SOC Analyst Career Roadmap
Investigate security alerts using SIEM, EDR, identity, cloud, network, and endpoint evidence, then improve detections and response.
What this career actually involves
SOC Analysts turn alerts into investigations by gathering evidence, building timelines, determining scope, escalating incidents, improving detections, and using automation or AI only with human validation.
Who this path is for
- Beginners building a practical security-operations pathway.
- IT support or network professionals moving into cybersecurity.
- Security learners building SIEM, EDR, investigation, and detection skills.
Skill demand for this career
Percentages show how often each skill appears across relevant current opportunities for this career.
Core capabilities
Network & Log Analysis
Understand traffic, logs, and common telemetry sources.
SIEM Investigation
Query and correlate security events.
Endpoint Investigation
Use EDR/XDR evidence to understand process and device activity.
Identity Investigation
Analyze sign-ins, MFA, privilege, and account changes.
Detection Engineering
Map threats and improve detection logic.
Incident Response
Scope, contain, escalate, document, and learn.
Responsible AI Assistance
Use AI for enrichment or summarization while validating evidence.
Relevant knowledge checks
Finding quizzes that match this career path...
Tools that support the work
SIEM querying and investigation.
Alternative SIEM/search platforms for lab practice.
Endpoint and identity investigation.
Packet-level network evidence.
Threat behavior mapping and detection context.
Automation for repeatable enrichment and response steps.
How the work typically flows
Triage the Alert
Understand source, severity, entities, context, and expected behavior.
Collect Evidence
Query SIEM, endpoint, identity, cloud, network, and email telemetry.
Build a Timeline and Scope
Determine what happened, when, who/what was affected, and confidence.
Respond and Escalate
Contain or escalate based on procedure and business impact.
Improve Detection
Document lessons, tune rules, create hunts, and improve playbooks.
Build capability in stages
Networking, OS, and Logs
Build foundations in network traffic, Windows/Linux, identity, and telemetry.
SIEM and Alert Triage
Learn queries, correlation, alert context, and investigation notes.
Endpoint, Identity, and Cloud Investigation
Use EDR/XDR and cloud/identity telemetry.
Detection, Hunting, and Response
Map behaviors, write detections, hunt, and support incident response.
Automation, AI, and Portfolio
Automate repeatable steps and document a complete incident case.
SOC Investigation Lab
Fictional workplace scenarioA suspicious sign-in alert may represent normal travel, credential misuse, session theft, or a broader compromise.
Collect identity, endpoint, network, and cloud evidence before deciding and escalating.
Suspicious Sign-In Investigation
Investigate a simulated suspicious-login alert using identity, endpoint, network, and SIEM evidence, then document scope, response, and detection improvements.
Queries used for identity, endpoint, network, and related-event investigation.
Chronological evidence with source and confidence.
Scope, impact, containment, recommendations, and unresolved questions.
Rule logic mapped to observed behavior.
A hypothesis-driven search for related activity.
What was automated or AI-assisted and how the result was verified.
What you should be able to show
Shows investigative fluency.
Shows evidence-based reasoning.
Shows defensive engineering.
Shows proactive analysis.
Shows controlled use of assistance.
Translate learning into an interview story
How do you investigate a suspicious login?
Check user, device, location, MFA, IP, privilege, recent activity, and correlated events.
What makes a good SIEM query during an incident?
Start from a question, identify entities/time range, normalize fields, pivot, and preserve evidence.
How do you use AI safely in a SOC?
Use it for assistance, preserve source evidence, validate conclusions, and keep human ownership.