A SOC (Security Operations Centre) analyst watches for attacks, checks alerts and escalates real problems. It is one of the most common first jobs in cybersecurity in India. This roadmap breaks the path into six months of focused work. Go faster or slower; the order matters more than the speed.
Six-month SOC analyst roadmap
Month 1
- Foundations: Windows, Linux, networking, accounts
Month 2
- Logs: Windows events, sign-in logs, firewall logs
Month 3
- SIEM: search, filter and correlate events in a free lab
Month 4
- Incidents: phishing, brute force and malware triage
Month 5
- Portfolio: three written investigations
Month 6
- Interviews: practise answers out loud and apply
Month 1: Foundations
Learn how Windows and Linux handle users, processes and permissions. Learn IP addressing, DNS, common ports and HTTP. Task: draw how a user logs in to a web app, step by step.
Month 2: Read logs
Logs are a SOC analyst's main evidence. Learn Windows process creation events such as event 4688 and what affects whether they are recorded. Read cloud sign-in logs and firewall logs. Task: create a failed login in your lab and find every record it produced.
Month 3: Use a SIEM
A SIEM collects logs in one place so you can search them. Free or trial editions of common SIEM tools are enough to learn. Task: write a search that finds several failed logins followed by a success for the same account.
Month 4: Handle common incidents
Practise triage for the incidents you will see most: phishing reports, password-guessing, suspicious scripts and unusual sign-ins. Learn the incident response lifecycle from NIST SP 800-61. Map alerts to techniques with MITRE ATT&CK.
Month 5: Build a portfolio
Write three short investigations: the alert, the evidence, your decision and what you could not see. This is what you will talk about in interviews.
Month 6: Interview and apply
Practise with the SOC analyst interview questions, the 20 SOC scenario questions and the blue team guide. Learn what to expect in an L1 SOC interview round.
Skills a SOC interviewer checks
Triage
- Verify an alert before acting
Logs
- Know which record proves what
Escalation
- Escalate with evidence and confidence
Notes
- Write clear handover notes
Communication
- Explain reasoning calmly out loud
Common questions
Can I become a SOC analyst without experience? Yes, many people start as L1 analysts. Read how to get your first SOC job with no experience.
Which certification helps most? Compare options in certifications for freshers in India.
Want to check your readiness? Try a free SOC mock interview round.