SOC Analyst Career Path UK: A 24-Week Plan to SOC Tier 1

Focus on TCP/IP, subnets, DNS, HTTP, Windows and basic Linux. Practise with Wireshark captures and Windows Event Viewer. Aim to explain what a connection, a process and a log entry tell you.

Cover core security concepts and identity basics. Configure MFA, conditional access and role-based access in a test tenant if possible. Build a small home lab to practise safely.

Learn SIEM concepts: connectors, analytics rules, incidents, dashboards and KQL (for Microsoft Sentinel) or a similar query language. Ingest sample logs, build a simple rule and triage outcomes.

If you prefer a structured route that maps directly to SOC operations in Microsoft environments, consider focused training aligned to Security Operations Analyst Associate, such as SC-200.

Deepen EDR triage (process trees, command lines, parent-child relationships) and network indicators (beacons, uncommon ports, DNS anomalies). Practise contain/isolate workflows in a lab scenario.

Introduce detection engineering at a beginner level: reduce noisy rules, add context, and improve fidelity. Build 2–3 playbooks for common cases: phishing, risky sign-ins, and malware on endpoints.

Assemble a concise portfolio: lab write-ups, rule snapshots, playbooks and incident notes. Practise interview scenarios and timed triage. Align your CV to UK role descriptions.

Turn study into proof with the steps outlined in this guide to proving skills without experience.

• Studying only for exams and skipping hands‑on triage practice.
• Collecting tools without documenting what you learned from them.
• Overbuilding labs and underusing them—start small and iterate.
• Ignoring identity and endpoint telemetry—most Tier 1 alerts touch both.
• Writing vague notes—aim for time‑stamped, reproducible steps.