What are some of the best sources of training and certification for SOC roles and career development?

In my experience, Information Security is among the most cross-disciplinary fields in Information Technology. For example, at one employer, we had announced that we were conducting a policy review of our firewall that morning. An hour later, we were getting inundated with calls reporting loss of Internet access. Looking at what might have been done to the firewall might have made sense in the moment, but after 30+ minutes of trying to find such, and not finding anything, a simple traceroute revealed that we could get to our ISP's gateway, but not beyond. Minutes later, Network Engineering reported an ISP outage. I would not limit myself to InfoSec when I think of "basics" and foundational knowledge.

Learning from the beginning will help the professional choose the path to follow. Even within a SOC, we can have many positions that require different knowledge. A clear example is the Blue and Red teams. Many trainings are focused on tools, which is valid, but only after learning the concept, and understanding the concept is a better experience than looking for a course. But if the person does not have a chance to start work in a SOC, look for renowned courses focused on the fundamentals so that later you can choose the path to follow.

Prioritize acquiring fundamental skills and knowledge in IT security operations, including network security, system administration, incident response, threat intelligence, malware analysis, and familiarity with security tools and technologies.

To establish your foundational knowledge, I recommend starting with the CompTIA Security+ certification. It's cost effective and gives you good exposure to all the major security domains.

In terms of skills and concepts, SOC professionals should master the following: Network security fundamentals Intrusion detection and prevention systems Security incident response procedures Threat intelligence analysis Log analysis and correlation Malware analysis and reverse engineering Digital forensics techniques Vulnerability assessment and management Security operations best practices and frameworks (e.g., NIST Cybersecurity Framework, MITRE ATT&CK Framework) Communication and collaboration skills for working effectively with other teams and stakeholders.

I recommend looking for specific courses that contain concepts such as SIEM, SOAR, MDR, XDR and forensic analysis. Some methods can be costly, so I recommend starting some online training, free to create understanding and then taking some renowned courses like the one listed in the article to improve and specialize. Companies like Microsoft, Fortinet, and IBM, among others, usually provide training. They know that training is often specialized in the solutions that else sell, but it is still worth it.

Look for courses or video tutorials on detection engineering, pcap analysis, MITRE Attack Framework, NIST, CIS and incident response.

Continuously develop intermediate and advanced skills and knowledge in IT security operations, focusing on mastering techniques and tools for threat detection, analysis, response, and SOC management. As you progress in your SOC career, honing these capabilities is essential for effectively mitigating emerging cyber threats and safeguarding organizational assets against evolving security risks.

Can't stress this enough, the fundamentals are crucial. Subjects such as networking, system administration, operating systems, and some basic file analysis is a great start. There will always be something new, but the fundamentals never go away.

Understand that CISM or CISSP should be a long-term goal, not only because of the difficulty and cost of training and exams but these certifications usually have previous experience requirements (having worked in information security in the last five years, for example), with this becomes more difficult to acquire for the beginning of a career, but we have many suitable options such as CompTIA Security+, Ethical Hacker from EC-Council, among others.

Prepare for certification exams by completing corresponding training courses or accumulating relevant work experience, ensuring readiness to successfully pass proctored assessments.

As you develop your skillset in the field, you will see what Blue Team topics you're drawn to the most. Whether this be Threat Detection, SIEM, SOAR, Malware Analysis, or others. Once you have a general area you want to dive into, I recommend researching this and going deep. This will allow you to get the reps in and be able to apply this on the job.

Charting your SOC career course is like picking your tools for an epic cybersecurity quest. Forging a solid foundation, consider vendor certifications like CompTIA CySA+ for a tactical SOC analyst's toolkit. As you level up, SANS GIAC GSOC imbues you with the wisdom of a seasoned hunter, while EC-Council CEH grants you glimpses into the shadowy tactics of your foes. Online platforms like Cybrary, Udemy, and Pluralsight are overflowing with training treasures to hone your skills. But for truly immersive journeys, seek the wisdom of SANS Institute's live courses or the adrenaline rush of Offensive Security's hands-on training grounds.

To effectively manage the certification process within a SOC, I recommend implementing a certification management framework. This framework could include the following components: Documented certification requirements: Clearly outline the certification requirements, including the specific certifications, exams, and eligibility criteria. Ongoing training and awareness programs: Provide regular training programs to ensure that SOC analysts are up-to-date with the latest security trends and best practices. Examination and certification process management: Establish a structured process for administering certification exams. Continuous assessment and tracking: Develop a system to track and assess the certification status of SOC analysts.

Developing a career in SOC is a multifaceted endeavor that goes beyond acquiring certifications and formal training. The power of networking cannot be overstated; connecting with peers and industry leaders can open doors to mentorship, knowledge expansion, and new opportunities. In the fast-paced domain of security operations, the landscape is in constant flux; hence, the commitment to lifelong learning is non-negotiable. Whether through staying updated with industry news, engaging in online education, reading relevant materials, or participating in workshops, the thirst for knowledge ensures professionals remain at the forefront of their field.

In addition to having technical experience and soft skills, a career in SOC is like a university. It is a journey, and the customer does not have a quick return because the SOC needs maturity to understand each customer differently. The customer needs to be patient, and the analysts too, because the chance of errors and false positives at the beginning is high. However, over time the maturity evolved and became an incredible partnership, making the supplier a vital part of the company that hired him. It is essential to trust the service performed.

Career development will be something you will always be working on, as Cybersecurity is a career of learning. Reading blogs, books, and watching webinars is a good low cost way to keep up to date with the field. I normally recommend resources like Over The Wire and CyberDefenders, as they are hands on. For paid options, there are courses on Coursera, Cybrary, and Udemy. These are usually low cost.

Next time you think about SOC, imagine it as a thrilling cyber quest with a dedicated team of heroes watching over you, ready to defend your digital kingdom from any lurking danger. They are the knights of the digital realm, silently standing guard, so you can rest easy knowing that your cyber-fortress is safe and sound.