Security analysis: SOC and incident response
Detect attacks, investigate and respond.
Your running project
Investigate a simulated intrusion
- The need
- Piece together what happened, say what to do, and report it clearly.
- The data
- Public training logs, never a real system's without agreement.
- External tools
- SplunkWazuhMITRE ATT&CK
Workshop
Establish the needs
Who uses it, what problem it solves, how to tell it worked.
What you will learn
- Networks, Linux and Windows from the defence side
- Log reading and SIEM tools
- Investigating and handling an incident
- Writing a clear, useful report
Certifications to aim for at the end
- Entry levelCCNA Cybersecurity (200-201)CiscoFormerly CyberOps Associate; some Cisco pages still show the old name.
- IntermediateMicrosoft Certified: Security Operations Analyst Associate (SC-200)MicrosoftExam available in French.
- IntermediateCompTIA Cybersecurity Analyst (CySA+) V4CompTIAVersion 3 retires on 22 December 2026 in English: prepare for V4.
- AdvancedGIAC Certified Incident Handler (GCIH)GIAC
These certifications are issued by their own bodies, not by Nangmo, and their exams are paid for with them. Checked on 3 November 2026: confirm the language, price and exam location on their site before registering. These exams are generally taken without AI: you will need to read and reason on your own.
How to start a career in this field
- 1Learn networking and Linux, then build a small lab at home.
- 2Practise on defensive training platforms and keep your write-ups.
- 3Take CCNA Cybersecurity or SC-200, depending on the tools employers use in your region.
- 4Apply as a level 1 SOC analyst, at banks, telecoms or security providers.
First jobs to aim for
- Level 1 SOC analyst
- Junior incident response analyst
- Security technician
The workshop is open, but this path's lessons are not online yet. Tell us you are interested: it helps us decide which to write first.