ITForMe Beta Sign in
Browse roadmaps/SOC Analyst
Tier 1 SOC → incident response

SOC Analyst

Turn systems and networking fundamentals into repeatable detection, triage, and response skills.

Path readiness

Current skill evidence for SOC Analyst.

0%
0%
Skills at target
0/11
Highest recorded readiness
0%
Refreshes due
0

Path readiness summarizes skill evidence across this roadmap. Stage and skill percentages cover smaller scopes; course progress tracks required study and checks. Stages also consider relevant experience. Readiness is a study signal, not a hiring guarantee.

  1. Current stageIT foundations0% knowledge · 60% targetExperience represented
  2. Later stageNetwork foundations0% knowledge · 65% targetExperience represented
  3. Later stageSecurity foundations0% knowledge · 70% targetExperience represented
  4. Later stageSecurity operations evidence0% knowledge · 70% targetExperience to build
  5. Later stageJunior SOC candidate0% knowledge · 75% targetExperience to build
Career roadmap

Your route to SOC Analyst

Each stage brings together the suggested study order, credentials, experience, and skill evidence. Choose one option where alternatives are offered; you do not need every credential.

0/5stages currently met
Stage metWork here nextLaterThe current stage and target role start open. Expand other stages for details. Update your background →
Common routeIT foundations → support → network/systems exposure → security work
Stretch routeCertifications + built-in practice → direct junior security application

Both routes exist. The stretch path asks a portfolio and interview performance to compensate for missing production experience.

01
Prerequisite knowledge

IT foundations

Current stage

Understands the endpoints and operating systems being defended

Next in this roadmap
ResourceKernel · Initial RAM filesystem · Bootloader · Filesystem Hierarchy Standard · Linux+

Study the ITForMe lesson, then take its short check. Guided practice is optional.

Start your lesson
○
Knowledge0% current · 60% targetBuild or assess the skills for this stage.
○
CredentialOptional hiring signalA+ is recommended for a new learner, not a universal security-job requirement. The underlying support knowledge is the gate.
✓
ExperienceRequirement representedCan begin in a lab; real support exposure makes later security decisions more credible.
Learning branchesChoose the branch that matches the work you wantA+ is recommended for a new learner, not a universal security-job requirement. The underlying support knowledge is the gate.
A+Knowledge option

CompTIA A+

220-1201 / 220-1202

Not a required purchase or fixed prerequisite.Linked courses are available; there are no built-in lessons or checks for this option.
View learning resources →
Linux+0% complete

CompTIA Linux+

XK0-006

0/272 guided steps
Free perspectives: Tertiary Courses, Linux project documentation
1 · System Management0/64 learning steps · Tertiary Courses + Linux project documentation assignments2 · Services and User Management0/50 learning steps · Tertiary Courses assignments3 · Security0/58 learning steps · Tertiary Courses + Linux project documentation assignments4 · Automation, Orchestration, and Scripting0/42 learning steps · Tertiary Courses + Linux project documentation assignments5 · Troubleshooting0/56 learning steps · Tertiary Courses + Linux project documentation assignments
Open Linux+ route →
Skill evidence0/3 representedConfidence, targets, and freshness
Endpoint & OS operations0%
0 evidence recordsEstimate halves in 150 days
IT troubleshooting0%
0 evidence recordsEstimate halves in 150 days
Linux operations0%
0 evidence recordsEstimate halves in 120 days
Other resources for this stage3 optional perspectivesThese do not replace the study sequence above.
Intune TrainingIntune community training playlists
Free

Free on YouTube The videos are free. Prefer newer playlists and confirm interface steps and product limits in current Microsoft Learn documentation.

Intune practitioners continue to recommend the channel for a second explanation, while noting that older screens and some practices require current-documentation checks.
Open resource ↗
Community references · 1

Community reports are anecdotal perspectives, not proof that a course fits every learner.

Access and mapping checked 2026-08-16 · review due 2027-08-16
Log completion

Saved as self-reported evidence.

LinkedIn LearningMD-102 Cert Prep by Microsoft Press
Paid

Paid subscription; employer or library access may be available A LinkedIn Learning subscription is normally required; some employers and public libraries include access.

A recent MD-102 pass report singled out the Microsoft Press course as a strong second explanation after official study material.
Open resource ↗
Community references · 1

Community reports are anecdotal perspectives, not proof that a course fits every learner.

Access and mapping checked 2026-08-16 · review due 2027-08-16
Log completion

Saved as self-reported evidence.

Microsoft LearnManage and secure Microsoft 365 endpoints by using Intune
Free

Free modules; optional paid instruction The learning modules are free. Hands-on work may require access to an Intune-capable tenant or subscription.

Official current course; recent r/Intune discussions still prioritize Microsoft Learn and tenant practice.
Open resource ↗
Community references · 1

Community reports are anecdotal perspectives, not proof that a course fits every learner.

Access and mapping checked 2026-08-16 · review due 2027-08-16
Log completion

Saved as self-reported evidence.

02
Essential knowledge gateNetwork foundationsLater stage · Details

Can explain normal traffic before attempting to identify abnormal traffic

○
Knowledge0% current · 65% targetBuild or assess the skills for this stage.
○
CredentialOptional hiring signalNetwork+ or equivalent knowledge is foundational for technical security. The certificate itself is role- and employer-dependent.
✓
ExperienceRequirement representedNetwork support, packet analysis, or a documented home lab can supply practical context.
Learning branchesChoose the branch that matches the work you wantNetwork+ or equivalent knowledge is foundational for technical security. The certificate itself is role- and employer-dependent.
Net+0% complete

CompTIA Network+

N10-009

0/442 guided steps
Free perspectives: Professor Messer, BurningIceTech
1 · Networking Concepts0/156 learning steps · Professor Messer + BurningIceTech assignments2 · Network Implementation0/66 learning steps · Professor Messer assignments3 · Network Operations0/84 learning steps · Professor Messer assignments4 · Network Security0/66 learning steps · Professor Messer assignments5 · Network Troubleshooting0/68 learning steps · Professor Messer assignments
Open Net+ route →
CCNA0% complete

Cisco CCNA

200-301 v1.1

0/444 guided steps
Free perspectives: Jeremy's IT Lab, Platform and standards documentation
1 · Network Fundamentals0/104 learning steps · Jeremy's IT Lab + Platform and standards documentation assignments2 · Network Access0/88 learning steps · Jeremy's IT Lab assignments3 · IP Connectivity0/48 learning steps · Jeremy's IT Lab assignments4 · IP Services0/76 learning steps · Jeremy's IT Lab assignments5 · Security Fundamentals0/76 learning steps · Jeremy's IT Lab + Platform and standards documentation assignments6 · Automation and Programmability0/50 learning steps · Jeremy's IT Lab assignments
Open CCNA route →
Skill evidence0/3 representedConfidence, targets, and freshness
Network fundamentals0%
0 evidence recordsEstimate halves in 180 days
Switching & routing0%
0 evidence recordsEstimate halves in 120 days
Network defense0%
0 evidence recordsEstimate halves in 120 days
03
Security baselineSecurity foundationsLater stage · Details

Prepared to begin role-specific security practice—not yet job-ready

○
Knowledge0% current · 70% targetBuild or assess the skills for this stage.
○
CredentialOptional hiring signalSecurity+ is a broad screening signal; SC-300 adds identity depth. Neither proves incident-handling ability.
✓
ExperienceRequirement representedHardening, access reviews, vulnerability remediation, or logging work in any IT role counts as security-adjacent exposure.
Learning branchesChoose the branch that matches the work you wantSecurity+ is a broad screening signal; SC-300 adds identity depth. Neither proves incident-handling ability.
Sec+0% complete

CompTIA Security+

SY0-701

0/240 guided steps
Free perspectives: Professor Messer, Inside Cloud and Security
1 · General Security Concepts0/36 learning steps · Professor Messer + Inside Cloud and Security assignments2 · Threats, Vulnerabilities, and Mitigations0/42 learning steps · Professor Messer + Inside Cloud and Security assignments3 · Security Architecture0/36 learning steps · Professor Messer assignments4 · Security Operations0/76 learning steps · Professor Messer + Inside Cloud and Security assignments5 · Security Program Management and Oversight0/48 learning steps · Professor Messer + Inside Cloud and Security assignments
Open Sec+ route →
SC-3000% complete

Microsoft Identity and Access Administrator Associate

SC-300

0/188 guided steps
Free perspectives: Microsoft Learn, John Savill's Technical Training
1 · Implement and manage user identities0/48 learning steps · Microsoft Learn assignments2 · Implement authentication and access management0/48 learning steps · Microsoft Learn assignments3 · Plan and implement workload identities0/48 learning steps · Microsoft Learn assignments4 · Plan and automate identity governance0/42 learning steps · Microsoft Learn assignments
Open SC-300 route →
Skill evidence0/3 representedConfidence, targets, and freshness
Security foundations0%
0 evidence recordsEstimate halves in 180 days
Identity & access0%
0 evidence recordsEstimate halves in 150 days
Network defense0%
0 evidence recordsEstimate halves in 120 days
04
Proof gateSecurity operations evidenceLater stage · Details

Can show repeatable analysis rather than only course completion

○
Knowledge0% current · 70% targetBuild or assess the skills for this stage.
○
CredentialOptional hiring signalNo additional certificate substitutes for investigations, written findings, and defensible decisions.
○
ExperienceEvidence still usefulA feeder IT role is common. Internships, serious projects, and security responsibilities can provide alternate evidence.
Skill evidence0/3 representedConfidence, targets, and freshness
Logging & monitoring0%
0 evidence recordsEstimate halves in 90 days
Incident triage0%
0 evidence recordsEstimate halves in 90 days
Technical communication0%
0 evidence recordsEstimate halves in 240 days
KnowledgeTelemetry · Triage · Communicate
Experience or evidenceA feeder IT role is common. Internships, serious projects, and security responsibilities can provide alternate evidence.
05
Target roleJunior SOC candidateLater stage · Details

Reasonable time to apply broadly while continuing to build evidence

○
Knowledge0% current · 75% targetBuild or assess the skills for this stage.
○
CredentialOptional hiring signalCertifications improve the signal; they do not guarantee an interview or make the role truly entry-level.
○
ExperienceEvidence still usefulSupport or operations experience materially improves competitiveness. Direct entry is possible, but it is the stretch path.
Skill evidence0/4 representedConfidence, targets, and freshness
Logging & monitoring0%
0 evidence recordsEstimate halves in 90 days
Incident triage0%
0 evidence recordsEstimate halves in 90 days
Network defense0%
0 evidence recordsEstimate halves in 120 days
Technical communication0%
0 evidence recordsEstimate halves in 240 days
KnowledgeTelemetry · Triage · Defense · Communicate
Experience or evidenceSupport or operations experience materially improves competitiveness. Direct entry is possible, but it is the stretch path.
Already introduced earlier:CompTIA Security+. This stage uses the same credential; it does not restart that learning route.
How readiness is calculatedSee the decay formula, evidence strengths, sources, and limitations in one place.View methodology →