Transcription
Do you want a roadmap that focuses strictly on becoming a SOC analyst so you can be on the right path in 2024? You might have seen my previous roadmap video about getting into cybersecurity in one year, and that still applies. However, this roadmap will be specific to becoming a SOC analyst, whereas the other one is more generalized and for those who aren't too sure which domain to take yet.
It seems that everyone wants to become a SOC analyst and start right away, but the reality is that it's not possible for the majority because they are lacking the foundations to perform the job responsibilities of a SOC analyst. This is why I created the roadmap to help those get started the right way. There will be some similarities from my previous roadmap, but let's just say you have zero IT experience. This is what you should do.
Step one: learn material tied to CompTIA A+ certification. If you are brand new to this field, learning A+ is a great way to gain IT experience. To get experience, you can enroll in a course that Google has created called the IT Support Course, which I will link down below. This course will help you get set up and get ready for the A+ certification.
Now, do you need to certify for A+? No, but it is nice to have. As long as you are confident in your ability after completing the course and reading the material, you should have a good foundational IT knowledge. If you had some prior IT experience or knowledge before, it is up to you if you want to take this step or jump straight to the next step.
The next step is to start obtaining knowledge in networking. This can be learning from CBT Nuggets, focusing on either Network Plus or Cisco CCNA. Either will help you learn networking. Just like the A+ certification, do you need to certify with either Network Plus or CCNA? No, but it is nice to have, and it will look good on your resume. If you have networking knowledge in the past and are confident, you can skip this one as well.
Now that you have the knowledge of A+ and Network Plus or CCNA, the next step is to obtain cybersecurity knowledge. To do this, I always recommend Google Cybersecurity Course, as that provides you with the base knowledge in cybersecurity and will get you started with Security Plus. I would recommend you purchase the study guide and read the book as well to allow yourself to digest information differently, as this should help with understanding the material.
Afterwards, you should have a decent understanding in the following: IT fundamentals, network fundamentals, and cybersecurity fundamentals. It's time to work towards becoming a SOC analyst. Look into certifications such as CDSA by Hack The Box or CCD by Cyber Defenders, as any of these will train you on skills to become a SOC analyst. There are others out there, but these ones are among the better ones in my opinion.
By enrolling in these certification programs, you get the ability to gain hands-on experience where you get to put theory into practice. In other words, apply the concepts that you learned into real-world scenarios. Also, while you are tackling the required labs to qualify for the SEERT, you should begin looking into creating your portfolio. This can be on any blog site of your choice, and you can even use GitHub.
The sole purpose of this is to showcase your work and demonstrate your ability. Just to clarify, I am not asking you to document your course material because that might be against their policy, but instead, I want you to document future labs and/or projects that you complete during your studies. You should definitely look into projects so you can start putting them onto your portfolio and resume.
Here are the projects that I recommend you do in any order, starting with the first one: Wazuh plus SOAR implementation, Windows Event Log plus ART detection, spin-up Security Onion plus PCAP investigation, Microsoft 365 plus MDE implementation, setup Active Directory and detect attacks, building a malware analysis lab, ID/Z network monitoring, and lastly, set up a honeypot.
These projects will allow you to see what a SOC environment might come across during their day-to-day operations. By completing these projects, you will gain an insane amount of hands-on experience, which would likely help you build up troubleshooting, problem-solving, and researching skills, but more importantly, confidence. The more you do, the more confident you become in discussing these projects with others, especially hiring managers.
Next, you want to focus on labs using various resources such as Cyber Defenders, Blue Team Cyber Range, and Let's Defend. The whole point of this is to focus on four core categories, and those are network, endpoint, malware, and phishing. In my SOC roadmap, I include which labs you can take to hit all four categories on those sites listed, but honestly, the majority of the free labs will help you.
There are a lot of tools to learn as a SOC analyst, but here are the main categories that I recommend you focus on, starting with the SIEM. You can use something like Microsoft Sentinel, Splunk, or Elastic. Second is IDS/IPS, such as Suricata, Snort, or Zeek. Then EDR, such as Velociraptor, Elastic EDR, or Wazuh.
Once you have finished with either CDSA or CCD and worked on projects and labs while documenting on GitHub or other sites, you should have obtained the following skills: IT fundamentals, network fundamentals, cybersecurity fundamentals, SOC analyst fundamentals, hands-on skills, and soft skills. Now you are ready to try your luck on job hunting.
But before you do that, let's start looking at both your resume and cover letter. Make sure you spend a lot of time on your resume because that one piece of paper is what will either land you a potential role or have you sit on the sidelines waiting forever. I want you to win. Use both my resume and cover letter template that I've created, and make sure whatever you put down relates to the role that you're applying to.
Once your resume and cover letter are completed, start building up your LinkedIn profile and list your blog or GitHub as well. You want to allow recruiters or hiring managers to easily view your work. Now you can start applying to SOC tier one roles, and while you do that, attend local conferences, webinars, or events around your area to network with people with similar interests because you never know who you might meet.
Networking is the secret to job success. Meet with others often and be a decent human being. During your off time, you can begin practicing interviews using my interview guide that I've created and try to really answer those questions. Everything can be found on my site at mydf.org.
Get a feel for what is to come eventually and prepare for it. You can also get a list of generic questions by using ChatGPT as well, but your mileage may vary. It is still a good exercise, and practice makes perfect. Set up job alerts for SOC analyst roles and continue to do labs to sharpen up your skills, and eventually, you will get a callback, and that is your time to shine.
As a bonus, I would also recommend you look into an additional SOC-related certification such as the Microsoft Security Operations Analyst SC-200 because this will touch on the cloud and show you how to use Microsoft-related security products, which a lot of employers are starting to see a lot of value in. I truly believe that every SOC within the next five years will have some sort of cloud-related tech or events being ingested into it, and you, as a SOC analyst, will be required to interpret that data and make sense of it.
Don't wait until that happens; the time to act is now. If you are a student or a professional that wants to transition into cybersecurity, I want you to know that I offer free mentorship on my site with no strings attached. On there, you will also see products that I've personally created, which you can download to help guide you along this journey.
These products include resume and cover letter templates, bookmarks, a one-year roadmap on how to get started in cybersecurity, and a list of interview questions to help you in your next interview. Also, as a sneak peek, I am in the process of creating a SOC course where there will be over 20 hands-on labs and multiple projects that you can put onto your resume. You can join the waitlist if you choose to do so.
My mission here is to help you get to where you want to be. If you stay till the end and like what you see, you can buy me a coffee by purchasing the No BS SOC Roadmap, which will give you a written PDF of this video with links and references.
Remember, the more certificates you have, the more attractive your resume becomes, especially if you are coming from a background with no IT experience. Now, certifications are not the end-all, be-all. You will get calls, but you must be able to have a conversation with the other side and be able to apply concepts that you learned to real-world scenarios. You can do this by working on projects and labs.
That is it for the video, and I hope you found it informative. Remember to stay curious and do things differently.