Most people “learn SOC” by consuming content.
They binge YouTube. Save threads. Bookmark tools.
Then they apply to jobs and get hit with the same wall:
“Cool… but what have you actually built?”
This newsletter is a blueprint to fix that.
If you work through the steps below, you’ll end up with something most candidates never have:
a detection + response lab you can demo
threat hunting reps with real artifacts
an automation portfolio (not just “I used a SIEM”)
DFIR projects with writeups that prove skill
Everything here is free. The only cost is effort.
Part 1: Detection and Response (The core SOC skill)
Detection and Response is the foundation. If you can’t reliably detect and respond to common attacker behaviors, nothing else matters.
Learn the concepts first (fast, not perfect)
Start with the CISA Incident Response playbook series. It’s practical, structured, and gives you the “how professionals do it” baseline.
Concept: CISA IR playbook series
https://www.youtube.com/watch?v=gWXgChC9ANg&list=PLjlGL4cu_NaOvqG0_xkDxtjcuJakxv7W-&index=1
Then build the lab (this is where the real learning happens)
Your goal is simple:
generate attacker activity → detect it → identify gaps → write detections → document it
Use this guide to build the “advanced lab”:
https://bluecapesecurity.com/build-your-lab/
Install Wazuh (EDR + SIEM):
https://www.youtube.com/watch?v=OG8V2O-j9FE
Trigger attacker behaviors using Atomic Red Team:
https://www.atomicredteam.io/invoke-atomicredteam/docs
What you should do in the lab
Run Atomic Red Team tests on your endpoint
Watch what your telemetry captures
Ask: did any attacks go undetected?
Create 1–3 custom detections
Write up what you did in a blog post:
what you deployed
what you tested
what you detected
what you missed
how you tuned it
That blog post becomes a portfolio artifact.
Part 2: Threat Hunting and Threat Intelligence (The step up)
A lot of people think threat hunting is “searching logs.”
It’s not.
Threat hunting is hypothesis-driven investigation:
“If an attacker did X, I should see Y”
then you prove or disprove it with telemetry
Concepts
Threat hunting techniques overview:
https://heimdalsecurity.com/blog/threat-hunting-techniques/
Lab (home threat hunting that actually works)
Set up a lab, generate artifacts, and hunt for those artifacts.
This Graylog guide walks you through it end-to-end:
https://graylog.org/post/creating-a-threat-hunting-lab-in-graylog/
How to approach the lab like a real hunter
Generate artifacts (simulate behavior)
Form a hypothesis
Hunt for evidence in your logs
Record your findings:
what you expected to find
what you found
what you didn’t find
what data source would’ve helped
what detection you’d add next
If you can explain your hunting logic clearly, you’re already ahead of most applicants.
Part 3: SOC Automation (How you scale without burning out)
Most SOC teams fail because they rely on humans to do repetitive tasks:
enrichment
context gathering
evidence collection
routing
standard response actions
That doesn’t scale.
SOC automation is how you reduce noise and speed up response without lowering quality.
Concepts
SOC automation overview:
https://www.wiz.io/academy/detection-and-response/soc-automation
Lab playlist
Good playlist for SOC automation:
https://www.youtube.com/watch?v=Lb_ukgtYK_U&list=PL6S-Iz_1t9tU_UeQaiNKdbepaVhb2-74Z
Part 2 on using AI in the SOC (same playlist link):
https://www.youtube.com/watch?v=Lb_ukgtYK_U&list=PL6S-Iz_1t9tU_UeQaiNKdbepaVhb2-74Z
Your automation challenge (portfolio-worthy)
Pick one workflow and automate it end-to-end, for example:
alert enrichment (IP, domain, hash, user context)
auto-open a case with evidence attached
auto-run a containment step in a safe lab environment
auto-summarize incidents for handoff
Then document:
what the inputs were
what your automation did
what the output looked like
time saved
failure modes
Hiring managers love automation because it signals you can scale operations.
Part 4: Forensics (How you stop guessing)
Forensics is how you go from:
“I think that’s suspicious”
to
“I can prove what happened.”
It teaches you:
what executed
when it executed
what it touched
what persisted
what data moved
Concepts
Free intro DFIR course:
https://www.youtube.com/watch?v=giv0DQDSsjQ&list=PLJu2iQtpGvv-2LtysuTTka7dHt9GKUbxD
Labs
Playlist with 24 different lab setups:
https://www.youtube.com/watch?v=jJqo2WnGpNo&list=PLsZo7Kc8eS0MFDk5AitdWYJ0LFAkw21nf
What to produce
Do 3 labs, then write 3 mini case studies:
evidence collected
timeline
conclusion
what you’d do next in a real incident
These writeups become proof you can do DFIR work, not just talk about it.
The “SOC Skills Ladder” (Do it in this order)
If you take nothing else from this newsletter, take this:
Detection and Response
Threat Hunting / Threat Intelligence
SOC Automation
Forensics
This order matters because each level builds on the previous one.
Your next step (simple, not easy)
If you want to move fast:
Start with the detection lab this week
Run Atomic Red Team tests
Identify one detection gap
Write one custom detection
Publish one writeup
That one project can change your interview outcomes.