SOC Analyst Fundamentals

What this cybersecurity course is

SOC Analyst Fundamentals is a 6-module cybersecurity course for career changers and IT professionals targeting an entry-level Security Operations Center analyst role in 2026. Every module connects a primary-source standard (NIST SP 800-61 Rev. 2 incident handling, NIST SP 800-92 log management, MITRE ATT&CK Enterprise) to the daily work of a SOC analyst: alert triage, log correlation, indicator-of-compromise extraction, escalation handoffs, and the structured analytic techniques used in mature SOCs. The course is designed for adults committing 6 to 8 weeks of focused study before sitting CompTIA Security+ or CySA+. It does not promise employment; it gives you the working vocabulary, mental models, and study cadence that a hiring manager filtering for SOC Tier 1 candidates expects to see in a portfolio interview. Designed by Julian Calvo, Ed.D. in Applied Learning Sciences (University of Miami, 2026).

The course sequences six modules around the operational lifecycle of a security alert as defined in NIST SP 800-61 Revision 2 (Cichonski, Millar, Grance, & Scarfone, 2012). Each module pairs a primary-source standard with a hands-on prompt: read the standard, apply it to a realistic alert scenario, write the analyst note that would land in the case management system. The pedagogical scaffolding follows Kolb's experiential learning cycle (Kolb, 1984) and Bandura's self-efficacy theory (Bandura, 1997): concrete reading, structured reflection, abstract conceptualization through the standard, then active experimentation in a home lab. The course is opinionated about source quality: every claim is sourced to NIST, MITRE, SANS, BLS, or peer-reviewed research. No vendor white papers without primary-source backing. No exam dump references.

Six modules

1. Module 01 · 110 minWhat a SOC Analyst Actually Does+

   The day-to-day work, the three-tier ladder, the BLS occupational data behind the role, and the difference between what hiring managers say they want and what the job actually demands.

   Learning objectives

   • Describe the four phases of the NIST SP 800-61 incident handling lifecycle and how a Tier 1 analyst's work maps to each
   • Cite the BLS OES 2024 median wage and projected growth rate for Information Security Analysts and articulate what those numbers do and do not tell you
   • Distinguish Tier 1, Tier 2, and Tier 3 analyst responsibilities and identify which credentials and skills move someone up the ladder
2. Module 02 · 130 minThe Threat Landscape: How Attackers Operate+
3. Module 03 · 140 minDetection Engineering: From Logs to Alerts+
4. Module 04 · 120 minIncident Response: NIST 800-61 in Practice+
5. Module 05 · 110 minThreat Hunting: Hypothesis-Driven Analysis+
6. Module 06 · 100 minCareer Trajectory: From Tier 1 to Tier 3+

Target audience

• Career changers from IT support, helpdesk, or sysadmin roles targeting a Tier 1 SOC analyst position
• Recent graduates of computer science, cybersecurity, or information systems programs preparing for first cybersecurity role
• Military veterans using GI Bill or VET TEC benefits toward a SOC analyst credential
• Self-taught learners working toward CompTIA Security+ or CySA+
• Mid-career IT professionals stepping sideways into security operations

Prerequisites

• Comfort with command-line basics on Linux and Windows (cd, ls, ps, netstat, get-process)
• Basic understanding of TCP/IP networking (IP addresses, ports, DNS, HTTP)
• Willingness to commit 6 to 8 weeks of 4 to 8 hours per week study
• Free home lab capability (any laptop with 16 GB RAM running VirtualBox or VMware)

Related cybersecurity content

• SOC Analyst cybersecurity career guide
• SOC Analyst salary data
• CompTIA Security+ certification guide
• CompTIA CySA+ certification guide
• GIAC GSEC certification guide
• Cybersecurity career match assessment (2 minutes)

Disclaimer

This course is for educational purposes only. It does not guarantee employment, interview invitations, or salary outcomes. Cybersecurity job-market conditions vary by region, economic cycle, and individual circumstances. NIST and MITRE materials cited here are public-domain US Government works; readers should consult primary sources for currency. CompTIA Security+ and CySA+ are trademarks of CompTIA; DecipherU is not affiliated with CompTIA. DecipherU is not responsible for career or financial decisions made based on this content.