Investigate security alerts using SIEM, EDR, identity, cloud, network, and endpoint evidence, then improve detections and response.
SOC Analysts turn alerts into investigations by gathering evidence, building timelines, determining scope, escalating incidents, improving detections, and using automation or AI only with human validation.
Current U.S. openings for the job titles employers use for this career.
Percentages show how often each skill appears across relevant current opportunities for this career.
See how close you are before you apply.
Finding quizzes that match this career path...
Understand traffic, logs, and common telemetry sources.
Query and correlate security events.
Use EDR/XDR evidence to understand process and device activity.
Analyze sign-ins, MFA, privilege, and account changes.
Map threats and improve detection logic.
Scope, contain, escalate, document, and learn.
Use AI for enrichment or summarization while validating evidence.
Roadmap, tools, projects and interview preparation — free for everyone.
Build foundations in network traffic, Windows/Linux, identity, and telemetry.
Learn queries, correlation, alert context, and investigation notes.
Use EDR/XDR and cloud/identity telemetry.
Map behaviors, write detections, hunt, and support incident response.
Automate repeatable steps and document a complete incident case.
SIEM querying and investigation.
Alternative SIEM/search platforms for lab practice.
Endpoint and identity investigation.
Packet-level network evidence.
Threat behavior mapping and detection context.
Automation for repeatable enrichment and response steps.
Understand source, severity, entities, context, and expected behavior.
Query SIEM, endpoint, identity, cloud, network, and email telemetry.
Determine what happened, when, who/what was affected, and confidence.
Contain or escalate based on procedure and business impact.
Document lessons, tune rules, create hunts, and improve playbooks.
A suspicious sign-in alert may represent normal travel, credential misuse, session theft, or a broader compromise.
Collect identity, endpoint, network, and cloud evidence before deciding and escalating.
Investigate a simulated suspicious-login alert using identity, endpoint, network, and SIEM evidence, then document scope, response, and detection improvements.
Queries used for identity, endpoint, network, and related-event investigation.
Chronological evidence with source and confidence.
Scope, impact, containment, recommendations, and unresolved questions.
Rule logic mapped to observed behavior.
A hypothesis-driven search for related activity.
What was automated or AI-assisted and how the result was verified.
Shows investigative fluency.
Shows evidence-based reasoning.
Shows defensive engineering.
Shows proactive analysis.
Shows controlled use of assistance.
Check user, device, location, MFA, IP, privilege, recent activity, and correlated events.
Start from a question, identify entities/time range, normalize fields, pivot, and preserve evidence.
Use it for assistance, preserve source evidence, validate conclusions, and keep human ownership.
Prefer a structured class and mentor feedback? Join a free demo first.
Live online classes with an instructor — the only paid part of ITLearn360. Every job, assessment and learning resource on the site stays free. Try a free demo class first.
Build practical analyst foundations around security operations, incidents, cloud security and Security+ concepts.
Learn governance, risk, compliance, controls, AI governance and responsible-AI practices used in modern organizations.
Learn requirements, Agile, Jira, SQL, UAT and practical AI-assisted business-analysis workflows.
