Five-stage roadmap
Security Operations (SOC & Incident Response)
You do not need to collect next-stage tools before you are ready. Sequence does not slow you down; it removes random detours.
- 1 · FoundationBuild the vocabulary and problem-solving habits the rest of the path assumes.
- 2 · CoreLearn the concepts that make this career distinct from simply writing code.
- 3 · PracticalMeet the inconvenient parts tutorials often skip: setup, failure, feedback and deployment.
- 4 · Professional EngineeringMake your work readable, testable, reviewable and safe for another person to depend on.
- 5 · Later / SpecializationChoose depth because a real project or question now demands it—not because a roadmap poster had empty boxes.
Roadmap stage
1 · Foundation
Build the vocabulary and problem-solving habits the rest of the path assumes.
What to learn
- Networking, DNS, HTTP, operating systems and identity basics.
- Linux/Windows logs, timestamps, processes and a little scripting.
- Authorization, privacy, evidence handling and incident terminology.
Enough for now
You can explain the source and limits of an event, normalize time and protect sensitive evidence before drawing a conclusion.
Practical task
Draw how one fictional login event travels from an application through collection and storage to an analyst. Mark timestamps, identities, trust boundaries and missing context.
Roadmap stage
2 · Core
Learn the concepts that make this career distinct from simply writing code.
What to learn
- Telemetry sources, log queries, baselines and alert triage.
- Hypothesis testing, timelines, severity and escalation.
- Incident response, detection logic and ATT&CK as a map—not a checklist.
Enough for now
You can explain the main trade-offs and solve a bounded problem without a recipe.
Practical task
Rebuild a familiar exercise with one changed constraint and document your reasoning.
Roadmap stage
3 · Practical
Meet the inconvenient parts tutorials often skip: setup, failure, feedback and deployment.
What to learn
- Triage a harmless fictional authentication-log alert.
- Build an evidence timeline and separate facts from hypotheses.
- Write one detection query, test benign cases and produce an escalation note.
Enough for now
You have one small, working artifact and can demonstrate a failure you found and fixed.
Practical task
Complete the linked career experiment, then improve it after one deliberate failure or review.
Roadmap stage
4 · Professional Engineering
Make your work readable, testable, reviewable and safe for another person to depend on.
What to learn
- Repeatable triage, evidence timelines, confidence and escalation boundaries.
- Detection-as-code review, benign test cases and false-positive learning.
- Privacy-aware records, incident communication, containment approval and handover.
Enough for now
Another analyst can reproduce your triage, distinguish evidence from hypotheses and know when to close, escalate or ask for authority.
Practical task
Turn a fictional alert into a reviewed mini-playbook: evidence sources, query, two benign cases, severity conditions, escalation owner, safe containment options and closure criteria.
Roadmap stage
5 · Later / Specialization
Choose depth because a real project or question now demands it—not because a roadmap poster had empty boxes.
What to learn
- Detection engineering, threat hunting and threat intelligence.
- Cloud, identity, endpoint and network-specialized operations.
- Incident command, malware analysis and digital forensics with appropriate supervision.
Enough for now
Choose one depth area, state why it matters now and produce one evidence-backed result.
Practical task
Write a one-page depth plan tied to a real system, research question or role requirement.
From skills to a destination
Where could you take this?
The career roadmap explains what to learn. A goal guide helps you put those skills to work. Start with one—not every route at once.
You read the roadmap—now gather evidence