Your plan · saved on this device only

SOC Analyst

The front line of defense — watch for threats, triage alerts, and investigate what's really happening.

Read this before you tick anything

This is a plan, not a qualification. Nobody completes it in order, plenty of people get hired halfway down it, and some finish the whole thing and still have a hard search. It tracks how much of this plan you have worked through — nothing more, and specifically not how employable you are. There is no score, no streak, and nothing here is a deadline.

The roadmap

Written as an order because the earlier stages genuinely make the later ones easier — not because skipping one is forbidden.

  1. Stage 1

    Build the IT foundation

    Get comfortable with networking and systems first (see the Network Administrator or IT Support paths). Security sits on top of this — skipping it is why most beginners stall.

  2. Stage 2

    Orient with the concepts

    Microsoft SC-900 gives you the vocabulary of security, compliance, and identity cheaply and quickly.

    Study guide: Microsoft SC-900 →

  3. Stage 3

    Clear the gate

    Earn CompTIA Security+ — the baseline credential that unlocks SOC and analyst roles (and federal eligibility). Practice hands-on labs on TryHackMe.

    Study guide: CompTIA Security+ →

  4. Stage 4

    Specialize into detection

    CompTIA CySA+ for threat detection and incident response, or branch toward GRC/IAM — the more accessible security rungs.

    Study guide: CompTIA CySA+ →

  5. Stage 5

    The senior tier (years in)

    With ~5 years of experience, CISSP (technical-leadership breadth) or CISM (security management) become realistic — they're the credentials senior and federal postings name explicitly.

    Study guide: ISC2 CISSP →

Skills this path is built on

Tick what you can already do. Most people arrive with more of these than they expect — especially the foundational ones, which are the part everyone skips and then has to come back for.

Certifications

Evidence for a direction you have already chosen, in the order they stop being premature. You do not need all of them, and buying the next one is rarely the answer to a stalled search.

Structured on-ramp

Google Cybersecurity Certificate

A zero-prerequisite curriculum (Linux, SQL, Python, SIEM concepts) — with 30% off Security+ on completion, feeding the gate directly.

Orientation

Microsoft SC-900

A gentle, low-cost first look at security, compliance, and identity concepts.

The gate

CompTIA Security+

The recognized baseline security cert and a DoD 8570/8140 requirement — the one that gets you past filters.

Level up

CompTIA CySA+

The defensive-analyst next step: threat detection and incident response for SOC roles.

Level up (Cisco lane)

CCNA Cybersecurity

Cisco's SOC-analyst associate cert (formerly CyberOps Associate) — the alternative analyst rung, strongest in Cisco-tooling SOCs.

Professional tier

CCNP Cybersecurity

The SOC-operations professional cert (formerly CyberOps Professional) — forensics or threat-hunting depth between the analyst rungs and the summit.

The summit

ISC2 CISSP

The senior security credential — experience-gated (5 years), but the one management and federal roles ask for by name.

The summit

ISACA CISM

The management-track summit: security governance, risk, and program leadership rather than hands-on defense.

Try the work

Worth doing before the first certification rather than after it. Finding out you dislike this is a genuinely useful result, and far cheaper here than after an exam voucher.

60–90 minutes · Free

Experience entry-adjacent security work: a methodical security review of your own accounts, written up as findings.

Fully local — review your own accounts only; nothing installed or transmitted.

More weekend trials →

Your data

Every tick is saved to this browser the moment you make it. Nothing is uploaded, there is no account, and progress on other paths is kept separately — switching plans never erases one.

All plans The full SOC Analyst guide