SOC Analyst
A practical cybersecurity training programme designed to develop skills in security monitoring, threat detection, security incident investigation and incident response.
Overview
Security operations is where most people enter the industry, and it is the clearest route from a technical foundation into a working security role.
This programme builds from networking and operating system fundamentals through to working an alert queue: reading logs, deciding what matters, investigating what does, and writing it up so somebody else can act on it.
The emphasis is on the reasoning behind each step rather than on tool menus. Tools change; the method of forming a hypothesis, testing it against evidence and recording the result does not.
At a glance
- Focus
- Security Operations
- Modules
- 13 proposed modules
- Practical work
- 5 lab exercises, 3 projects
- Prior experience
- No prior security experience assumed
Duration, fees and any form of certification are not published here because they are not yet established. Ask us directly and we will tell you exactly where things stand.
Skills you develop
- Read and correlate logs from hosts, networks and cloud services
- Build and tune detection queries in a SIEM
- Triage an alert queue and judge what deserves escalation
- Investigate an incident from first indicator to root cause
- Map observed behaviour to MITRE ATT&CK techniques
- Apply threat intelligence to active investigations
- Write an incident report a non-specialist can act on
Curriculum
Proposed programme content. Expand a module to see what it covers.
Tools and technologies
Hands-on labs
- Reconstruct an intrusion from host and network logs alone
- Build a SIEM detection rule, then tune it against noisy traffic
- Investigate a suspicious authentication pattern across several systems
- Trace a phishing message from delivery through to endpoint activity
- Map a recorded attack chain to ATT&CK and identify the detection gaps
Projects
Produce a written incident report from a full investigation, including timeline, impact and recommendations
Build a small detection ruleset for a defined environment and justify each rule
Run a shift on a simulated alert queue and document every triage decision
What you can do by the end
- Work a realistic alert queue and justify what you escalated and why
- Investigate an incident and present a defensible timeline
- Write detection logic and explain the trade-off you chose
- Communicate technical findings to a non-technical reader
Roles this prepares you for
These are the kinds of roles the programme is aimed at. PolarSight does not guarantee employment, placement or an interview.
Prerequisites
- Comfort with a command line on either Linux or Windows
- Basic networking knowledge, or willingness to cover it in the opening modules
- No prior security experience assumed
Who this is for
- Students approaching the end of a technical degree
- IT and support staff moving toward a security role
- Anyone who wants defensive security experience rather than theory alone
Want to run SOC Analyst with your batch?
Send us the details and we will reply with a programme outline and what delivery would involve.
AI Security Engineer
A specialized programme focusing on securing AI-powered applications, understanding vulnerabilities in modern AI systems and developing practical AI security skills.
View programme →