SOC Analyst
Monitor, triage, and escalate security alerts in a security operations center.
Responsibilities
- Triage SIEM alerts and document cases
- Escalate true positives with evidence
- Follow runbooks for phishing, malware, and account takeover
- Tune noisy detections with senior analysts
Required skills
- Networking & Windows/Linux literacy
- Log analysis & SIEM queries
- MITRE ATT&CK mapping
- Incident response fundamentals
Practical projects
- Mock SIEM shift: 10 alerts → triage table
- Phishing investigation write-up with IOCs
Portfolio evidence
- Redacted ticket write-ups
- Detection notes mapped to ATT&CK
- Lab evidence: log hunt + SIEM rule labs
Roadmap
Shared lessons (content registry)
- Understanding TCP/IP Protocol
- CIA Triad
- MITRE ATT&CK Mapping
Industry certification prep
Vendor exams — not CYNARKS Academy completion certificates.
CompTIA Security+ · CompTIA CySA+ · BTL1
Cert prep hub →Interview questions
- Walk through how you triage a high-severity alert.
- How do you reduce false positives without missing attacks?
- Explain CIA vs authentication vs authorization in one minute.