Most SOC career advice is written by people who haven't worked a real alert in years. It recommends certifications that hiring managers don't care about, skill trees that don't match how real SOCs operate, and salary ranges that bear no relationship to what Canadian and US financial sector employers actually pay. This post is the version I'd have wanted when I started — built from 10 years of working the role, hiring for it, and watching what actually moves careers forward.
The Four Career Levels That Actually Exist
- Alert triage from a queue using documented runbooks — the playbook tells you what to do
- Basic log analysis — reading SIEM events, understanding what fields mean
- Phishing email analysis — headers, links, attachments, sandbox submissions
- Ticket creation, escalation, and documentation to a standard template
- Understanding of core attack techniques at a conceptual level
- Familiarity with at least one platform — Splunk, Sentinel, or CrowdStrike
- Incident investigation without a runbook — you know what to look for and why
- SIEM query writing from scratch — custom SPL, KQL, or LogScale for specific investigations
- Malware triage — static and dynamic analysis, identifying indicators, sandbox interpretation
- Detection rule tuning — identifying false positives, adjusting thresholds, documenting changes
- Mentoring Tier 1 analysts on complex alert types
- Understanding attacker technique at the implementation level — not just "lateral movement" but specifically pass-the-hash vs pass-the-ticket vs over-pass-the-hash
- Detection engineering — writing new detection rules from threat intelligence or gap analysis
- IR lead on complex incidents — coordinating across teams, managing communications
- Threat hunting program development — hypothesis generation, methodology, outcome documentation
- SOAR playbook design and automation implementation
- Metrics program ownership — defining, tracking, and reporting SOC performance
- Tooling evaluation and platform architecture input
- Proactive hunting across the estate without alert triggers — finding what the detections missed
- MITRE ATT&CK gap analysis — mapping coverage and identifying blind spots systematically
- Adversary emulation using red team outputs to validate detection coverage
- Detection rule development at scale — query libraries, version control, testing methodology
- Threat intelligence consumption and operationalization into detection logic
Certifications: What's Worth It and What Isn't
The certification landscape is full of credentials that look impressive on paper and don't move hiring managers. After a decade of interviewing and being interviewed, here's the honest breakdown:
Vendor-specific certifications — CrowdStrike's CCFR, Splunk's Core Certified User and Power User — often matter more in practice than general certs because they prove you can operate the specific platform the SOC uses. They're cheaper, faster, and directly applicable. Get the vendor cert for whatever platform your target employer runs before you get through the interview process.
What Actually Moves Careers Forward
In 10 years of watching analysts progress and stagnate, the pattern is consistent. Certifications help get you in the door. These are what actually determine how fast you progress:
- Writing your own queries — analysts who can write custom SPL, KQL, or LogScale from scratch for any investigation progress faster than those who rely on existing saved searches. It's the single highest-leverage technical skill in a SOC role.
- Owning post-incident reviews — volunteering to write and present the post-incident review after major incidents puts you in front of management, builds documentation skills, and forces you to understand every phase of the incident deeply. Do this even when you're Tier 1.
- Building something visible — a detection rule you wrote that fires on a real incident, a runbook you built that the team uses, a training session you ran for junior analysts. Visible contributions that outlast any specific incident.
- Understanding the business context — analysts who understand why certain systems are more critical than others, what the regulatory requirements are for the organization, and what "business risk" means in your specific environment make better decisions under pressure and are much easier to promote.
Tier 1 is a proving ground, not a permanent position. The analysts who move out in 12-18 months are the ones who treat every alert as a learning opportunity — who ask "why did this fire" not just "is this real." The ones who stay stuck are the ones who learn to close tickets efficiently without understanding what they're closing. Both are possible in the same role on the same team.
Home Lab and Hands-On Practice
Technical SOC skills don't develop from reading about them. You need a lab environment where you can generate real events, write queries against real data, and practice investigation workflows. The minimum viable lab for a junior analyst:
- A Windows VM generating Security Event Log data (Event ID 4688 enabled, Sysmon installed)
- Free tier Splunk or Microsoft Sentinel trial ingesting those logs
- MITRE ATT&CK Navigator for tracking your detection coverage as you build queries
- Atomic Red Team for generating real attacker technique artifacts to detect
- TryHackMe or HackTheBox for structured scenario practice
Alert triage handbook, IR runbook set, threat hunting playbook, and quick reference card — the practical tools that support everything on this career roadmap. Written by someone who's hired for these roles and worked them for 10 years.
Get SOC Starter Kit — $39 Read the Interview Questions Post