Step 1 — Choose the role you’re aiming for

Watches a company's security alerts in a Security Operations Center (SOC), spotting and triaging attacks as they happen.

A day in the life, the workflow, and the tool ecosystem.

A day in the life — read these first

What to look for: notice the recurring tasks, the tools mentioned by name, and the frustrations people vent about — that is the real texture of the job.

Tool ecosystem map

Tier 1 — daily (must-know)

SplunkSIEMCollects and searches mountains of logs so you can spot attacks.FREE
WazuhSIEM / XDRFree, open-source platform that watches endpoints and raises alerts.FREE
Security OnionNetwork monitoringA free Linux distro that bundles intrusion detection and log tools.FREE

Tier 2 — weekly/situational

TheHiveCase managementTracks security incidents like support tickets for attacks.FREE
VirusTotalFile/URL analysisChecks a suspicious file or link against dozens of antivirus engines.FREE
WiresharkPacket analysisShows the raw network traffic so you can see exactly what was sent.FREE

Tier 3 — awareness only

MITRE ATT&CKThreat frameworkA free catalog of the techniques attackers use, by stage.FREE
MISPThreat intelligenceShares 'indicators of compromise' between defenders.FREE
Preparing your immersion briefing…

Start networking from day one