Skip to content

INTEGRATION-GUIDE.md

Latest commit

 

History

History
478 lines (352 loc) · 18.3 KB

INTEGRATION-GUIDE.md

File metadata and controls

478 lines (352 loc) · 18.3 KB
Raw

🎯 Complete SOC Analyst Training Integration Guide

What You Now Have: The Full Picture

You've been given a complete, industry-leading SOC analyst training program that bridges two critical eras:

  1. Foundation (2023-2024): Manual investigation, SIEM mastery, detection engineering
  2. Future-State (2026+): Automation-first, agentic AI, cloud-native security

Your Training Library (Overview)

Core Roadmaps

Document Purpose Focus
SOC-Analyst-Roadmap.md Original master plan 6 foundational projects (beginner → advanced)
2026-Automation-First-Roadmap.md Future-state vision AI/automation layer, emerging tech, new roles
QUICK-START-GUIDE.md Action-oriented start Week 1 plan, platform setup, career paths

Project Templates (18 Total)

🟢 Foundation Projects (1-6) — Manual Skills

  1. Live SOC Monitoring (LetsDefend) — Alert triage, pattern recognition
  2. Phishing Analysis (CyberDefenders) — Email forensics, IOC extraction
  3. Incident Response (TryHackMe) — SIEM investigation, SPL/KQL
  4. Ransomware Forensics (CyberDefenders) — Memory/PCAP analysis, timeline reconstruction
  5. Threat Hunting (TryHackMe) — Hypothesis-driven hunting, detection rules
  6. Detection Engineering (Home Lab) — SIEM rule creation, Sigma, GitHub publication

🟡 Automation & Orchestration (7-8) — 2026 Skills

  1. Automated Phishing Responder (Wazuh+Shuffle+TheHive) — SOAR orchestration
  2. Serverless Security (AWS Lambda/Azure Functions) — Cloud-native, FaaS security

🔵 AI & Emerging Tech (9-10) — Future-Proofing

  1. AI-Assisted Threat Hunting (Jupyter+AI agents) — Human-agent collaboration
  2. Post-Quantum Cryptography — PQC readiness, crypto inventory

🔴 Offensive-Defensive Mastery (11-14) — Advanced

  1. AD Attack & Defense Lab (BloodHound+Impacket) — Kerberoasting, DCSync, Golden Ticket + detection
  2. Cloud Security Investigation (AWS+Azure+Prowler) — CloudTrail forensics, Sentinel KQL, PIM abuse
  3. Purple Team Exercise (ATT&CK Navigator+Atomic Red Team) — APT emulation, full kill chain
  4. Malware Reverse Engineering (FlareVM+Any.Run+Wireshark) — Static/dynamic analysis, YARA rules

🔥 AI Security Automation (15-18) — n8n Workflows

  1. AI Firewall Rulebase Audit (n8n+Palo Alto+AI Agent) — Automated audit, HTML reporting
  2. AI Incident Response Pipeline (n8n+Wazuh+VT+AbuseIPDB) — SOAR pipeline, AI triage
  3. Automated Malware Analysis (Wazuh+n8n+ANY.RUN) — Sandbox API, IOC extraction
  4. SOC Enrichment Micro-SOAR (n8n+VT+urlscan+WHOIS+Shodan) — Parallel enrichment, confidence scoring

How to Use This Material: 3 Strategic Approaches

Path A: "Fast Track to Employment" (10-12 weeks)

Goal: Entry-level SOC Analyst Tier-1 job ASAP

Projects to Complete:

  • ✅ Project 1: Live SOC Monitoring (3 weeks)
  • ✅ Project 2: Phishing Analysis (2 weeks)
  • ✅ Project 3: Incident Response (3 weeks)
  • ✅ Project 7: Automated Phishing Responder (3 weeks)

Why this combination:

  • Projects 1-3 = Prove manual investigation skills (mandatory baseline)
  • Project 7 = Stand out with automation experience (top 5% of candidates)

Resume Impact: 9-12 strong bullets
Portfolio: 4 detailed project write-ups + 1 SOAR workflow
Job Readiness: Week 10-12 → Start applications

Path B: "Complete SOC Professional" (16-20 weeks)

Goal: Tier-2 SOC Analyst / Detection Engineer roles

Projects to Complete:

  • ✅ All Foundation Projects (1-6) - 12-16 weeks
  • ✅ Project 7: SOAR Automation - 3 weeks
  • ✅ Optional: Project 8 or 9 - 2 weeks

Why this combination:

  • Comprehensive skill coverage (monitoring → hunting → detection → automation)
  • Demonstrates depth (forensics, SIEM mastery) + breadth (automation, cloud)

Resume Impact: 15-18 bullets
Portfolio: 7-8 projects, GitHub detection rules, SOAR workflows
Job Readiness: Week 16-20 → Target mid-level roles

Path C: "Automation-First Future Leader" (20-28 weeks)

Goal: AI SOC Engineer / Tier 4 Orchestrator / Detection Engineering roles

Projects to Complete:

  • ✅ All Foundation + Automation + AI Projects (1-10)
  • ✅ Emphasis on Projects 7-10 (automation, AI, emerging tech)
  • ✅ Contribute to open-source (Sigma HQ, SOAR playbooks)
  • ✅ Obtain 1-2 certifications (SEC545, AI-102)

Why this combination:

  • Full-stack SOC expertise (foundation + cutting-edge)
  • Proven ability to architect autonomous defense
  • Community contributions (GitHub stars, Sigma rules)

Resume Impact: 20+ bullets
Portfolio: Complete project suite, certifications, publications
Job Readiness: Week 20+ → Target specialized/senior roles

Path D: "Elite Security Leader" (28-40 weeks)

Goal: Security Architect / Senior Security Engineer / Staff SecEng

Projects to Complete:

  • ✅ All 18 Projects (1-18)
  • ✅ Offensive-Defensive Mastery (11-14): AD attacks, cloud forensics, purple team, malware RE
  • ✅ AI Security Automation (15-18): n8n pipelines, SOAR, sandbox automation, enrichment APIs
  • ✅ Certifications: OSCP/GPEN + cloud certs

Why this combination:

  • Attack + defend + automate — the complete security professional
  • n8n automation pipelines prove production-level engineering skills
  • Purple team + malware RE demonstrates deep adversary understanding

Resume Impact: 54+ bullets
Portfolio: AD attack lab, APT emulation reports, n8n workflows, enrichment APIs, YARA rules
Job Readiness: Week 28+ → Target senior/architect roles

Integration: How Projects Build on Each Other

Skill Progression Map

Week 1-3: Project 1 (SOC Monitoring)
  ↓ Learn: Alert triage, log analysis basics
  ↓
Week 4-6: Project 2 (Phishing Analysis)
  ↓ Build on: IOC extraction, report writing
  ↓ Add: Email forensics, threat intelligence
  ↓
Week 7-10: Project 3 (Incident Response)
  ↓ Build on: Log analysis → Advanced SIEM queries
  ↓ Add: Multi-source correlation, MITRE ATT&CK
  ↓
Week 11-13: Project 4 (Ransomware Forensics)
  ↓ Build on: Investigation skills → Deep forensics
  ↓ Add: Memory analysis, PCAP, timeline reconstruction
  ↓
Week 14-17: Project 5 (Threat Hunting)
  ↓ Build on: SIEM mastery → Proactive detection
  ↓ Add: Hypothesis-driven hunting, behavioral analytics
  ↓
Week 18-21: Project 6 (Detection Engineering)
  ↓ Build on: Hunting findings → Formalize detections
  ↓ Add: Sigma rules, testing frameworks, GitHub publication
  ↓
Week 22-24: Project 7 (SOAR Automation) ⭐ KEY TRANSITION
  ↓ Transform: Manual execution → Automated orchestration
  ↓ Add: API integration, workflow design, human-in-the-loop
  ↓
Week 25-27: Projects 8-10 (Cloud, AI, Emerging Tech)
  ↓ Future-proof: 2026+ readiness
  ↓ Add: Cloud-native, AI agents, PQC
  ↓
Week 28-32: Projects 11-14 (Offensive-Defensive Mastery)
  ↓ Level-up: Attack simulation + detection engineering
  ↓ Add: AD attacks, cloud forensics, purple team, malware RE
  ↓
Week 33-40: Projects 15-18 (AI Security Automation)
  ↓ Automate: n8n pipelines, sandbox, enrichment APIs
  ↓ Add: AI auditing, SOAR orchestration, confidence scoring
  ↓
Week 40+: Senior Roles & Continuous Learning

Key Insight: Each project compounds your skills. Don't skip the foundation (1-6) to jump to automation (7-18). The automation projects assume you understand the what and why from manual work—they teach you how to scale.

Recommended Learning Sequence (Week-by-Week)

Weeks 1-3: Foundation Setup

  • Read: QUICK-START-GUIDE.md (full)
  • Read: SOC-Analyst-Roadmap.md (overview)
  • Execute: Project 1 (LetsDefend)
  • Outcome: Understand SOC fundamentals, triage 50+ alerts

Weeks 4-6: Deepen Investigation Skills

  • Execute: Project 2 (Phishing Analysis)
  • Outcome: Master email forensics, IOC extraction

Weeks 7-10: SIEM Mastery

  • Execute: Project 3 (Incident Response)
  • Read: Start reviewing 2026-Automation-First-Roadmap.md (context)
  • Outcome: Advanced SPL/KQL, incident reports

Weeks 11-13: Advanced Forensics (Optional - Skip if fast-tracking)

  • Execute: Project 4 (Ransomware Forensics)
  • Outcome: Memory/PCAP analysis, deep technical skills

Weeks 14-17: Threat Hunting (Optional - Skip if fast-tracking)

  • Execute: Project 5 (Threat Hunting)
  • Outcome: Proactive detection, behavioral analytics

Weeks 18-21: Detection Engineering (Optional - Skip if fast-tracking)

  • Execute: Project 6 (Detection Engineering)
  • Outcome: GitHub detection repo, Sigma contributions

Weeks 22-24: AUTOMATION TRANSITION ⭐

  • Read: 2026-Automation-First-Roadmap.md (full, detailed)
  • Execute: Project 7 (Automated Phishing Responder)
  • Study: SOAR concepts, API-driven security
  • Outcome: End-to-end SOAR workflow deployed

This is the inflection point: After Project 7, you understand why automation matters and how to architect it.

Weeks 25-27: Cloud & AI (Advanced)

  • Execute: Project 8 (Serverless Security) OR Project 9 (AI Threat Hunting)
  • Study: Cloud IAM, AI agent supervision
  • Outcome: Cloud-native security + AI collaboration experience

Weeks 28-30: Emerging Tech (Expert)

  • Execute: Project 10 (Post-Quantum Cryptography)
  • Study: Quantum threats, NIST PQC standards
  • Outcome: Future-proof expertise

Weeks 28-32: Offensive-Defensive Mastery (Elite Path)

  • Execute: Projects 11-14 (AD Attack Lab, Cloud Security, Purple Team, Malware RE)
  • Study: Active Directory security, MITRE ATT&CK, reverse engineering
  • Outcome: Attack simulation capability, detection coverage matrices, YARA rules

Weeks 33-40: AI Security Automation (Elite Path)

  • Execute: Projects 15-18 (AI Firewall Audit, IR Pipeline, Malware Analysis, Micro-SOAR)
  • Study: n8n workflow design, API integration, confidence scoring algorithms
  • Outcome: Production-grade automation pipelines, enrichment APIs, sandbox integration

Portfolio Assembly Strategy

Minimum Viable Portfolio (Job-Ready)

Required Elements:

  1. Resume with 9-12 SOC bullets (use templates from Projects 1-3, 7)
  2. LinkedIn Profile updated with:
    • Headline: "SOC Analyst | SIEM | Incident Response | Security Automation"
    • Experience section with project bullets
    • Skills: Splunk, SIEM, SOAR, Python, Wazuh, Incident Response
  3. GitHub Repository OR Notion Page:
    • 3-4 project write-ups (redacted screenshots)
    • SOAR workflow (Shuffle export JSON)
    • README explaining your SOC journey

Time to Build: 2-4 hours (after completing projects)

Competitive Portfolio (Top 5% Candidate)

All from MVPplus: 4. Detection Rules Repository (GitHub)

  • 5-10 Sigma rules (from Project 6)
  • Documentation, test cases
  1. Blog Posts (Medium/Dev.to)
    • "How I Built an Automated Phishing Response System"
    • "From Manual Triage to SOAR Orchestration"
  2. Certifications:
    • Security+ OR GSEC
    • AWS Security Specialty OR AZ-500
  3. Contributions:
    • Sigma HQ pull request (1-2 rules accepted)
    • SOAR playbook shared on Shuffle community

Time to Build: 8-12 hours (over course of projects)

Resume Strategy: Before & After

Before (Generic, Weak)

• Studied cybersecurity fundamentals
• Completed online courses in security operations
• Familiar with SIEM tools and incident response

After (Specific, Strong - Using Your Projects)

• Monitored and triaged 150+ security alerts on LetsDefend SOC platform, achieving 92% accurate classification (TP/FP) and reducing avg triage time from 15 to 6 minutes through pattern recognition

• Conducted forensic analysis of ransomware incident using Volatility (memory) and Wireshark (PCAP), reconstructing 72-hour attack timeline and identifying C2 infrastructure, data exfiltration, and persistence mechanisms

• Architected SOAR pipeline integrating Wazuh SIEM, Shuffle orchestration, and TheHive case management, reducing Mean Time to Contain (MTTC) from 45 minutes to 3 minutes via automated IOC enrichment and endpoint isolation

Difference: Quantifiable metrics, technical tools, real outcomes.

Certification Timing & Priorities

Entry-Level Track

  • After Projects 1-3: Security+ (validates foundation)
  • After Project 7: AWS Certified Cloud Practitioner (basic cloud)
  • Target: SOC Tier-1 roles

Advanced Track

  • After Projects 1-6: GSEC or GCIA (SANS)
  • After Project 7: AWS Security Specialty OR AZ-500
  • After Project 9: AI-102 (Azure AI Engineer)
  • Target: Tier-2 SOC, Detection Engineer

2026 Future Track

  • After Projects 7-9: SEC545 (GenAI/LLM Security) OR SEC598 (AI SOC)
  • Target: AI Security Engineer, Tier 4 Orchestrator

Pro Tip: Don't delay job applications waiting for certs. Projects > Certifications in 2026.

Interview Preparation Workflow

1 Week Before Interview:

Review:

  • All resume bullets - practice explaining each project
  • Interview talking points from each project template
  • Common behavioral questions (STAR method practice)

Prepare:

  • Portfolio links ready to share (GitHub, Notion)
  • 2-3 "war stories" from projects (most challenging investigation)
  • Questions to ask interviewer about their SOC maturity

Day Before Interview:

Refresh:

  • Re-read Project 7 (automation) - likely to impress interviewers
  • Review MITRE ATT&CK tactics/techniques from your projects
  • Practice explaining technical concepts to non-technical audience

During Interview:

Structure answers using STAR:

  • Situation: "In my SOAR automation project..."
  • Task: "I needed to reduce response time while maintaining human oversight..."
  • Action: "I built a Shuffle workflow that..."
  • Result: "Achieved 93% reduction in MTTC, from 45 min to 3 min"

Have ready:

  • Screenshots on laptop/tablet to show (if virtual interview)
  • GitHub repo link in chat (if asked for examples)
  • Notebook with questions you prepared

Continuous Learning Path (Post-Projects)

After Completing All Projects:

Don't stop learning. The 2026 SOC landscape evolves rapidly.

Monthly Habits:

  1. Threat Intelligence: Follow 3-5 security researchers on Twitter/LinkedIn
  2. Hands-On: Complete 1-2 TryHackMe/CyberDefenders new challenges
  3. Reading: Read 2-3 security blog posts (Krebs, Schneier, vendor blogs)
  4. Tools: Experiment with 1 new security tool (SOAR, SIEM, EDR)

Quarterly Goals:

  1. Skill Expansion: Learn 1 new domain (e.g., cloud security → container security)
  2. Certification: Progress toward next certification
  3. Contribution: Publish 1 blog post OR 1 Sigma rule OR 1 SOAR playbook

Yearly Goals:

  1. Major Project: Build 1 significant new project (e.g., home SOC lab expansion)
  2. Community: Present at 1 conference (BSides, local meetup)
  3. Career: Apply for 1 level-up role (if employed) or negotiate raise

FAQ: Navigating Your SOC Journey

Q: Should I do all 18 projects before applying for jobs?

A: No. After Projects 1-3 + 7 (12 weeks), you're ready for entry-level SOC roles. Projects 11-18 are for advancing to senior/architect roles — don't wait for them to start applying.

Q: I don't have time for 20+ weeks of projects. What's the minimum?

A: Projects 1, 2, 3 (foundation) - 8 weeks. This gets you job-ready for Tier-1 SOC.

Q: How important is Project 7 (SOAR automation)?

A: Very important for 2026+ roles. It differentiates you from 95% of candidates. Prioritize it if targeting modern SOCs.

Q: Can I skip the manual projects (1-6) and just do automation (7-18)?

A: No. Automation without understanding fundamentals is dangerous. Do 1-3 minimum before 7. Projects 15-18 (n8n pipelines) especially assume you understand alert triage, IOCs, and threat intel from the foundation projects.

Q: Which certifications should I get first?

A: Security+ (validates foundation) → AWS/Azure cloud cert → AI-focused (SEC545, AI-102) if pursuing 2026 path.

Q: How do I balance learning vs. job applications?

A: 80/20 rule: 80% learning (projects) until Week 10, then 20% learning + 80% applications. Don't over-optimize.

Q: What if I get stuck on a project?

A: Use platform communities (LetsDefend Discord, TryHackMe forums), Google specific errors, revisit template instructions. Don't stay stuck >24 hours - ask for help.

Q: How long until I'm "job-ready"?

A:

  • Tier-1 SOC: 8-10 weeks (Projects 1-3)
  • Tier-2 SOC: 16-20 weeks (Projects 1-7)
  • AI SOC Engineer: 24-28 weeks (Projects 1-10 + certs)
  • Security Architect/Senior: 28-40 weeks (All 18 projects + certs)

Your Next Immediate Action

Right now, do this:

  1. Open QUICK-START-GUIDE.md
  2. Read the Week 1 Action Plan section
  3. Create accounts:
  4. Block calendar: Reserve 10 hours THIS WEEK for SOC projects
  5. Start Project 1, Day 1 tasks

Stop reading. Start doing.

Final Thoughts: You Have Everything You Need

What you've been given:

  • ✅ 18 comprehensive project templates (250,000+ words)
  • ✅ Step-by-step execution plans (day-by-day breakdowns)
  • ✅ 54+ resume bullets for every project (copy-paste ready)
  • ✅ Interview talking points (STAR method answers)
  • ✅ Documentation templates (reports, timelines, evidence)
  • ✅ 4 career paths (fast / professional / automation-first / elite leader)
  • ✅ 2026 automation-first vision integration
  • ✅ n8n SOAR automation pipelines (P15-P18)
  • ✅ Certification roadmap
  • ✅ Portfolio assembly guide

What separates you from those who succeed:

  • ❌ NOT intelligence
  • ❌ NOT prior experience
  • ❌ NOT expensive bootcamps
  • ✅ Consistent execution: 10 hours/week for 8-24 weeks

The only question: Will you execute?

The SOC analyst career you want is 8 weeks away. The automation-first future is 24 weeks away. The elite security leader path is 40 weeks away.

Your move. 🎯🔒🚀

Need help? Re-read the templates. Everything is documented. Now go build. 💪