Video summary

From Zero to SOC Analyst: Complete Roadmap (2026)

Main summary

Key takeaways

Educational

Main Ideas / Lessons

  • Don’t just “chase SOC” immediately: many beginners get stuck in endless advice and certifications without becoming job-ready. The video argues for a step-by-step roadmap from zero experience to SOC readiness.
  • Foundations come first: build IT, then networking, then security fundamentals before tools/SOC workflows make sense.
  • Networking is the “language” behind detections: without networking knowledge, you can’t confidently investigate suspicious connections.
  • AI is becoming part of SOC work: candidates who can use AI correctly (prompting, verifying outputs, catching errors) will stand out.
  • Certifications help with screening but don’t replace practice: prefer targeted certs, and prioritize projects and hands-on labs to win interviews.
  • Portfolio projects are a differentiator: build multiple projects that prove you understand real workflows (AD, automation, SOAR/response).
  • Paid SOC training can help only after foundations: if you’re brand new to IT, start with free fundamentals first; only then consider the paid accelerator.

Roadmap (Structured Phases)

Phase 1: IT Fundamentals (Before Cybersecurity)

Core Lesson

SOC analysts investigate operating systems, networks, applications, and endpoints. Without IT basics, you won’t know how to tell what’s wrong.

Free Resources Recommended

  • TCM Security
    • Free practical help desk course (help desk technician basics)
    • Free Linux 100 fundamentals (SOC analysts often handle Linux)
  • KevTech (YouTube)
    • Focused content on Active Directory and Windows Server Administration
  • Professor Messer (YouTube)
    • Free CompTIA A+ course (hardware/OS/troubleshooting; exam optional)

Phase 2: Networking Fundamentals

Core Lesson

Networking knowledge is required to understand/interpret connections and investigate suspicious activity.

Free Resources Recommended

  • Professor Messer (YouTube)
    • Free Network+ course (OSI model, TCP/IP, routing, switching, fundamentals)

Hands-on Practice Options (Both Free)

  • GNS3: network emulator for building virtual networks and configuring devices
  • Packet Tracer (Cisco): similar emulation/training tool

Suggested Choice Order

  • Start with Packet Tracer (easier to begin)
  • Move to GNS3 later (more powerful)

Phase 3: Security Fundamentals (Core Concepts for Everything Else)

Core Concepts Called Out

  • CIA triad
  • Threat actors
  • Attack types
  • Defense in depth (These show up constantly in security conversations and underpin later learning.)

Free Resources Recommended

  • Professor Messer (YouTube)
    • Free Security+ course (study notes available on his site)
  • TCM Security
    • Free Practical Security Fundamentals course

Recommendation: do both Security+ and Practical Security Fundamentals.

Phase 4: SOC Tools and Workflows (What You’ll Use on the Job)

SIEM (Example: Microsoft Sentinel)

  • Microsoft SC-200 learning track on Microsoft Learn (free)
    • Covers Microsoft Sentinel, KQL, and Defender

Splunk

  • Mentions Cisco’s free career path on their education portal:
    • Cybersecurity Defense Analyst path (basics)

Blue Team / SOC Analysis Workflow Content

  • Security Blue Team
    • Free introductory training content on Blue Team work
  • Also mentioned: the creator’s channel includes walkthroughs and investigation workflows, including:
    • Sentinel, Splunk, Kaseya 7, KQL, and “real investigation workflows”

Phase 5: AI for SOC Analysts (To Stand Out)

Core Lesson

AI is being integrated into SOC workflows; learning to use AI effectively helps you outperform other candidates.

Free AI Resources Recommended

  • TCM Security: AI Fundamentals course
  • Anthropic: free courses on prompting and using AI effectively
  • Microsoft: AI-901 certification track on Microsoft Learn (AI fundamentals path)

What You Must Learn (Practical Expectations)

  • How to write good prompts
  • How to recognize when AI output is wrong
  • How to verify AI results

Project Recommendation

  • A channel project: SOC automation project 2.0
    • Integrates OpenAI directly into a SOC workflow
    • Suggested for portfolio value

Phase 6: Certifications (What to Target and in What Order)

Key Guidance

Be honest about the market: certs can help with resume screening, but hands-on experience/portfolio gets you hired.

  • Avoid collecting many random certs hoping one lands a role.

Recommended Cert Path

  1. CompTIA Security+
    • Signals foundational knowledge to hiring managers
  2. Microsoft SC-200
    • Signals knowledge of the Microsoft security stack (common in SOCs)
  3. Optional/conditional: CompTIA CySA+
    • Mentioned as appearing more often in SOC job postings

Explicit “Don’t Do”

  • Don’t aim for 10 random certifications immediately.

Phase 7: Projects (Major Interview Differentiator)

Core Lesson

Projects are one of the biggest differences between candidates who get interviews vs. those ignored.

Three Recommended Projects (Detailed Build Instructions)

  1. Active Directory (AD) Project

    • Spin up a domain controller
    • Create users
    • Configure group policies
    • Attack it
    • Purpose: learn what Windows environments look like and what suspicious activity looks like inside them.

  2. SOC Automation Project

    • Build a small environment with:
      • a SIM
      • an EDR
      • an alerting pipeline
    • Use tools with free options such as Wazuh, Sentinel, Splunk
    • Generate attacks
    • Verify they get detected
    • Document what happened (detections, findings, outcomes)

  3. SOAR + EDR Project

    • Build a small workflow that:
      • Takes an alert from your EDR
      • Enriches it with threat intelligence
      • Then either:
        • Auto-contains, or
        • Escalates based on the enriched data
    • Purpose: demonstrates understanding of the SOC workflow.

Documentation Requirements (Strong Emphasis)

  • Document everything:
    • Take screenshots
    • Write up findings
    • Publish to GitHub or LinkedIn
  • This becomes “proof of work.”

Phase 8: Hands-on Labs (Simulate Real SOC Work)

Free Lab Resources Recommended

  • TryHackMe
  • Hack The Box
  • Cyber Defenders
  • Security Blue Team
  • Malware Traffic Analysis

Goal Expectation

If you complete even “half” of these, you’ll be in a better position than the average entry-level SOC candidate.

Paid Option (My D4 Forge) — Only After Foundations

Important Condition

If you’re completely new to IT and haven’t built foundations, the first step is not the forge. Start with IT/networking/security fundamentals using the free resources.

What the Paid Community/Program Offers

  • Structured 90-day SOC accelerator
    • Step-by-step: alert triage, investigations, documentation
  • A deeper course beyond typical entry-level training
  • Access to a SOC simulator
    • Simulated clients including Splunk, Microsoft Sentinel, Defender XDR
    • Monthly Capture The Flag (CTF) events
  • Community support from other aspiring SOC analysts

Why This Paid Approach Is Framed as Valuable

  • Working with real alerts on enterprise tools is the real test of readiness.
  • It provides safe practice so mistakes can be learned from before a real SOC.

Sources / Speakers Featured (As Named in the Subtitles)

  • Steven (video creator; cybersecurity professional working in security operations for 10+ years)
  • TCM Security
  • KevTech (YouTube)
  • Professor Messer
  • Anthropic
  • Microsoft (Microsoft Learn, AI-901, SC-200, Defender XDR, Sentinel)
  • Cisco (Packet Tracer; Cisco education portal career path)
  • Security Blue Team
  • OpenAI (referenced for SOC automation project using OpenAI integration)
  • Wazuh
  • Splunk
  • GNS3
  • Packet Tracer
  • TryHackMe
  • Hack The Box
  • Cyber Defenders
  • Malware Traffic Analysis
  • GitHub
  • LinkedIn

Original video