Career Roadmap
SOC Analyst: Zero to Hero
This roadmap guides you from security foundations to professional SOC Analyst roles. You will master SIEM operations, threat detection, incident response, and threat hunting. SC-200 validates Microsoft Sentinel and Defender expertise. GCIH validates senior incident handling capability. The roadmap covers the Tier 1 to Tier 3 progression that defines SOC careers. Use ExamOS practice quizzes to track progress at every stage.
Who is this roadmap for?
This roadmap is designed for Security Analysts transitioning into SOC roles who already have Security+ and CySA+, as well as IT Support Professionals moving into security monitoring. Additionally, it is tailored for Network Administrators adding security operations skills, as well as Recent Graduates building their first SOC credentials.
Skills You'll Develop
Operate Microsoft Sentinel or Splunk, write detection queries, and build dashboards.
Identify attack patterns, triage alerts, and tune detection rules.
Lead incidents from detection through containment and recovery.
Proactively search for threats using MITRE ATT&CK and hypothesis-driven hunting.
Analyze Windows Event Logs, Linux logs, network logs, and cloud audit logs.
Investigate disk, memory, and network artifacts for incident investigation.
Target Roles in this Roadmap
- SOC Analyst (Tier 1): Triages alerts, monitors security tools, and escalates incidents
- SOC Analyst (Tier 2): Investigates incidents, hunts for threats, and tunes detection rules
- SOC Analyst (Tier 3): Leads incident response, mentors junior analysts, and handles complex investigations
- Detection Engineer: Builds detection rules and analytics for security monitoring
- Incident Responder: Leads incident response engagements and containment efforts
- Threat Hunter: Proactively searches for undetected threats in enterprise environments
Typical Employer Categories
- Managed Security Service Providers (MSSPs): 24x7 security monitoring and incident response
- Technology & Software Firms: Internal SOC teams and product security operations
- Financial Services: Banking, insurance, fintech, and payment processors with SOCs
- Government & Defense: Federal agencies, DoD, and defense contractors
- Healthcare Organizations: HIPAA compliance and patient data protection SOCs
- Consulting & Professional Services: Incident response consulting and security monitoring engagements
The Certification Path
Recommended Path
| Cert | When | Why |
|---|---|---|
| Microsoft SC-200 (Security Operations Analyst) | Month 2-4 | The most directly relevant SOC certification. Validates Microsoft Sentinel, Defender XDR, and Defender for Cloud. |
| GIAC GCIH (Certified Incident Handler) | Month 10-14 | The most respected incident response credential. Signals genuine Tier 3 / lead analyst capability. |
Optional Foundation
| Cert | When | Why |
|---|---|---|
| Splunk Core Certified User / Power User | Month 3-5 | If your SOC runs Splunk instead of Sentinel. Vendor-specific but widely deployed. |
Specialization Path
| Cert | When | Why |
|---|---|---|
| GIAC GCFE (Forensics) | Month 12-16 | Digital forensics specialization for analysts who want to go deep on investigation work. |
| GIAC GCFA (Advanced Forensics) | Month 14-18 | Advanced forensics for senior investigators and incident responders. |
Milestones: Junior → Mid → Senior
| Level | Milestone | When |
|---|---|---|
| Entry Level — Job Ready | Security+ and CySA+ passed. Can read logs, recognize attack patterns, and understand the incident response lifecycle. | Before starting this roadmap |
| Practitioner Level — Hire Ready | SC-200 passed. Can triage alerts, write detection rules, and work a full incident. Ready for Tier 1 / Tier 2 SOC Analyst roles. | Month 4-6 |
| Specialist Level — Lead Ready | GCIH passed with real incident response experience. Can lead incidents, mentor junior analysts, and operate independently. Ready for Tier 3 / Senior SOC Analyst / Incident Response Lead roles. | Month 10-14 |
Step 0 - SIEM fundamentals and log analysis at depth
Build genuine fluency with the tool that defines SOC work—the SIEM. This is the platform where alerts arrive, investigations happen, and detection rules live.
~1-2 months~1-2 months
Step 0 - SIEM fundamentals and log analysis at depth
Build genuine fluency with the tool that defines SOC work—the SIEM. This is the platform where alerts arrive, investigations happen, and detection rules live.
- What a SIEM actually does: log aggregation, normalization, correlation, and alerting at scale
- Log sources that matter most: endpoint (EDR), network (firewall, IDS/IPS), identity (authentication logs), cloud (audit logs)
- Query languages: KQL (Kusto Query Language) for Microsoft Sentinel, SPL (Search Processing Language) for Splunk
- Writing detection rules: correlation logic, thresholds, false positive tuning
- Alert triage methodology: severity assessment, initial scoping, escalation criteria
- Building and reading dashboards: what a useful SOC dashboard actually shows versus a vanity dashboard
💡 Pick one SIEM to go deep on rather than learning three shallowly. Microsoft Sentinel (via SC-200) and Splunk are the two most commonly required in job postings.
💡 KQL and SPL are conceptually similar (filter, aggregate, join) but syntactically different. Once you know one well, learning the second is faster.
🏁 Entry Level Checkpoint: You can write basic detection queries, triage alerts, and build operational dashboards.
🛠 Project Ideas
- ▸Set up a free Microsoft Sentinel workspace. Ingest sample logs and write KQL queries to surface suspicious activity.
- ▸Install Splunk Free and ingest Windows Event Logs. Write SPL queries to identify failed login attempts.
- ▸Build a SOC dashboard that shows alert volume by severity, source, and time.
Step 1 - Microsoft Sentinel and Defender (SC-200)
Earn the certification most directly aligned with SOC analyst work in Microsoft-centric environments—one of the most commonly requested credentials in SOC analyst job postings.
~2-3 months~2-3 months
Step 1 - Microsoft Sentinel and Defender (SC-200)
Earn the certification most directly aligned with SOC analyst work in Microsoft-centric environments—one of the most commonly requested credentials in SOC analyst job postings.
- Microsoft Sentinel architecture: workspaces, data connectors, analytics rules, workbooks, playbooks
- KQL for threat hunting: writing queries that surface suspicious activity across log sources
- Microsoft Defender XDR: unified incident correlation across identity, endpoint, email, and cloud apps
- Microsoft Defender for Cloud: cloud workload protection and security posture findings
- Incident investigation in Sentinel: using the incident timeline, entity behavior, and related alerts
- SOAR basics: how Sentinel playbooks (built on Logic Apps) automate response actions
💡 This is the single most practically valuable certification for a SOC career in a Microsoft-heavy environment.
🏁 Practitioner Level Checkpoint — Hire Ready: You have passed SC-200. You can triage alerts in Sentinel, write KQL detection and hunting queries, and investigate incidents. This qualifies you for Tier 1 / Tier 2 SOC Analyst roles.
🛠 Project Ideas
- ▸Configure a Microsoft Sentinel workspace with data connectors for Microsoft 365 and Azure Activity logs.
- ▸Write a KQL detection rule for suspicious sign-in activity. Tune it to reduce false positives.
- ▸Investigate a simulated incident in Sentinel. Document the timeline, affected entities, and recommended remediation.
Step 2 - Threat hunting and incident response
Move from reactive alert triage to proactive threat hunting and structured incident response. These skills separate Tier 2 analysts from Tier 1 and Tier 3 from Tier 2.
~2-3 months~2-3 months
Step 2 - Threat hunting and incident response
Move from reactive alert triage to proactive threat hunting and structured incident response. These skills separate Tier 2 analysts from Tier 1 and Tier 3 from Tier 2.
- MITRE ATT&CK framework applied: mapping observed behavior to tactics and techniques
- Hypothesis-driven threat hunting: starting from 'what would an attacker do here' rather than waiting for an alert
- IOC vs TTP-based hunting: why TTP-based hunting catches more than IOC matching alone
- Common attacker techniques: initial access, persistence, privilege escalation, lateral movement, exfiltration
- Incident response lifecycle: preparation, identification, containment, eradication, recovery, lessons learned
- Severity classification: triaging incidents into priority tiers and determining escalation
- Containment strategies: isolating endpoints, disabling accounts, blocking IPs—and the trade-offs
- Blameless postmortems: writing incident reports that identify root cause and process improvements
Certifications
💡 The skill that separates Tier 1 from Tier 2 is threat hunting. Investing time here accelerates career progression more than almost anything else.
💡 Communication skill during an active incident is consistently the deciding factor in who gets promoted to Tier 3.
🏁 Practitioner Level Checkpoint: You can proactively hunt for threats, lead incident response, and write clear postmortems.
🛠 Project Ideas
- ▸Pick one MITRE ATT&CK technique. Write a hunting query that would surface evidence of it in your lab SIEM. Document the findings as a hunt report.
- ▸Run a simulated incident through the full response lifecycle. Write both a technical incident report and a one-paragraph executive summary.
Step 3 - GIAC GCIH and Tier 3 readiness
Earn the certification most respected for senior incident handling capability. GCIH validates that you can not just detect an incident but actively handle and contain one under pressure.
~3-4 months~3-4 months
Step 3 - GIAC GCIH and Tier 3 readiness
Earn the certification most respected for senior incident handling capability. GCIH validates that you can not just detect an incident but actively handle and contain one under pressure.
- Incident handling process at an advanced level: beyond the general lifecycle into specific attacker techniques
- Common attack vectors in depth: how real intrusions unfold from initial access through impact
- Hands-on exploitation awareness: understanding attacker tooling and technique well enough to recognize and counter it
- Advanced containment and eradication techniques: network-level and host-level response actions
- Incident handling under GIAC's practical, scenario-heavy exam format
Certifications
💡 GIAC GCIH is widely regarded as one of the most respected incident response credentials. Frequently listed as preferred or required for Tier 3 SOC Analyst, Incident Responder, and SOC Lead roles.
💡 GIAC exams are open-book but demanding. Building a detailed index of your materials is necessary.
💡 GCIH is a meaningful financial investment (SANS training plus exam can cost several thousand dollars). Self-study is more affordable.
🏁 Specialist Level Checkpoint — Lead Ready: You have passed GCIH with real incident response experience. You can lead incidents, mentor junior analysts, and operate as the senior voice during a live security incident. This qualifies you for Tier 3 SOC Analyst, Senior Incident Responder, and SOC Team Lead roles.
🛠 Project Ideas
- ▸Build a detailed index of incident handling concepts and attacker techniques for the GCIH open-book exam.
- ▸Practice incident handling scenarios under time pressure. Document containment decisions and their rationale.
Step 4 - Alternative SIEM - Splunk (optional)
Build Splunk fluency if your target market favors it over Microsoft Sentinel, or for cross-platform SIEM versatility.
~1-2 months (optional)~1-2 months (optional)
Step 4 - Alternative SIEM - Splunk (optional)
Build Splunk fluency if your target market favors it over Microsoft Sentinel, or for cross-platform SIEM versatility.
- Splunk architecture: indexers, search heads, forwarders, and data flow
- SPL (Search Processing Language): filtering, transforming, and correlating log data
- Splunk dashboards and alerts: building operational and security dashboards
- Splunk Enterprise Security (ES): the SIEM-specific app layer used in most SOC deployments
- Common Information Model (CIM): normalizing data across log sources for consistent searching
Certifications
💡 Splunk Core Certified User is the entry credential; Splunk Core Certified Power User goes deeper into SPL and is more practically useful for SOC work.
💡 Many SOCs, particularly in larger enterprises and MSSPs, run Splunk. Check your target job market before deciding if this step is necessary.
💡 If you already have strong KQL, SPL is a faster second language to learn.
🏁 Practitioner Level Checkpoint: You can operate Splunk, write SPL queries, and build security dashboards.
🛠 Project Ideas
- ▸Install Splunk Free and ingest sample logs. Write SPL queries for common detection scenarios.
- ▸Build a Splunk Enterprise Security dashboard for monitoring failed logins and malware alerts.
Step 5 - Career advancement and specialization
SOC experience builds pattern recognition and pressure-tested judgment. Once you reach Tier 3, several strong career paths open up.
OngoingOngoing
Step 5 - Career advancement and specialization
SOC experience builds pattern recognition and pressure-tested judgment. Once you reach Tier 3, several strong career paths open up.
- Detection engineering: moving from responding to alerts to building detection logic and analytics rules
- Threat intelligence: moving from hunting inside your environment to tracking threat actors and campaigns
- Incident response consulting: moving into dedicated IR roles at firms that respond to breaches
- Cloud security: detection and monitoring skills transfer directly into cloud-native security monitoring
- SOC management: leading a SOC team, owning tooling decisions, and building SOC processes
- Digital forensics specialization (optional): GCFE or GCFA for deep investigation work
💡 SOC experience is one of the most respected backgrounds across all of cybersecurity because it forces pattern recognition under real time pressure.
💡 Detection engineering is currently one of the fastest-growing adjacent specializations.
💡 GCFE (Certified Forensic Examiner) is the entry credential for forensics specialization.
💡 GCFA (Advanced Forensics) is for senior investigators and incident responders.
🏁 Specialist Level Checkpoint: You have chosen your career path. You know which certifications, tools, and skills to build next.
Final Step - What this path actually builds
This roadmap builds a professional SOC Analyst who can operate SIEM platforms, detect threats, hunt for adversaries, and lead incident response. SC-200 validates Microsoft Sentinel and Defender expertise—the most common SOC toolset. GCIH validates senior incident handling capability. The career progression is clear - Tier 1 (alert triage) to Tier 2 (investigation and hunting) to Tier 3 (incident leadership and mentorship). What actually drives promotion is documented judgment under pressure - hunt reports that found something real, incidents handled cleanly, and postmortems that made the SOC measurably better. Build a portfolio of these artifacts as you go, not just a list of passed exams. After Tier 3, detection engineering, threat intelligence, IR consulting, cloud security, and SOC management are all strong career paths. Use ExamOS daily scenario practice for SC-200 and GCIH preparation to build the applied reasoning both exams test.
Final Step - What this path actually builds
This roadmap builds a professional SOC Analyst who can operate SIEM platforms, detect threats, hunt for adversaries, and lead incident response. SC-200 validates Microsoft Sentinel and Defender expertise—the most common SOC toolset. GCIH validates senior incident handling capability. The career progression is clear - Tier 1 (alert triage) to Tier 2 (investigation and hunting) to Tier 3 (incident leadership and mentorship). What actually drives promotion is documented judgment under pressure - hunt reports that found something real, incidents handled cleanly, and postmortems that made the SOC measurably better. Build a portfolio of these artifacts as you go, not just a list of passed exams. After Tier 3, detection engineering, threat intelligence, IR consulting, cloud security, and SOC management are all strong career paths. Use ExamOS daily scenario practice for SC-200 and GCIH preparation to build the applied reasoning both exams test.
Final Thoughts
💡 Total: 8-14 months at 2 hours/day from CySA+ to Hire Ready (SC-200)
💡 SC-200: 2-3 months. Core SOC certification.
💡 Threat Hunting & IR: 2-3 months. Skills for Tier 2 and Tier 3.
💡 GCIH: 3-4 months. Senior incident handling credential.
💡 Readiness: Consistent 80%+ on Legend mode across five sessions is your signal to book.
Honest Timeline
| Path | Minimum Study Pace | More Realistic Pace |
|---|---|---|
| SC-200 only (Hire Ready) | ~2 months | ~4 months |
| SC-200 + Splunk cross-platform | ~4 months | ~6 months |
| Full path to GCIH (Lead Ready) | ~8 months | ~14 months |