Roadmaps Security roadmaps Core domains
Security Operations (SecOps)
Watch an organisation's systems around the clock, spot attacks in the noise, and respond before they turn into breaches.
Estimated time: 25–43 months · At about 10 hours a week.
- BeginnerLogs, alerts and the analyst's toolkit3–4 months
- IntermediateInvestigation and endpoint and network visibility4–6 months
- AdvancedDetection engineering and automation6–9 months
- ExpertLeading and designing security operations12–24 months
Overview
Security Operations is the day-to-day defence of an organisation. A security operations centre (SOC) collects logs and alerts from computers, networks, cloud services and applications, decides which ones are real attacks, and responds to them.
The work mixes investigation (what happened, on which machine, by which account), engineering (getting the right logs in and writing detections that fire on real attacks and not on normal work) and communication (telling the right people, fast, in plain language).
Why it matters
Every organisation gets attacked; what decides the damage is how fast someone notices and acts. SOC roles are also the most common way into a security career, because the job teaches you how attacks really look on real systems.
Typical job roles
- EntrySOC analyst (Tier 1) Triages alerts, closes false positives, escalates real incidents with clear notes.
- Mid-levelSOC analyst (Tier 2) / incident responder Investigates escalated alerts end to end and contains threats.
- Mid-levelDetection engineer Writes, tests and tunes the rules and analytics the SOC relies on.
- SeniorThreat hunter (Tier 3) Looks for attackers that no alert has caught, starting from a hypothesis.
- SeniorSecurity engineer (SIEM, SOAR, EDR) Builds and runs the platforms, log pipelines and automations.
- LeadSOC manager / head of security operations Runs the team, the shift rota, metrics and the relationship with the business.
Prerequisites
- Comfortable with Windows and Linux: users, processes, services, the file system and the command line.
- Networking basics: IP addresses, ports, TCP and UDP, DNS, HTTP and what a firewall does.
- Basic scripting in Python or PowerShell, enough to read and change a short script.
- Security basics: the CIA triad, common attack types (phishing, malware, brute force) and why logging matters.
Learning path
Show
-
Beginner Logs, alerts and the analyst's toolkit 3–4 months
Topics
Skills
- Read Windows logon events (4624, 4625, 4688) and Linux auth logs and say what happened.
- Search a SIEM with simple queries and filters.
- Analyse a suspicious email: headers, links and attachments, safely.
- Write a short, clear ticket that someone else can act on.
Hands-on projects and labs
- Install Wazuh or the Elastic Stack on a laptop or a free cloud VM, connect one Windows and one Linux machine, and watch your own logons appear.
- Install Sysmon with a community configuration on a Windows VM and compare what it records with the default logs.
- Work through the free introductory SOC rooms or challenges on a blue team practice platform.
Done when you can…
- Explain the difference between an event, an alert and an incident.
- Take an alert, decide if it is a real threat or a false positive, and justify why in writing.
- Map a simple attack (password spraying, a malicious macro) to ATT&CK techniques.
-
Intermediate Investigation and endpoint and network visibility 4–6 months
Topics
Skills
- Follow an attack from the first email to the last command using several log sources together.
- Write SIEM queries that join and count, not just search.
- Use Zeek logs and Suricata alerts to spot beaconing, scanning and data leaving the network.
- Contain an incident safely: isolate a host, disable an account, block an indicator.
Hands-on projects and labs
- Build a home SOC: Security Onion (or Wazuh with Suricata) watching a small virtual network of a Windows client, a Linux server and an attacker VM.
- Run Atomic Red Team tests in your lab and check which ones your setup detects. Write down the gaps.
- Investigate the free Boss of the SOC datasets from Splunk and write a full incident report.
Done when you can…
- Investigate an alert from start to finish in under an hour and write a report with a timeline.
- Explain what a good detection needs: the log source, the logic, the expected false positives and the response.
- Run the response steps for a phishing compromise without a checklist.
-
Advanced Detection engineering and automation 6–9 months
Topics
Skills
- Write, test and version detections in Git, and convert Sigma rules to your SIEM's language.
- Automate enrichment and routine response with a SOAR tool or scripts.
- Run a hypothesis-driven hunt and turn what you find into new detections.
- Measure coverage against ATT&CK and decide what to build next.
Hands-on projects and labs
- Set up a detection-as-code pipeline: Sigma rules in a GitHub repository, converted and tested automatically on every change.
- Build a Shuffle playbook that enriches an alert with threat intelligence and opens a ticket.
- Run a small purple team exercise in your lab: emulate one ATT&CK technique, check the detection, fix it, repeat.
Done when you can…
- Show a set of your own detections with tests, documented false positives and response notes.
- Lead a hunt and present the findings to a non-technical manager.
- Explain the trade-offs between alert volume, coverage and analyst time.
-
Expert Leading and designing security operations 12–24 months
Topics
Skills
- Design a SOC: what to log, which tools, which processes and which people.
- Lead a major incident with executives, legal and communications involved.
- Build a detection programme that is driven by the threats your organisation actually faces.
- Mentor analysts and reduce burnout through automation and good processes.
Hands-on projects and labs
- Write a complete SOC design for a fictional organisation of 2,000 people: log sources, retention, budget, staffing and metrics.
- Contribute detections or documentation to an open-source project such as Sigma or Wazuh.
- Run a tabletop exercise for a ransomware scenario with friends or colleagues playing executives.
Done when you can…
- Defend a security operations budget and roadmap in front of leadership.
- Run a major incident from first alert to post-incident review.
- Show measurable improvement in a SOC's detection coverage and response time.
Tools and technologies
- Wazuh Open-source SIEM and XDR: log collection, file integrity monitoring and alerting.
- Security Onion A free Linux distribution for network security monitoring, log management and hunting.
- Elastic Security SIEM and endpoint security on the Elastic Stack; the free tier covers a home lab.
- Sysmon Microsoft's tool that logs detailed process, network and file activity on Windows.
- Zeek Turns network traffic into rich, searchable logs.
- Suricata Network intrusion detection and prevention engine.
- Sigma A generic format for writing detections once and using them in any SIEM.
- Velociraptor Endpoint visibility and collection at scale, for hunting and response.
- MISP Threat intelligence sharing platform.
- Shuffle Open-source SOAR for automating alert handling.
- Atomic Red Team Small, safe tests mapped to ATT&CK to check whether your detections work.
- CyberChef Decode, decrypt and transform data in the browser.
- Splunk Enterprise Security A widely used commercial SIEM; many job ads ask for it.
- Microsoft Sentinel Microsoft's cloud SIEM and SOAR, using the KQL query language.
Certifications
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
- Entry Security+ CompTIAThe usual first certification for SOC roles.Cost and exam details
- Intermediate CySA+ (Cybersecurity Analyst) CompTIABuilt for analysts.Cost and exam details
- Intermediate Security Operations Analyst Associate (SC-200) MicrosoftPick this if the jobs near you use Microsoft Sentinel and Defender.Cost and exam details
- Intermediate Certified Defensive Security Analyst (CDSA) Hack The BoxHands-on exam that proves you can investigate.Cost and exam details
- Advanced GIAC Certified Incident Handler (GCIH) GIAC (SANS)Respected incident handling certification; often employer-funded.Cost and exam details
- Advanced GIAC Certified Detection Analyst (GCDA) GIACFor detection engineering and SIEM work.
- Advanced CISSP ISC2For SOC managers and senior leaders.Cost and exam details
Resources
- MITRE ATT&CK
- Security Onion documentation
- Wazuh documentation
- SC-200 learning path
- Boss of the SOC v3 dataset
- CyberDefenders blue team labs
- Malware-Traffic-Analysis.net exercises
- The DFIR Report
- Blue Team Labs Online
- LetsDefend SOC simulator
- TryHackMe SOC learning paths
- The Practice of Network Security Monitoring
- SEC450: Blue Team Fundamentals
Frameworks and standards
- MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
- MITRE D3FEND A knowledge graph of defensive techniques, mapped to the ATT&CK techniques they counter.
- NIST Cybersecurity Framework (CSF) 2.0 A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
- NIST SP 800-61 Rev. 3 Incident response recommendations, aligned with CSF 2.0.
- CIS Critical Security Controls A prioritised list of 18 practical defences, grouped so smaller organisations know what to do first.
- CISA Known Exploited Vulnerabilities (KEV) catalog The list of vulnerabilities known to be exploited in the wild; a practical guide to what to patch first.
Career path
A common progression. Titles vary between companies.
- IT support or junior SOC analyst0–2 years
- SOC analyst (Tier 2) or incident responder2–4 years
- Detection engineer or threat hunter4–7 years
- SOC lead or security operations manager7+ years
- Head of security operations or CISO10+ years
Related domains to move into
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact