This is the working course for a security operations analyst. It teaches what the job actually involves: understanding the telemetry a SOC runs on, writing and tuning detections, triaging alerts under pressure, hunting for what the alerts missed, responding to incidents with a method, and reporting so that leadership acts. The topics align to the knowledge domains CySA+ covers, so it serves as preparation, but every lesson is built around the role rather than the exam. Each lesson ends with an action step that builds a home lab, a detection library or a portfolio artefact.

For help-desk and network staff moving into security, junior analysts formalising what they know, and anyone preparing for CySA+ who wants the practice behind the objectives.

Modules

The SOC and the Analyst

Lessons

• How a Security Operations Centre Works Preview
• The Analyst’s Mindset and Method
• Adversary Behaviour and the Kill Chain

Telemetry and Tooling

Lessons

• Endpoint Telemetry
• Network and Cloud Telemetry
• The Analyst Platform: SIEM, EDR and Beyond

Detection and Triage

Lessons

• How Detections Are Built and Tuned
• Alert Triage Under Pressure
• Vulnerability Management from the Analyst’s Seat

Investigation and Threat Hunting

Lessons

• Investigating an Endpoint Compromise
• Investigating Identity and Cloud Incidents
• Threat Hunting

Incident Response

Lessons

• The Incident Response Lifecycle
• Containment and Eradication
• Recovery, Lessons Learned and Detection Improvement

Reporting and the Career

Lessons

• Writing Incident Reports and Briefings
• Metrics, Improvement and Threat Intelligence
• Preparing for CySA+ and the Analyst Career