ITForMe Sign in
Career roadmaps/SOC Analyst
Tier 1 SOC → incident response

SOC Analyst

Turn systems and networking fundamentals into repeatable detection, triage, and response skills.

0%path readiness
0%peak evidence
0/11skills at target
0refreshes due
One route · progressively disclosed

Your route to SOC Analyst

Each stage keeps the role gate, exact learning sequence, credentials, experience, and skill evidence together. Choose one branch where alternatives exist—you do not need every credential.

0/5role gates currently met
Gate metWork here nextLaterOnly the current stage stays open; completed and later stages are expandable. Update your background →
Common routeIT foundations → support → network/systems exposure → security work
Stretch routeCertifications + built-in practice → direct junior security application

Both routes exist. The stretch path asks a portfolio and interview performance to compensate for missing production experience.

01
Prerequisite knowledge

IT foundations

Current gate

Understands the endpoints and operating systems being defended

Exact next step
ResourceLearn 1.1 · Linux+

Continue with the provider lesson, here or on its own site. Then return to try four related questions. The concept notes are optional.

Continue your lesson
○
Knowledge0% current · 60% targetBuild or assess the mapped skills for this gate.
○
CredentialOptional hiring signalA+ is recommended for a new learner, not a universal security-job requirement. The underlying support knowledge is the gate.
✓
ExperienceRequirement representedCan begin in a lab; real support exposure makes later security decisions more credible.
Learning branchesChoose the branch that matches the work you wantA+ is recommended for a new learner, not a universal security-job requirement. The underlying support knowledge is the gate.
A+Knowledge option

CompTIA A+

220-1201 / 220-1202

Not a required purchase or fixed prerequisite.Use the official scope and this stage’s skill evidence.
View certification context →
Linux+0% complete

CompTIA Linux+

XK0-006

0/142 guided steps
Free perspectives: Tertiary Courses, Linux project documentation
1 · System Management0/34 learning steps · Tertiary Courses + Linux project documentation assignments2 · Services and User Management0/24 learning steps · Tertiary Courses assignments3 · Security0/30 learning steps · Tertiary Courses + Linux project documentation assignments4 · Automation, Orchestration, and Scripting0/22 learning steps · Tertiary Courses + Linux project documentation assignments5 · Troubleshooting0/30 learning steps · Tertiary Courses + Linux project documentation assignments
Open Linux+ route →
Skill evidence0/3 representedShow confidence, targets, and freshness
Endpoint & OS operations0%
0 evidence eventshalf-life 150d
IT troubleshooting0%
0 evidence eventshalf-life 150d
Linux operations0%
0 evidence eventshalf-life 120d
Other resources for this stage3 optional perspectivesThese do not replace the bounded sequence above.
Intune TrainingIntune community training playlists
Free

Free on YouTube The videos are free. Prefer newer playlists and confirm interface steps and product limits in current Microsoft Learn documentation.

Intune practitioners continue to recommend the channel for a second explanation, while noting that older screens and some practices require current-documentation checks.
1 community source

Community reports are anecdotal perspectives, not proof that a course fits every learner.

Access and mapping checked 2026-08-16 · review due 2027-08-16
Open resource ↗
Log completion

Saved as self-reported evidence.

LinkedIn LearningMD-102 Cert Prep by Microsoft Press
Paid

Paid subscription; employer or library access may be available A LinkedIn Learning subscription is normally required; some employers and public libraries include access.

A recent MD-102 pass report singled out the Microsoft Press course as a strong second explanation after official study material.
1 community source

Community reports are anecdotal perspectives, not proof that a course fits every learner.

Access and mapping checked 2026-08-16 · review due 2027-08-16
Open resource ↗
Log completion

Saved as self-reported evidence.

Microsoft LearnManage and secure Microsoft 365 endpoints by using Intune
Free

Free modules; optional paid instruction The learning modules are free. Hands-on work may require access to an Intune-capable tenant or subscription.

Official current course; recent r/Intune discussions still prioritize Microsoft Learn and tenant practice.
1 community source

Community reports are anecdotal perspectives, not proof that a course fits every learner.

Access and mapping checked 2026-08-16 · review due 2027-08-16
Open resource ↗
Log completion

Saved as self-reported evidence.

02
Essential knowledge gateNetwork foundationsLater gate · Preview details

Can explain normal traffic before attempting to identify abnormal traffic

○
Knowledge0% current · 65% targetBuild or assess the mapped skills for this gate.
○
CredentialOptional hiring signalNetwork+ or equivalent knowledge is foundational for technical security. The certificate itself is role- and employer-dependent.
✓
ExperienceRequirement representedNetwork support, packet analysis, or a documented home lab can supply practical context.
Learning branchesChoose the branch that matches the work you wantNetwork+ or equivalent knowledge is foundational for technical security. The certificate itself is role- and employer-dependent.
Net+0% complete

CompTIA Network+

N10-009

0/154 guided steps
Free perspectives: Professor Messer, BurningIceTech
1 · Networking Concepts0/54 learning steps · Professor Messer + BurningIceTech assignments2 · Network Implementation0/22 learning steps · Professor Messer assignments3 · Network Operations0/30 learning steps · Professor Messer assignments4 · Network Security0/24 learning steps · Professor Messer assignments5 · Network Troubleshooting0/22 learning steps · Professor Messer assignments
Open Net+ route →
CCNA0% complete

Cisco CCNA

200-301 v1.1

0/280 guided steps
Free perspectives: Jeremy's IT Lab, Platform and standards documentation
1 · Network Fundamentals0/66 learning steps · Jeremy's IT Lab + Platform and standards documentation assignments2 · Network Access0/52 learning steps · Jeremy's IT Lab assignments3 · IP Connectivity0/32 learning steps · Jeremy's IT Lab assignments4 · IP Services0/46 learning steps · Jeremy's IT Lab assignments5 · Security Fundamentals0/48 learning steps · Jeremy's IT Lab + Platform and standards documentation assignments6 · Automation and Programmability0/34 learning steps · Jeremy's IT Lab assignments
Open CCNA route →
Skill evidence0/3 representedShow confidence, targets, and freshness
Network fundamentals0%
0 evidence eventshalf-life 180d
Switching & routing0%
0 evidence eventshalf-life 120d
Network defense0%
0 evidence eventshalf-life 120d
03
Security baselineSecurity foundationsLater gate · Preview details

Prepared to begin role-specific security practice—not yet job-ready

○
Knowledge0% current · 70% targetBuild or assess the mapped skills for this gate.
○
CredentialOptional hiring signalSecurity+ is a broad screening signal; SC-300 adds identity depth. Neither proves incident-handling ability.
✓
ExperienceRequirement representedHardening, access reviews, vulnerability remediation, or logging work in any IT role counts as security-adjacent exposure.
Learning branchesChoose the branch that matches the work you wantSecurity+ is a broad screening signal; SC-300 adds identity depth. Neither proves incident-handling ability.
Sec+0% complete

CompTIA Security+

SY0-701

0/114 guided steps
Free perspectives: Professor Messer, Inside Cloud and Security
1 · General Security Concepts0/16 learning steps · Professor Messer + Inside Cloud and Security assignments2 · Threats, Vulnerabilities, and Mitigations0/20 learning steps · Professor Messer + Inside Cloud and Security assignments3 · Security Architecture0/16 learning steps · Professor Messer assignments4 · Security Operations0/36 learning steps · Professor Messer + Inside Cloud and Security assignments5 · Security Program Management and Oversight0/24 learning steps · Professor Messer + Inside Cloud and Security assignments
Open Sec+ route →
SC-3000% complete

Microsoft Identity and Access Administrator Associate

SC-300

0/156 guided steps
Free perspectives: Microsoft Learn, John Savill's Technical Training
1 · Implement and manage user identities0/40 learning steps · Microsoft Learn assignments2 · Implement authentication and access management0/40 learning steps · Microsoft Learn assignments3 · Plan and implement workload identities0/40 learning steps · Microsoft Learn assignments4 · Plan and automate identity governance0/34 learning steps · Microsoft Learn assignments
Open SC-300 route →
Skill evidence0/3 representedShow confidence, targets, and freshness
Security foundations0%
0 evidence eventshalf-life 180d
Identity & access0%
0 evidence eventshalf-life 150d
Network defense0%
0 evidence eventshalf-life 120d
04
Proof gateSecurity operations evidenceLater gate · Preview details

Can show repeatable analysis rather than only course completion

○
Knowledge0% current · 70% targetBuild or assess the mapped skills for this gate.
○
CredentialOptional hiring signalNo additional certificate substitutes for investigations, written findings, and defensible decisions.
○
ExperienceEvidence still usefulA feeder IT role is common. Internships, serious projects, and security responsibilities can provide alternate evidence.
Skill evidence0/3 representedShow confidence, targets, and freshness
Logging & monitoring0%
0 evidence eventshalf-life 90d
Incident triage0%
0 evidence eventshalf-life 90d
Technical communication0%
0 evidence eventshalf-life 240d
KnowledgeTelemetry · Triage · Communicate
Experience or evidenceA feeder IT role is common. Internships, serious projects, and security responsibilities can provide alternate evidence.
05
Target roleJunior SOC candidateLater gate · Preview details

Reasonable time to apply broadly while continuing to build evidence

○
Knowledge0% current · 75% targetBuild or assess the mapped skills for this gate.
○
CredentialOptional hiring signalCertifications improve the signal; they do not guarantee an interview or make the role truly entry-level.
○
ExperienceEvidence still usefulSupport or operations experience materially improves competitiveness. Direct entry is possible, but it is the stretch path.
Skill evidence0/4 representedShow confidence, targets, and freshness
Logging & monitoring0%
0 evidence eventshalf-life 90d
Incident triage0%
0 evidence eventshalf-life 90d
Network defense0%
0 evidence eventshalf-life 120d
Technical communication0%
0 evidence eventshalf-life 240d
KnowledgeTelemetry · Triage · Defense · Communicate
Experience or evidenceSupport or operations experience materially improves competitiveness. Direct entry is possible, but it is the stretch path.
Already introduced earlier:CompTIA Security+. This gate uses the same credential signal; it does not restart that learning route.
How readiness is calculatedSee the decay formula, evidence strengths, sources, and limitations in one place.View methodology →