SockAnalyst

How to become a SOC analyst

I am Mario, and I run SockAnalyst. This is the path I am actually on — not a story about a job I already have.

Why I am making the change

I have been a surgical technologist since 2004, with a break of about a year and a half. That work taught me checklists, staying calm when something goes wrong, and documenting what I did. I wanted a second career in cybersecurity, so I completed a 10-month cybersecurity bootcamp through the University of Colorado Boulder.

I earned CompTIA Security+ around November 2024. I am working toward my first IT or SOC role, and I have not landed that job yet. While I search and practice, I built SockAnalyst with AI tools so I could turn each day's breaches and exploited vulnerabilities into short playbooks: what happened, who is affected, the fix, a hunt query and the CISA deadline.

What a SOC actually does day to day

A security operations center is the team that watches for signs that something bad is happening on a network, then figures out whether an alert is real and what to do next. The work is less "hacking back" and more careful, repeatable investigation.

On a typical day, analysts:

  • Watch a queue of alerts from tools such as a SIEM, endpoint detection, email security or firewall logs.
  • Triage what is noise, what is suspicious and what needs to be handled now. An unfamiliar IP or a single failed login is not automatically a breach.
  • Investigate by building a timeline: who signed in, from where, on what device, and what happened next? Compare that with the user's explanation and other logs.
  • Follow a playbook if the evidence supports compromise: contain access when approved, escalate to the right people and preserve what you looked at.
  • Write it down — timestamps, what you checked, what you still do not know and what you did. Good tickets are part of the job.
  • Hunt and watch patches by searching logs for known-bad activity and tracking vulnerabilities that are already being exploited, the same kind of work captured in our hunt library and CISA KEV deadlines.

I describe this from studying the role and from writing playbooks, not from a SOC seat I do not have yet.

The Security+ path

CompTIA Security+ was my foundational certification. It covers the vocabulary and baseline ideas — threats, architecture, operations and governance — that job posts keep asking for. I treated it as proof I could learn the material, not as a guarantee I would get hired.

If you are considering the same route:

  • Read CompTIA's current official exam objectives and requirements, not a random list of must-have certs.
  • Study one objective at a time, then explain it without notes and test it in a lab you are allowed to use.
  • Pair the cert with evidence you can show: a tuned hunt, a short write-up or a home-lab investigation. Our Career corner walks through those exercises.

A certification can support your story. It does not replace hands-on practice, and it does not by itself get you the job. I am living that part in real time.

How I practice with SockAnalyst playbooks

Each Patch Now playbook is the format I wish I had when I started: a real incident, official sources first, the CISA KEV deadline when CISA lists it, MITRE techniques, any published IOCs, and copy-paste Splunk SPL and Microsoft Sentinel KQL hunts.

Good starting points if you want to see what "investigate this" looks like:

Looking for the first role

I check real, currently open SOC and blue-team postings and collect the ones I can verify on the employer's own board. That list lives on the SockAnalyst jobs board. If you are in the same boat — changing careers, Security+ in hand, still looking — start there, then practice one playbook hunt you can talk through in an interview.

Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.

Weekly email; daily brief on the website.

Subscribe free

Read the free weekly pack →