Cybersecurity Analyst Roadmap

What a SOC Analyst Actually Does beginner: The real day to day of the role: triaging alerts, investigating, and escalating, not hacking in the movie sense.

• SOC Structure & Tiers: How security operations centers organize analysts by experience level.
• Defensive vs Offensive Security: Monitoring and responding versus simulating attacks with permission.
• The Alert Triage Workflow: The general process of assessing whether an alert is a real threat.

The CIA Triad & Threat Landscape beginner: The foundational model for what security is actually trying to protect, and who the common attackers are.

• Confidentiality, Integrity, Availability: The three core properties security aims to protect.
• Threat Actor Types: Different categories of attackers and their typical motivations.
• Common Attack Vectors: The typical ways attackers gain initial access to a system.

Networking Core Concepts beginner: How data actually moves between systems, the foundation nearly every other security skill depends on.

• TCP/IP Model: The layered structure that describes how network communication works.
• IP Addressing & Subnetting: How devices are identified and grouped on a network.
• Common Ports & Protocols: The standard doorways services use to communicate.
• DNS: How domain names resolve to IP addresses, and how it's abused.

Network Devices & Traffic Analysis intermediate: Reading and understanding the actual traffic flowing across a network.

• Firewalls & Routers: The devices that control and direct traffic between networks.
• Packet Capture Basics: Capturing raw network traffic for inspection with tools like Wireshark.
• Reading Packet Data: Interpreting captured traffic to understand what's actually happening.

Linux Fundamentals for Security beginner: The command line and system knowledge underlying most security tooling and a large share of monitored infrastructure.

• File System & Permissions: How Linux organizes files and controls access to them.
• Process & Service Management: Viewing and controlling what's actually running on a system.
• Command Line Log Access: Finding and reading system logs directly from the terminal.

Windows Fundamentals for Security beginner: The Windows-specific knowledge most corporate SOC environments assume, alongside Linux.

• Windows Event Logs: The built-in logging system Windows uses to record system activity.
• Active Directory Basics: How Windows environments manage users and permissions centrally.

NIST Cybersecurity Framework intermediate: The widely referenced structure organizations use to organize their overall security posture.

• Identify, Protect, Detect, Respond, Recover: The five core functions the NIST framework is built around.
• Risk Management Basics: How organizations prioritize which security gaps to address first.

MITRE ATT&CK Framework intermediate: The shared language for describing real attacker behavior that SOC analysts are expected to be fluent in.

• Tactics & Techniques: The what and how of attacker behavior in the ATT&CK matrix.
• Mapping Detections to ATT&CK: Connecting a specific alert to a known attack technique.
• Using ATT&CK for Threat Hunting: Proactively searching for signs of known attack techniques.

Log Analysis Fundamentals intermediate: Reading raw logs closely enough to spot what's normal versus what's actually suspicious.

• Log Sources & Formats: Where security-relevant logs come from and how they're structured.
• Normal vs Anomalous Activity: Establishing a baseline to recognize what actually looks wrong.
• Correlating Multiple Log Sources: Connecting events across different systems to see the full picture.

SIEM Fundamentals intermediate: How security information and event management platforms centralize and correlate security data.

• Log Aggregation: Collecting logs from many sources into one searchable platform.
• Correlation Rules: Automated logic that flags combinations of events as suspicious.
• Dashboards & Alerts: Visualizing security data and surfacing what needs attention.

Splunk Hands-On intermediate: Practical, query-level fluency in one of the most widely deployed SIEM platforms.

• SPL (Search Processing Language): Splunk's query language for searching and analyzing log data.
• Building Splunk Dashboards: Creating visualizations of security data for ongoing monitoring.

Microsoft Sentinel Hands-On intermediate: The cloud-native SIEM increasingly common in Azure-based environments.

• KQL (Kusto Query Language): Sentinel's query language for searching security data.
• Sentinel Analytics Rules: Automated detections configured to trigger alerts in Sentinel.

Threat Detection Fundamentals intermediate: Turning raw alerts and logs into a confident judgment about whether something is a real threat.

• Indicators of Compromise: Specific evidence that a system has been breached or compromised.
• False Positive Triage: Efficiently ruling out alerts that aren't actually threats.
• Alert Prioritization: Deciding which of many alerts needs attention first.

Incident Response Process advanced: The structured steps a team follows once a real security incident is confirmed.

• IR Lifecycle: The standard phases from preparation through recovery and lessons learned.
• Containment Strategies: Stopping an active threat from spreading further.
• Evidence Preservation: Handling systems and data in a way that keeps evidence usable later.

Vulnerability Scanning Fundamentals intermediate: Finding known weaknesses in systems before an attacker does.

• CVE & CVSS Scoring: How known vulnerabilities are identified and rated by severity.
• Scanning Tools Overview: Common tools used to automatically detect known vulnerabilities.
• Patch Management Basics: How organizations track and apply fixes for known issues.

Penetration Testing Basics advanced: Enough offensive security understanding to think like the attackers you're defending against.

• Reconnaissance: Gathering information about a target before attempting access.
• Exploitation Basics: How a discovered vulnerability is actually used to gain access.
• Reporting Findings: Documenting discovered vulnerabilities clearly for remediation.

Cloud Security Fundamentals intermediate: The security concerns specific to AWS, Azure and GCP that most organizations now rely on.

• Shared Responsibility Model: What the cloud provider secures versus what the customer must secure.
• Common Cloud Misconfigurations: The frequent, damaging security mistakes in cloud setups.
• Cloud Identity & Access Management: Controlling who and what can access cloud resources.

Cloud Logging & Monitoring advanced: Extending the log analysis and SIEM skills you've built into a cloud environment.

• CloudTrail & Cloud-Native Logging: How cloud providers log account and resource activity.
• Cloud SIEM Integration: Feeding cloud logs into a SIEM for centralized monitoring.

Bash Scripting for Security Tasks intermediate: Automating repetitive log parsing and investigation tasks directly from the Linux command line.

• Text Processing (grep, awk, sed): Filtering and extracting data from large log files quickly.
• Writing Simple Automation Scripts: Turning a repeated manual task into a reusable script.

Python for Security Automation intermediate: Handling security tasks too complex for a shell one-liner, like parsing structured data at scale.

• Parsing Log Files with Python: Programmatically extracting and analyzing data from logs.
• Using Security APIs: Pulling threat intelligence or scan data from external services.

Certification Landscape Context beginner: Understanding where certifications like Security+ actually fit, without treating them as mandatory gates.

• CompTIA Security+: A widely recognized entry-level general security certification.
• Certifications vs Hands-On Skill: Why real lab experience matters alongside, not instead of, certs.