up a free Microsoft Sentinel workspace. Ingest sample logs and write KQL queries to surface suspicious activity.
- ▸Install Splunk Free and ingest Windows Event Logs. Write SPL queries to identify failed login attempts.
- ▸Build a SOC dashboard that shows alert volume by severity, source, and time.
Step 1 - Microsoft Sentinel and Defender (SC-200)
Earn the certification most directly aligned with SOC analyst work in Microsoft-centric environments. SC-200 is one of the most commonly requested credentials in SOC analyst job postings and validates hands-on threat detection, investigation, and response skills.
~2-3 months~2-3 months
Step 1 - Microsoft Sentinel and Defender (SC-200)
Earn the certification most directly aligned with SOC analyst work in Microsoft-centric environments. SC-200 is one of the most commonly requested credentials in SOC analyst job postings and validates hands-on threat detection, investigation, and response skills.
- Manage a security operations environment (40-45%): Configure automation in Defender XDR and Sentinel, design Sentinel workspaces with RBAC and retention tiers (Analytics, Data lake, XDR), configure data ingestion via AMA, WEF, and Syslog/CEF, and build detection engineering rules (scheduled, NRT, threat-intelligence, ML, and anomaly rules)
- Respond to security incidents (35-40%): Investigate and remediate incidents across Defender for Office 365, Purview, Defender for Cloud workloads, Defender for Cloud Apps, Entra ID, Defender for Identity, and Sentinel; use agentic AI investigation with embedded Copilot for Security; manage cases
- Perform threat hunting (20-25%): Write KQL hunting queries across Advanced Hunting tables, use hunting graphs and blast-radius views, explore entity relationships in Sentinel Graph, run KQL jobs and Summary rules in the Data lake tier, and use Notebooks with the Sentinel MCP Server
- Microsoft Defender XDR: unified incident correlation across identity, endpoint, email, and cloud apps; configure advanced features and attack surface reduction rules
- Microsoft Sentinel SIEM and SOAR: data connectors, analytics rules, workbooks, playbooks built on Logic Apps, and automation rules
💡 Exam details: SC-200 has 40-60 questions with a 100-minute time limit. The passing score is 700/1000. The exam costs $165 USD (regional pricing varies; Microsoft Learn shows $83 USD in some regions). Delivery is through Pearson VUE. The certification is valid for 12 months and renews free through an online assessment on Microsoft Learn.
💡 Domain structure: The exam was updated on April 16, 2026, consolidating from four domains to three functional groups. Manage a security operations environment increased from 20-25% to 40-45%, effectively doubling its weight. Configure protections and detections was removed as a standalone domain, with its content absorbed into the remaining three.
💡 This is the single most practically valuable certification for a SOC career in a Microsoft-heavy environment. It qualifies you for Tier 1 and Tier 2 SOC Analyst roles.
🏁 Practitioner Level Checkpoint: Hire Ready. You have passed SC-200. You can triage alerts in Sentinel, write KQL detection and hunting queries, investigate incidents, and configure automation for response workflows.
🛠 Project Ideas
- ▸Configure a Microsoft Sentinel workspace with data connectors for Microsoft 365 and Azure Activity logs.
- ▸Write a KQL detection rule for suspicious sign-in activity. Tune it to reduce false positives.
- ▸Investigate a simulated incident in Sentinel. Document the timeline, affected entities, and recommended remediation.
- ▸Configure an automation rule in Sentinel that triggers a playbook for a common incident type.
Step 2 - Threat hunting and incident response
Move from reactive alert triage to proactive threat hunting and structured incident response. These skills separate Tier 2 analysts from Tier 1 and Tier 3 from Tier 2.
~2-3 months~2-3 months
Step 2 - Threat hunting and incident response
Move from reactive alert triage to proactive threat hunting and structured incident response. These skills separate Tier 2 analysts from Tier 1 and Tier 3 from Tier 2.
- MITRE ATT&CK framework applied: mapping observed behavior to tactics and techniques
- Hypothesis-driven threat hunting: starting from 'what would an attacker do here' rather than waiting for an alert
- IOC vs TTP-based hunting: why TTP-based hunting catches more than IOC matching alone
- Common attacker techniques: initial access, persistence, privilege escalation, lateral movement, exfiltration
- Incident response lifecycle: preparation, identification, containment, eradication, recovery, lessons learned
- Severity classification: triaging incidents into priority tiers and determining escalation
- Containment strategies: isolating endpoints, disabling accounts, blocking IPs—and the trade-offs
- Blameless postmortems: writing incident reports that identify root cause and process improvements
Certifications
💡 The skill that separates Tier 1 from Tier 2 is threat hunting. Investing time here accelerates career progression more than almost anything else.
💡 Communication skill during an active incident is consistently the deciding factor in who gets promoted to Tier 3.
🏁 Practitioner Level Checkpoint: You can proactively hunt for threats, lead incident response, and write clear postmortems.
🛠 Project Ideas
- ▸Pick one MITRE ATT&CK technique. Write a hunting query that would surface evidence of it in your lab SIEM. Document the findings as a hunt report.
- ▸Run a simulated incident through the full response lifecycle. Write both a technical incident report and a one-paragraph executive summary.
Step 3 - GIAC GCIH and Tier 3 readiness
Earn the certification most respected for senior incident handling capability. GCIH validates that you can not just detect an incident but actively handle and contain one under pressure.
~3-4 months~3-4 months
Step 3 - GIAC GCIH and Tier 3 readiness
Earn the certification most respected for senior incident handling capability. GCIH validates that you can not just detect an incident but actively handle and contain one under pressure.
- Incident handling process at an advanced level: beyond the general lifecycle into specific attacker techniques
- Common attack vectors in depth: how real intrusions unfold from initial access through impact
- Hands-on exploitation awareness: understanding attacker tooling and technique well enough to recognize and counter it
- Advanced containment and eradication techniques: network-level and host-level response actions
- Incident handling under GIAC's practical, scenario-heavy exam format
Certifications
💡 GIAC GCIH is widely regarded as one of the most respected incident response credentials. Frequently listed as preferred or required for Tier 3 SOC Analyst, Incident Responder, and SOC Lead roles.
💡 GIAC exams are open-book but demanding. Building a detailed index of your materials is necessary.
💡 GCIH is a meaningful financial investment (SANS training plus exam can cost several thousand dollars). Self-study is more affordable.
🏁 Specialist Level Checkpoint — Lead Ready: You have passed GCIH with real incident response experience. You can lead incidents, mentor junior analysts, and operate as the senior voice during a live security incident. This qualifies you for Tier 3 SOC Analyst, Senior Incident Responder, and SOC Team Lead roles.
🛠 Project Ideas
- ▸Build a detailed index of incident handling concepts and attacker techniques for the GCIH open-book exam.
- ▸Practice incident handling scenarios under time pressure. Document containment decisions and their rationale.
Step 4 - Alternative SIEM - Splunk (optional)
Build Splunk fluency if your target market favors it over Microsoft Sentinel, or for cross-platform SIEM versatility.
~1-2 months (optional)~1-2 months (optional)
Step 4 - Alternative SIEM - Splunk (optional)
Build Splunk fluency if your target market favors it over Microsoft Sentinel, or for cross-platform SIEM versatility.
- Splunk architecture: indexers, search heads, forwarders, and data flow
- SPL (Search Processing Language): filtering, transforming, and correlating log data
- Splunk dashboards and alerts: building operational and security dashboards
- Splunk Enterprise Security (ES): the SIEM-specific app layer used in most SOC deployments
- Common Information Model (CIM): normalizing data across log sources for consistent searching
Certifications
💡 Splunk Core Certified User is the entry credential; Splunk Core Certified Power User goes deeper into SPL and is more practically useful for SOC work.
💡 Many SOCs, particularly in larger enterprises and MSSPs, run Splunk. Check your target job market before deciding if this step is necessary.
💡 If you already have strong KQL, SPL is a faster second language to learn.
🏁 Practitioner Level Checkpoint: You can operate Splunk, write SPL queries, and build security dashboards.
🛠 Project Ideas
- ▸Install Splunk Free and ingest sample logs. Write SPL queries for common detection scenarios.
- ▸Build a Splunk Enterprise Security dashboard for monitoring failed logins and malware alerts.
Step 5 - Career advancement and specialization
SOC experience builds pattern recognition and pressure-tested judgment. Once you reach Tier 3, several strong career paths open up.
OngoingOngoing
Step 5 - Career advancement and specialization
SOC experience builds pattern recognition and pressure-tested judgment. Once you reach Tier 3, several strong career paths open up.
- Detection engineering: moving from responding to alerts to building detection logic and analytics rules
- Threat intelligence: moving from hunting inside your environment to tracking threat actors and campaigns
- Incident response consulting: moving into dedicated IR roles at firms that respond to breaches
- Cloud security: detection and monitoring skills transfer directly into cloud-native security monitoring
- SOC management: leading a SOC team, owning tooling decisions, and building SOC processes
- Digital forensics specialization (optional): GCFE or GCFA for deep investigation work
Certifications
💡 SOC experience is one of the most respected backgrounds across all of cybersecurity because it forces pattern recognition under real time pressure.
💡 Detection engineering is currently one of the fastest-growing adjacent specializations.
💡 GCFE (Certified Forensic Examiner) is the entry credential for forensics specialization.
💡 GCFA (Advanced Forensics) is for senior investigators and incident responders.
🏁 Specialist Level Checkpoint: You have chosen your career path. You know which certifications, tools, and skills to build next.
🛠 Project Ideas
- ▸For detection engineering: build a detection rule set for a specific MITRE ATT&CK technique and document the logic.
- ▸For IR consulting: practice responding to breach scenarios from publicly available incident reports.
Final Step : What this path builds
This roadmap builds a professional SOC Analyst who can operate SIEM platforms, detect threats, hunt for adversaries, and lead incident response. SC-200 validates Microsoft Sentinel and Defender expertise—the most common SOC toolset. GCIH validates senior incident handling capability. The career progression is clear - Tier 1 (alert triage) to Tier 2 (investigation and hunting) to Tier 3 (incident leadership and mentorship). What drives promotion is documented judgment under pressure - hunt reports that found something real, incidents handled cleanly, and postmortems that made the SOC measurably better. Build a portfolio of these artifacts as you go, not just a list of passed exams. After Tier 3, detection engineering, threat intelligence, IR consulting, cloud security, and SOC management are all strong career paths. Use ExamOS daily scenario practice for SC-200 and GCIH preparation to build the applied reasoning both exams test.
Final Step : What this path builds
This roadmap builds a professional SOC Analyst who can operate SIEM platforms, detect threats, hunt for adversaries, and lead incident response. SC-200 validates Microsoft Sentinel and Defender expertise—the most common SOC toolset. GCIH validates senior incident handling capability. The career progression is clear - Tier 1 (alert triage) to Tier 2 (investigation and hunting) to Tier 3 (incident leadership and mentorship). What drives promotion is documented judgment under pressure - hunt reports that found something real, incidents handled cleanly, and postmortems that made the SOC measurably better. Build a portfolio of these artifacts as you go, not just a list of passed exams. After Tier 3, detection engineering, threat intelligence, IR consulting, cloud security, and SOC management are all strong career paths. Use ExamOS daily scenario practice for SC-200 and GCIH preparation to build the applied reasoning both exams test.
Final Thoughts
💡 Total: 8-14 months at 2 hours/day from CySA+ to Hire Ready (SC-200)
💡 SC-200: 2-3 months. Core SOC certification.
💡 Threat Hunting & IR: 2-3 months. Skills for Tier 2 and Tier 3.
💡 GCIH: 3-4 months. Senior incident handling credential.
💡 Readiness: The ExamOS Readiness Score updates after every practice session and recommends when to schedule the exam.
Honest Timeline
| Path | Minimum Study Pace | More Realistic Pace |
|---|---|---|
| SC-200 only (Hire Ready) | ~2 months | ~4 months |
| SC-200 + Splunk cross-platform | ~4 months | ~6 months |
| Full path to GCIH (Lead Ready) | ~8 months | ~14 months |