Complete, production-ready SOC analyst training program bridging foundational skills (manual investigation) with 2026 automation-first capabilities (AI agents, SOAR, threat intelligence).
Transform from beginner to automation-first SOC analyst in 8-24 weeks.
- Overview
- What You Get
- Quick Start
- Learning Paths
- Project Portfolio
- Technology Stack
- Career Outcomes
- Getting Started
- Repository Structure
- Contributing
- License
By 2026, cybercrime is a $20 trillion economy. The average data breach costs $4.88 million. Attack windows have collapsed from weeks to hours.
Traditional SOC analysts are obsolete. The future belongs to automation architects.
This program trains you for the new reality:
- ✅ AI agents handle 90%+ of routine triage
- ✅ Human-agent teaming is baseline
- ✅ SOAR orchestration is mandatory
- ✅ Cloud-native, identity-first security
- ✅ Intelligence-driven operations
| Document | Purpose | Read Time |
|---|---|---|
| QUICK-START-GUIDE.md | Week 1 action plan, platform setup | 20 min |
| SOC-Analyst-Roadmap.md | Original master plan (Projects 1-6) | 10 min |
| 2026-Automation-First-Roadmap.md | Future-state vision (AI, SOAR, cloud) | 40 min |
| INTEGRATION-GUIDE.md | How everything fits together | 35 min |
Foundation Projects: Manual investigation skills
Automation Projects: SOAR orchestration, ML-powered threat intelligence
Future-State Projects: AI agents, post-quantum cryptography
Each template includes:
- ✅ Day-by-day execution plan
- ✅ Evidence capture guidelines
- ✅ 3 resume bullet versions (technical, results-oriented, strategic)
- ✅ STAR method interview answers
- ✅ Documentation templates
- ✅ Skills checklist
-
Read the Quick Start Guide
# Open this file first cat QUICK-START-GUIDE.md -
Create Platform Accounts (Free)
- LetsDefend - SOC monitoring labs
- TryHackMe - SIEM & incident response
- CyberDefenders - Blue team challenges
-
Start Project 1
# Open and follow step-by-step cat templates/Project-1-Template.md
This Week: Triage your first 20 security alerts 🎯
Goal: Entry-level SOC Analyst Tier-1 job
Projects: 1, 2, 3, 7
Outcome: 9-12 resume bullets, 4 portfolio projects
Start Applying: Week 10
Goal: Mid-level SOC Analyst / Detection Engineer
Projects: 1-7 (all foundation + SOAR)
Outcome: 15-18 resume bullets, 7 projects, GitHub detection repo
Start Applying: Week 16
Goal: AI SOC Engineer / Tier 4 Orchestrator
Projects: 1-10 (full suite)
Outcome: 20+ bullets, certifications, open-source contributions
Start Applying: Week 20+
Build manual investigation skills before automating.
| # | Project | Platform | Duration | Difficulty | Skills |
|---|---|---|---|---|---|
| 1 | Live SOC Monitoring | LetsDefend | 2-3 weeks | Beginner | Alert triage, log analysis |
| 2 | Phishing Email Analysis | CyberDefenders | 1-2 weeks | Beginner-Int | Email forensics, IOC extraction |
| 3 | Incident Response (SIEM) | TryHackMe | 2-3 weeks | Intermediate | Splunk/Elastic, MITRE ATT&CK |
| 4 | Ransomware Forensics | CyberDefenders | 2 weeks | Int-Advanced | Memory/PCAP analysis |
| 5 | Threat Hunting | TryHackMe | 2-3 weeks | Int-Advanced | Hypothesis-driven hunting |
| 6 | Detection Engineering | Home Lab | 2-3 weeks | Advanced | Sigma rules, GitHub publication |
2026 automation-first skills.
| # | Project | Platform | Duration | Difficulty | Skills |
|---|---|---|---|---|---|
| 7 | Automated Phishing Responder ⭐ | Wazuh + Shuffle + TheHive | 2-3 weeks | Advanced | SOAR orchestration, API integration |
| 8 | Automated Threat Intelligence Platform 🚀 | MISP + OpenCTI + Cortex + ML | 3-4 weeks | Enterprise | ML-based IOC filtering, STIX/TAXII, automated detections |
Project 8 Highlights:
- 🤖 ML model (89% accuracy) filters 10,000 IOCs → 50 actionable
- ⚡ Intelligence → Detection time: 5 minutes (vs. 5 days manual)
- 🎯 Automated Sigma rule generation + SIEM deployment
- 📊 15+ threat intelligence sources integrated
Outlined in 2026-Automation-First-Roadmap.md
| # | Project | Focus | Status |
|---|---|---|---|
| 9 | AI-Assisted Threat Hunting | Jupyter + AI agents | 🔄 Outlined |
| 10 | Post-Quantum Cryptography | PQC readiness assessment | 🔄 Outlined |
Training:
- LetsDefend (SOC simulation)
- TryHackMe (SIEM labs)
- CyberDefenders (blue team CTFs)
SIEM/EDR:
- Splunk Free (15GB/day)
- Elastic Stack
- Wazuh (open-source EDR)
SOAR:
- Shuffle (open-source)
- TheHive (case management)
Threat Intelligence:
- MISP (TI platform)
- OpenCTI (knowledge graph)
- Cortex (enrichment analyzers)
Detection:
- Sigma (universal rule format)
- YARA (file-based detection)
AI/ML:
- Python scikit-learn
- Jupyter notebooks
- OpenAI/Claude APIs (optional)
| Week | Milestone | Job Readiness |
|---|---|---|
| 8-10 | Projects 1-3 complete | ✅ Entry-level SOC Analyst Tier-1 |
| 12-16 | First interviews, feedback | 🔄 Refining based on market |
| 16-20 | Projects 1-7 complete | ✅ Mid-level SOC / Detection Analyst |
| 20-24 | Projects 1-8 + certifications | ✅ AI SOC Engineer, Tier 4 Orchestrator |
Before (Generic):
• Studied cybersecurity fundamentals
• Completed online courses
After (This Program):
• Monitored and triaged 150+ security alerts, achieving 92% TP/FP accuracy
• Conducted ransomware forensic investigation using Volatility and Wireshark
• Architected SOAR pipeline reducing MTTC from 45 minutes to 3 minutes
• Built ML-powered TIP processing 12,500 IOCs/day with 89% accuracy
| Candidate Type | Experience |
|---|---|
| Average | Courses only, no projects |
| Good | 2-3 basic projects |
| Top 10% | SOAR automation (Project 7) |
| Top 1% | ← YOU (Enterprise TIP + ML) 🏆 |
Recommended Path:
Entry-Level:
- CompTIA Security+ (after Projects 1-3)
- AWS Cloud Practitioner
Intermediate:
- GIAC Security Essentials (GSEC)
- AWS Security Specialty OR Azure Security Engineer (AZ-500)
Advanced (2026-Focused):
- SEC545: GenAI/LLM Security
- SEC598: AI SOC Orchestration
- Azure AI Engineer (AI-102)
Note: Projects > Certifications in 2024-2026 market.
soc-roadmap-2026/
├── README.md (this file)
├── QUICK-START-GUIDE.md (👈 START HERE)
├── SOC-Analyst-Roadmap.md
├── 2026-Automation-First-Roadmap.md
├── INTEGRATION-GUIDE.md
├── templates/
│ ├── Project-1-Template.md (Live SOC Monitoring)
│ ├── Project-2-Template.md (Phishing Analysis)
│ ├── Project-3-Template.md (Incident Response)
│ ├── Project-4-Template.md (Ransomware Forensics)
│ ├── Project-5-Template.md (Threat Hunting)
│ ├── Project-6-Template.md (Detection Engineering)
│ ├── Project-7-Template.md (Automated Phishing Responder)
│ └── Project-8-Template.md (Automated TIP) 🚀
└── LICENSE
- ⭐ Star this repository
- 📖 Read QUICK-START-GUIDE.md
- 🔐 Create accounts (LetsDefend, TryHackMe, CyberDefenders)
- 📂 Open templates/Project-1-Template.md
- 🎯 Complete Day 1-7 tasks (first 20 alerts)
- 📝 Start your triage log
- ✅ Complete Projects 1-3
- 📄 Update resume with 6-9 SOC bullets
- 💼 Start applying for SOC Analyst Tier-1 jobs
This is a solo training program, but contributions are welcome!
Ways to contribute:
- 🐛 Report issues or unclear instructions
- 💡 Suggest additional project ideas
- 📝 Share your success stories
- 🔗 Submit pull requests for corrections
Please:
- Follow existing template structure
- Keep content actionable (not theoretical)
- Test any technical steps before submitting
This project is licensed under the MIT License - see the LICENSE file for details.
You are free to:
- ✅ Use for personal learning
- ✅ Share with others
- ✅ Modify and adapt
- ✅ Use in portfolios
Attribution appreciated but not required.
If this roadmap helped you, consider giving it a ⭐!
Questions or feedback?
- 💬 Open an issue in this repository
- 🐦 Share your progress:
#SOCRoadmap2026 - 💼 Built by: Security professionals, for aspiring SOC analysts
What you have:
- ✅ Complete training program (147,000+ words)
- ✅ 10 project blueprints (8 detailed templates)
- ✅ Day-by-day execution plans
- ✅ Resume bullets & interview prep
- ✅ 2026 automation-first vision
What you need:
- ⏰ Consistency (10 hours/week)
- 🚀 Execution (start, don't just read)
- ⏳ Patience (8-24 weeks to job-ready)
The SOC analyst career you want is 8 weeks away.
Your move. 🔒🚀
👉 Begin with the Quick Start Guide →
Made with 🔐 for aspiring SOC analysts