Cybersecurity analyst (SOC)
Learn to detect, triage and respond to threats the way a security operations centre does, using AI tools to speed up the work and learning to check what they tell you, in 20 weeks.
Coming soon · planned, not written yet
IT and cybersecurity is one of five fastest-growing skill stacks in IndiaLinkedIn Skills on the Rise 2026 (India)
- 20
- weeks planned
- ~30 h
- a week
- 5
- milestone projects
- 1
- project, grown every week
These are planned figures. The weeks are written after we check the tools against current job postings and official documentation, so the final route may differ.
Built for the AI era
How AI fits this roadmap
AI tools now summarise alerts, suggest queries and draft incident notes for SOC analysts, and security products ship with built-in assistants. That makes the analyst's judgement the valuable part, so this roadmap teaches you to use an AI assistant every week and to verify its answers against the raw logs. You also build an AI-assisted triage helper and test it on labelled alerts, and you learn the risks of putting untrusted log text into a model.
The main project
WatchPost
A home security operations lab that collects logs from your own machines, detects simulated attacks, and uses an AI assistant to help triage alerts while you check every answer.
What you will be able to do
- 01
Read Windows, Linux and network logs and explain what a suspicious event shows, with the log lines as evidence.
- 02
Build a lab SIEM with Wazuh or Elastic Security, and write detection rules in Sigma that you test against attacks you run in your own isolated lab.
- 03
Map each alert to a MITRE ATT&CK technique, triage it, decide true or false positive, and write a clear incident ticket.
- 04
Hunt for threats with queries in a SIEM, including KQL in Microsoft Sentinel, and check every AI-suggested query before you trust it.
- 05
Build and test an AI-assisted alert triage helper, measure where it is wrong, and defend it against prompt injection hidden in log text.
01The route
Five months, one month at a time.
Each month ends in a milestone project, so you always have something to show for the work.
Month 1 · Weeks 1–4
Foundations and AI-assisted analysis
Networking, Linux and Windows basics, how logs are made, and packet reading with Wireshark. You set up an AI assistant, learn to prompt it with log data safely, and check its explanations against the raw lines.
MilestoneA written analysis of a packet capture and a set of logs, with a note on where the AI assistant was right and wrong
Month 2 · Weeks 5–8
Build the lab and the SIEM
An isolated virtual lab with Windows and Linux machines, log collection into Wazuh or Elastic Security, and basic dashboards. You use AI to draft setup steps and parsing rules, then test them.
MilestoneWatchPost running: your lab machines send logs to a working SIEM with dashboards
Month 3 · Weeks 9–12
Detection and ATT&CK
MITRE ATT&CK, detection rules in Sigma and in your SIEM, and network detection with Suricata. You run simulated attacks in your own lab and tune rules to cut false alarms. AI drafts rules, you test them.
MilestoneA rule set mapped to ATT&CK techniques, each rule proven against a lab attack and a clean baseline
Month 4 · Weeks 13–16
Triage, response and hunting
Alert triage, evidence gathering, containment steps, ticket writing and threat hunting with queries. You learn Microsoft Sentinel and KQL, in the Defender portal where Microsoft is moving it, and use AI to suggest hunts that you then verify.
MilestoneThree lab incidents worked end to end, each with a timeline, evidence and a ticket
Month 5 · Weeks 17–20
AI triage helper and career prep
Build an AI-assisted triage helper for WatchPost, test it on labelled alerts, and handle prompt injection in log text. Then a portfolio write-up, certification path choice, interview preparation and applications.
MilestoneA tested AI triage helper with an error report, a portfolio and a working job-search pipeline
03What is inside
Everything a week comes with.
Every week is built the same way, so once you have done one you know how all of them work.
- 01
One project, WatchPost
You grow one home security lab from first logs to a tested AI triage helper, so every tool lands in something real.
- 02
A day-by-day plan
Each week has a Learn part and a Do part, with a checklist so you know when you are done. Most weeks include a task to do with an AI assistant and a step to check its work.
- 03
A project in every milestone
Five milestones, each ending in something you can show and link to.
- 04
Reference topics
Short topic pages with check questions you can come back to.
- 05
A job track
Interview practice, portfolio and resume help, and an application plan.
- 06
Progress in your Study plan
Add weeks to your Study plan, give them dates, and finished days are counted for you.
04Is it for you
Who this is, and is not, for.
Better to know before you start than six weeks in.
It is for you if
- You are comfortable with a computer and basic networking ideas, and want to start a security operations career.
- You are an IT support, system admin or developer moving into security and want to be strong with AI tools.
- You can give about 30 hours a week for five months. The roadmap is built for part-time study.
It is not for you if
- You have never used a command line. Do a beginner computing course first.
- You want a job guarantee. Nobody can promise that, and this roadmap does not.
- You want to attack systems you do not own. Every exercise is lab-only, legal and on machines you set up yourself.
- You want to paste AI answers into an incident ticket without checking them. This roadmap trains you to verify.
?Questions
Before you start
- Is this roadmap ready?
- Not yet. This is the plan. The weeks are being written and checked against current job postings and official documentation. Leave your email and we will write to you when it opens.
- What will it cost?
- The price is not set. Roadmaps are bought once, with no subscription. We will announce it when this one opens.
- Will the plan change?
- It may. Before the weeks are written we check the tools against current job postings, so the lengths and months here are planned, not final.
- Is it safe and legal to practise attacks?
- Only inside a lab you build yourself. The roadmap runs simulated attacks on your own virtual machines, kept off the internet, and never on systems you do not own.
- Will it get me a job?
- It will give you skills and proof of work. It cannot promise a job on a fixed date, because hiring depends on the market, your location and your past work.
Not open yet
Leave your email and we will write once, when it opens.