Free skills gap assessment

Skills Gap Assessment

About this career

SOC analysts work in a security operations center. They watch alerts from security tools, look through logs to work out whether something is a real attack, investigate affected computers and accounts, and help contain and clean up incidents.

It suits people who are curious, stay calm under pressure and enjoy detective work. A grounding in how computers and networks work comes first; certificates and hands-on practice labs help you show it.

First roles are SOC analyst or security operations analyst, often on shifts. From there people move to incident response, threat hunting, detection engineering or security engineering.

Similar job titles

SOC Analyst
Security Operations Analyst
Incident Response Analyst

Free with an account

Sign up for free and complete the Skills Gap Assessment

Your readiness for each SOC Analyst level, and when it's worth applying
Your gaps, most asked-for first, with what to learn and build for each
A week-by-week plan, saved to your account, with progress on every retake

Free accounts get 3 assessments a month. No credit card.

How to get started

New to SOC Analyst? Where to start learning and what employers usually look for. Everything here is free.

Recommended starting point

Item	Kind
ISC2 Certified in Cybersecurity (CC): free course and exam ISC2 · closes: Operating system and network fundamentals, Attacker techniques and MITRE ATT&CK	Certification
Professor Messer's Security+ (SY0-701) video course Professor Messer (YouTube) · closes: Operating system and network fundamentals, Attacker techniques and MITRE ATT&CK, Incident response and forensics	Course
Splunk free training courses Splunk · closes: Log analysis and SIEM queries, Detection engineering and threat hunting	Course

What employers usually look for first

A guide, not a pass mark. Your Skills Gap Assessment shows how ready you are for each level and what to work on.

CompTIA Security+ or ISC2 CC
One home lab investigation written up: an alert traced through SIEM logs

What the SOC Analyst assessment covers

You answer yes or no to short statements about what you have actually done. Each statement belongs to one of 10 skill areas, and each area is weighted by how often employers ask for it, so the score reflects what jobs need.

Skill areas

Operating system and network fundamentals. Core networking, Windows administration and Active Directory most often, then Linux and macOS, web technologies and OWASP Top 10.
Attacker techniques and MITRE ATT&CK. MITRE ATT&CK and attacker TTPs across Windows, Linux, macOS and cloud, plus threat modeling.
Log analysis and SIEM queries. SIEM query languages (SPL, KQL, SQL) and log analysis most often, then data lake analysis and general security monitoring.
Alert triage and endpoint investigation. Security monitoring, EDR telemetry analysis and alert triage, with Windows, Linux and macOS investigations.
Detection engineering and threat hunting. Detection engineering and detection-as-code most often, then threat hunting and turning threat intel and ATT&CK into detection logic.
Incident response and forensics. Incident response, digital forensics and root cause analysis most often, then malware analysis, memory forensics and reverse engineering.
Cloud and SaaS investigation. Cloud incident response across AWS, Azure and GCP most often, then M365 investigations and cloud logging.
Scripting and automation. Python and scripting most often, then PowerShell and Bash for log parsing and workflow automation.
Communication and reporting. Stakeholder and technical communication most often, plus customer focus, incident documentation and security reporting.
Experience, certifications and clearance. Top Secret clearance and SOC or DFIR experience most often, then Security+, CySA+, GCIH and GIAC certifications and CTF or training platform activity.

About this career

First roles are SOC analyst or security operations analyst, often on shifts. From there people move to incident response, threat hunting, detection engineering or security engineering.

How to get started

New to SOC Analyst? Where to start learning and what employers usually look for. Everything here is free.

Recommended starting point

Item	Kind
ISC2 Certified in Cybersecurity (CC): free course and exam ISC2 · closes: Operating system and network fundamentals, Attacker techniques and MITRE ATT&CK	Certification
Professor Messer's Security+ (SY0-701) video course Professor Messer (YouTube) · closes: Operating system and network fundamentals, Attacker techniques and MITRE ATT&CK, Incident response and forensics	Course
Splunk free training courses Splunk · closes: Log analysis and SIEM queries, Detection engineering and threat hunting	Course

What employers usually look for first

A guide, not a pass mark. Your Skills Gap Assessment shows how ready you are for each level and what to work on.

CompTIA Security+ or ISC2 CC

One home lab investigation written up: an alert traced through SIEM logs

What the SOC Analyst assessment covers

Skill areas

Operating system and network fundamentals. Core networking, Windows administration and Active Directory most often, then Linux and macOS, web technologies and OWASP Top 10.

Attacker techniques and MITRE ATT&CK. MITRE ATT&CK and attacker TTPs across Windows, Linux, macOS and cloud, plus threat modeling.

Log analysis and SIEM queries. SIEM query languages (SPL, KQL, SQL) and log analysis most often, then data lake analysis and general security monitoring.

Alert triage and endpoint investigation. Security monitoring, EDR telemetry analysis and alert triage, with Windows, Linux and macOS investigations.

Detection engineering and threat hunting. Detection engineering and detection-as-code most often, then threat hunting and turning threat intel and ATT&CK into detection logic.

Incident response and forensics. Incident response, digital forensics and root cause analysis most often, then malware analysis, memory forensics and reverse engineering.

Cloud and SaaS investigation. Cloud incident response across AWS, Azure and GCP most often, then M365 investigations and cloud logging.

Scripting and automation. Python and scripting most often, then PowerShell and Bash for log parsing and workflow automation.

Communication and reporting. Stakeholder and technical communication most often, plus customer focus, incident documentation and security reporting.

Experience, certifications and clearance. Top Secret clearance and SOC or DFIR experience most often, then Security+, CySA+, GCIH and GIAC certifications and CTF or training platform activity.