Block 0
FreeYour first shift
Work an analyst's shift in a simulated SOC before studying anything.
- A day as a SOC analystFree
≈ 1.5 h · Split-screen simulated SOC
Career track
Become a SOC Analyst
From zero to your first SOC job: triage alerts, investigate with SIEM and EDR, analyse phishing and read Windows, Linux, network and web logs. With real cases for your portfolio.
Courses
21
Hours
≈ 41
Blocks
10
Junior salary
£27,000 – £36,000/yr
Indicative base salary for a junior SOC analyst in the UK. Source: Payscale, Junior SOC Analyst salary in the UK
Lab tools you will use
SplunkElastic / KibanaWiresharkSysmonSnortMITRE ATT&CKSplunkElastic / KibanaWiresharkSysmonSnortMITRE ATT&CK
VirusTotalCyberChefYARAEDRLinuxPowerShellVirusTotalCyberChefYARAEDRLinuxPowerShell
01 / The role
What an L1 SOC analyst does
The first line of defence of a company: they work in the SOC, often in shifts, and decide which alerts are a real attack. It's the role most people use to enter the industry, and from there you move up to L2, L3, engineering, incident response or leading the SOC.
- Work the alert queue and decide which alerts are real
- Investigate with SIEM, EDR and Windows, Linux, network and web logs
- Analyse phishing emails reported by users
- Enrich IPs, domains and hashes without tipping off the attacker
- Escalate to L2 with a ticket that doesn't bounce back
02 / Is it for you?
It fits you if…
No prior experience needed: how you work matters more than what you already know. If most of these sound like you, the track is for you.
- You're curious about how things work
- You stay calm when something goes wrong
- You like solving, not just reading
- You write clearly what you've checked
- You're fine learning something new every month
03 / How you practise
Real consoles, in your browser
Every task ends with something to do: an alert queue, a SIEM, a network capture or a Linux terminal. Nothing to install.
https://soc.acme-corp.example/alerts
| Time | Severity | Message | Copy |
|---|---|---|---|
| 16-oct · 19:18 | Critical | Successful SSH login from the suspicious IP 203.0.113.45 | |
| 16-oct · 19:14 | Critical | Unauthorised login attempts from 203.0.113.45 to port 22 | |
| 16-oct · 18:28 | Low | User Juan Díaz logged in to LPT-JDIAZ after 3 failed attempts | |
| 16-oct · 17:18 | Medium | Multiple failed logins from the “IT Automation” service account | |
| 16-oct · 17:08 | Low | Logon error: the “IT Automation” password has expired |
Alerts by category
- Intrusion35%
- Phishing30%
- Malware20%
- Anomaly15%
Logins by country
- Spain60
- Mexico30
- Argentina21
- Colombia17
- Portugal15
- Unknown4
Try it right here: it is the same interface you use in the courses. Working the full scenarios needs a free account.
04 / Roadmap
The path, course by course
You start for free. Each block ends with a review and a badge; complete the required courses and you get the track certificate.
Block 1
FreeFoundations
The security, networking and Linux basics you need to understand an alert.
- Introduction to CybersecurityFree
≈ 4.5 h · Practices and in-browser Linux terminal
- Networking for analystsFree
≈ 5.5 h · In-browser Wireshark
- Linux for analystsHTK Pro
≈ 1 h · Real Linux terminal in the browser
- Python for cybersecurityFreeOptional
≈ 5 h · Python that runs in the browser
Block 2
FreeSOC method
How an alert is worked end to end and the consoles you'll spend your day in.
- SOC Analyst: your first shiftFree
≈ 6 h · Alert console, SIEM and phishing inbox
- L1 triage and reportingHTK Pro
≈ 1 h · Full shift in the simulator
- SIEM, EDR and SOARHTK Pro
≈ 1 h · Simulated SIEM and EDR
Block 3
FreeDetecting on the endpoint
Windows and Linux: what an intruder leaves on the machines you monitor.
- Windows for the SOCFree
≈ 1 h · Simulated event viewer
- Linux for the SOCHTK Pro
≈ 1 h · Real Linux terminal in the browser
- Windows Malware — BeginnerHTK UltimateProfessional courseOptional
≈ 14 h · Real machine lab
View the professional course
Block 4
FreeDetecting on the network and web
Scans, exfiltration and web attacks, even when traffic is encrypted.
- Network detectionFree
≈ 1 h · Wireshark, Snort and conn.log
- Web monitoringHTK Pro
≈ 1 h · Real logs in a Linux terminal
Block 5
HTK ProEmail and intelligence
Where most incidents start and how to enrich every indicator without putting yourself at risk.
- Phishing & OSINT — BeginnerHTK UltimateProfessional course
≈ 9 h · Real machine lab
View the professional course - Phishing & OSINT — IntermediateHTK UltimateProfessional courseOptional
≈ 15 h · Real machine lab
View the professional course - Malware and threat intelligence for L1HTK Pro
≈ 1 h · Simulated VirusTotal and urlscan
Block 6
FreeThink like a defender
Organise what you've seen with the industry frameworks and write your own detections.
- Pyramid of Pain, Kill Chain and MITRE ATT&CKFree
≈ 1.5 h · Challenge: climb the pyramid
- Your first detection with SigmaHTK Pro
≈ 1 h · Write and tune a rule against real data
Block 7
HTK ProThe augmented analyst
AI as a working tool and as a new attack surface.
- AI for the SOC analystHTK Pro
≈ 1 h · Review a copilot that gets it wrong
Block 8
HTK ProCapstone cases
Complete incidents end to end. Each leaves a report for your portfolio.
- Complete investigationsHTK Pro
≈ 2 h · Simulator (Pro) and real machine (Ultimate)
Block 9
HTK ProYour first job
From certificate to interview: CV, LinkedIn, typical questions and the market.
- Land your first SOC jobHTK Pro
≈ 0.5 h
FreeHTK ProHTK Ultimate
05 / Access
Choose how to take the track
Free
To start from zero
0 €
- The free courses, with every lesson in writing
- The first video in each module
- Module exams, with unlimited attempts
- The first practice in each module and the first lab in each course
- Daily streak with rewards
3 months free with yearly
HTK Pro
To complete the track
€14.99€11.24/mo
€134.91 a year, in one payment
🔒 Secure payment · Cancel anytime
Everything in Free, plus…
- Every new career-track course
- Video lessons with visual demos: watch it done before you do it
- Every practice and in-browser lab
- Capstone cases in the simulator
- The real-machine lab of the free courses
- An instructor grades your final assignment: certificate for each course and the track
- Guide to landing your first job
HTK Ultimate
To go beyond the track
€34.99€26.24/mo
€314.91 a year, in one payment
🔒 Secure payment · Cancel anytime
Everything in Pro, plus…
- Full professional courses, Beginner and Intermediate: Windows Malware and Phishing with OSINT
- Guided labs on a real, isolated machine, with unlimited resets
- Capstone cases on a real machine
- Module exams and HTK certificates for each level
- An instructor personally reviews your reports and practicals
- Private Discord community and direct instructor support
06 / Myths
What you don't need to get started
01
“I need a degree”
It helps, but many SOCs hire L1s for what they can do. A hands-on track and a portfolio of cases carry weight in the interview.
02
“I need expensive certifications”
Some job ads ask for them, not all. First, be able to triage an alert and write a good ticket; certifications come easier after that.
03
“It's too hard to learn alone”
That's why the track goes in order, with practice in every task and free hints. You don't progress by reading: you progress by solving.
07 / When you finish
What you take to the interview
Verifiable certificate
When you finish the track, a certificate with a code any employer can check on the site.
Case portfolio
An incident report for every capstone case, ready to show in an interview.
First-job guide
The market, a CV without experience, L1 interview questions and your first 90 days.
? Questions answered
Career track Frequently Asked Questions
What people usually ask before starting the track.
About 41 hours for the required courses. At an hour a day, five days a week, about 8 weeks.
No. The track starts from zero and the first courses are free. All you need is a computer and a browser.
No, and be wary of anyone who promises that. It gives you what's expected of an L1, a portfolio of cases and a guide to finding your first role.
Yes: when you complete the required courses you get the track certificate, publicly verifiable. A practical exam will come later.
HTK Pro covers the whole track. HTK Ultimate adds the professional courses (Phishing & OSINT, Windows Malware) with real-machine labs.
Your first shift starts today
Start with the free courses and unlock the rest with HTK Pro whenever you want.
Create a free account