SOC Analyst: roadmap

#5 in "Web Security" progression
Python
SOC Analyst: roadmap thumbnail

Updated: Aug 21, 2026

In this project

Wanna become a Security Operations Center Analyst (SOC)?

I've prepared a roadmap for you to learn a new profession just in one Guide.

Ready? Let's dive into. 

Learning plan

  1. Short version of full roadmap

  2. 1. Networking

  3. HTTP/HTTPS

  4. OSI / TCP-IP

  5. TCP vs UDP

  6. IP addressing / subnetting

  7. ARP

  8. DNS

  9. DHCP

  10. TLS basics

  11. SSH

  12. SMTP

  13. FTP/SFTP

  14. SMB

  15. LDAP

  16. Kerberos

  17. ICMP

  18. NAT

  19. VPN

  20. proxies

  21. firewalls

  22. Ports and protocols

  23. Routing basics

  24. VLANs

  25. IPv4/IPv6 basics

  26. Packet capture

  27. TCP handshake

  28. DNS queries

  29. HTTP requests

  30. Suspicious connections

  31. Port scanning

  32. C2 traffic

  33. Beaconing

  34. Lateral movement

  35. Wireshark

  36. 2. Linux

  37. Linux filesystem

  38. Linux permissions

  39. Linux users/groups

  40. Linux processes

  41. Linux services

  42. Linux systemd

  43. Linux SSH

  44. Linux cron

  45. Linux environment variables

  46. Linux networking commands

  47. Linux package management

  48. Linux logs

  49. Linux shell/Bash

  50. 3. Windows

  51. Windows architecture

  52. Windows users/groups

  53. Linux services

  54. Linux processes

  55. Windows registry

  56. Windows scheduled tasks

  57. Windows PowerShell

  58. Windows networking

  59. Active Directory basics

  60. Group Policy

  61. Authentication

  62. Kerberos

  63. NTLM

  64. Windows Event Logs

  65. 4. Cybersecurity fundamentals

  66. CIA triad

  67. Authentication vs authorization

  68. Least privilege principle

  69. Defense in depth

  70. Encryption

  71. Hashing

  72. Digital signatures

  73. Certificates

  74. PKI

  75. MFA

  76. Access control

  77. Vulnerabilities

  78. Exploits

  79. Malware

  80. Phishing

  81. Ransomware

  82. Brute force

  83. Credential attacks

  84. Privilege escalation

  85. Persistence

  86. Lateral movement

  87. Сommand & control

  88. Data exfiltration

  89. MITRE ATT&CK

  90. Logs — this is where SOC really starts

  91. 5. SIEM

  92. Microsoft Sentinel

  93. Splunk

  94. Elastic Security

  95. Microsoft Sentinel + Splunk/Elastic concepts

  96. 6. Detection engineering

  97. 7. Incident Response

  98. 8. Threat Intelligence

  99. 9. EDR/XDR

  100. 10. Malware analysis — but only the SOC level

  101. 11. Cloud security

  102. 12. Automation / scripting

  103. 13. Vulnerability management

  104. 14. Basic offensive security

  105. 15. SOC operations

  106. 16. Threat hunting

  107. 17. Professional communication

SOC Analyst: roadmap