Path 01 / Blue team

Security analyst

Watch the alerts, find the real incidents and lead the response.

Start learning
  • CompTIASecurity+CompTIA Security+
  • CompTIACySA+CompTIA Cybersecurity Analyst
  • Security Blue TeamBTL1Blue Team Level 1
  • GIACGCIHGIAC Certified Incident Handler

What the job is

0:00 / 0:22

The path

4 courses, in order

  1. SOC Analyst: Detection and TriageTriage alerts and write up incidents.Soon
  2. Incident Response and ForensicsContain, collect evidence, rebuild the timeline.Soon
  3. Detection Engineering as CodeShip tested detections as code.Soon
  4. Malware AnalysisTriage samples safely and write detections.Soon

Where it leads

  1. 01SOC analyst, tier 1
  2. 02SOC analyst, tier 2 or incident responder
  3. 03Detection engineer or threat hunter
  4. 04SOC lead or incident response manager

The tools and the pay

  • Microsoft Sentinel
  • Splunk
  • Elastic Security
  • Microsoft Defender for Endpoint
  • CrowdStrike Falcon
  • SentinelOne
  • Wireshark
  • Zeek
  • Suricata
  • Sigma
  • YARA
  • MITRE ATT&CK
  • TheHive
$129kMedian pay
$75k starting$200k+ top 10%
+21%Jobs by 2035

US figures, U.S. Bureau of Labor Statistics, May 2025.

Before you start

Take these in order

  1. FreeLinux FoundationsNavigate, search and audit a real Linux server.12 units / 73 lessons
  2. FreeNetworking EssentialsPackets, subnets, DNS and real captures.12 units / 68 lessons
  3. FreeHow the Web WorksHTTP, cookies and TLS, inspected with curl.10 units / 50 lessons
  4. Python for Security AutomationSmall Python tools defenders use daily.10 units / 55 lessons
  5. The Modern Threat LandscapeSpot phishing, read headers, verify, report.10 units / 51 lessons
  6. Windows and Active Directory BasicsUsers, registry, event logs and domains.9 units / 52 lessons
  7. Identity and Access SecurityStop the identity attacks behind most breaches.10 units / 48 lessons

Skills you will build

Turn a card

Questions

Do I need a degree to become a security analyst?

Many analysts have one, but it is not always required. Employers look for evidence that you can investigate: labs you have completed, write-ups you have published and certifications such as Security+.

Is SOC work only night shifts?

Some SOCs run around the clock and use shifts, especially at managed security providers. Many in-house teams work business hours with an on-call rotation.

How is this different from a penetration tester?

An analyst defends and investigates live systems. A penetration tester is hired to find weaknesses before attackers do. The skills overlap, and many people move between the two.

Become a security analyst

Start learning