⚔️ Fighter → SOC Analyst
“The frontline isn’t glamorous, but someone has to hold it. That someone is you.”
Your Role in the Party
You’re the backbone of the security operations center—the first line of defense against threats. While others theorize about attacks, you’re in the trenches monitoring alerts, triaging incidents, and keeping the organization safe around the clock.
SOC Analysts are in high demand. Every organization with a security program needs people who can monitor, detect, and respond to threats in real-time. The role is often an entry point into cybersecurity, but don’t let that fool you—it requires real skill and mental endurance to do well.
The SOC never sleeps, but that doesn’t mean you shouldn’t. Burnout is real in this role. The Fighters who thrive are the ones who find the rhythm meditative rather than monotonous, and who build sustainable habits early.
📊 Your Stat Spread
| Stat | Score | What It Means for You |
|---|---|---|
| CON | ⭐⭐⭐⭐⭐ | Sustained monitoring capability. You can watch dashboards for hours without losing focus. Shift work doesn’t break you. |
| INT | ⭐⭐⭐⭐ | You know detection frameworks, understand attack patterns, and can recall which alerts matter. |
| WIS | ⭐⭐⭐⭐ | Pattern recognition in the noise. You spot the anomaly in thousands of logs that others miss. |
| DEX | ⭐⭐⭐ | Handle multiple concurrent incidents. Pivot between tickets without losing context. |
| STR | ⭐⭐⭐ | Implement response actions when needed. Run queries, isolate hosts, execute playbooks. |
| CHA | ⭐⭐⭐ | Coordinate with team members and escalate clearly. Document findings so others understand. |
🎭 Neurodivergent Advantages
Your traits are class features, not bugs:
-
Sustained Focus (CON): What others call “boring repetitive work,” you might find genuinely meditative. Monitoring dashboards for hours? Some brains are built for exactly this.
-
Pattern Recognition (WIS): Autistic attention to detail catches the subtle anomaly that automated rules miss. ADHD’s wider associative network notices when “something feels off.”
-
Systematic Thinking (INT): You thrive with clear playbooks and procedures. The structure of SOC workflows—triage, investigate, escalate, document—can be deeply satisfying.
-
Hyperfocus Under Pressure: When an incident kicks off, your ability to lock in and work the problem for hours becomes a superpower.
-
Honest Assessment: Your directness means you don’t sugarcoat findings or bury bad news. Leadership actually needs this.
🗺️ Career Path
Help Desk → SOC Tier 1 → SOC Tier 2 → Senior Analyst → SOC Lead → SOC Manager
↓ ↓ ↓
(Entry point) (Specialization) (Leadership or
options) pivot to other
classes)Common Fighter Multiclasses:
- Fighter/Ranger: SOC Analyst → Threat Hunter (add proactive hunting to reactive monitoring)
- Fighter/Barbarian: SOC Analyst → Incident Responder (when you want to be the one who charges in)
- Fighter/Wizard: SOC Analyst → Forensics (deep-dive analysis when you find something interesting)
📜 Certification Pathway
Level 1-5: Foundation (0-2 years)
| Certification | Org | Type | Cost | Why It Fits |
|---|---|---|---|---|
| CC (Certified in Cybersecurity) | ISC² | Multiple Choice | FREE (training + exam) | Perfect entry point. No experience required. Just pay $50/year AMF after passing. |
| CompTIA Security+ | CompTIA | Multiple Choice | ~$425 | Industry standard. Proves you understand security fundamentals. Required for many DoD positions. |
| BTL1 (Blue Team Level 1) | Security Blue Team | Practical (24-hr) | Hands-on blue team cert. 24-hour practical exam simulates real incident response. |
Neurodivergent Note: ISC² CC is free and low-pressure—great for building confidence. Security+ is memorization-heavy; use Anki and practice tests. BTL1’s practical format rewards “learn by doing” brains.
Level 6-10: Specialization (2-5 years)
| Certification | Org | Type | Cost | Why It Fits |
|---|---|---|---|---|
| CompTIA CySA+ | CompTIA | Multiple Choice | ~$404 | THE SOC analyst cert. Covers behavioral analytics, threat detection, and incident response. |
| GCIH (Incident Handler) | SANS/GIAC | Practical | ~$999 (exam) + ~$8,780 (SEC504 course) | Gold standard for incident handling. Expensive but highly respected. |
| CCD (Certified CyberDefender) | CyberDefenders | Practical | ~$400 | Hands-on blue team cert focused on real-world scenarios. More affordable than SANS. |
Neurodivergent Note: CySA+ builds directly on Security+ knowledge. GCIH is expensive but SEC504 is excellent hands-on training. If cost is a barrier, CCD offers similar practical validation at lower cost.
Level 11-15: Advanced (5-8 years)
| Certification | Org | Type | Cost | Why It Fits |
|---|---|---|---|---|
| GCIA (Intrusion Analyst) | SANS/GIAC | Practical | ~$999 (exam) + ~$8,780 (SEC503 course) | Deep network analysis. More technical than GCIH. |
| GMON (Continuous Monitoring) | SANS/GIAC | Practical | ~$999 (exam) + course | Specialized in security monitoring—exactly what senior SOC analysts do. |
| OSDA (Blue Team) | OffSec | Practical | ~$1,649 | Offensive Security’s blue team cert. Rigorous practical exam. |
Neurodivergent Note: These are deep specializations. Pick based on what you’re drawn to: network analysis (GCIA), monitoring architecture (GMON), or proving yourself against OffSec’s standards (OSDA).
Level 16-20: Mastery (8+ years)
| Certification | Org | Type | Cost | Why It Fits |
|---|---|---|---|---|
| GSOM (Security Operations Manager) | SANS/GIAC | Practical | ~$999 (exam) + course | If you’re leading a SOC, this validates management skills. |
| CISSP | ISC² | Multiple Choice | ~$750 | Management-track cert. “Think like a manager” mindset. Opens leadership doors. |
| CISM | ISACA | Multiple Choice | ~$760 | Security management focus. Bridges technical and business. |
🛠️ Your Toolkit
Primary Weapons
| Tool | Type | What It Does | Link |
|---|---|---|---|
| Splunk | SIEM | Industry-leading log analysis and correlation. SPL query language is powerful but has a learning curve. | splunk.com |
| Microsoft Sentinel | SIEM | Cloud-native SIEM with strong Microsoft integration. Uses KQL queries. Good for Azure environments. | azure.microsoft.com |
| CrowdStrike Falcon | EDR | Endpoint detection and response. See what’s happening on endpoints in real-time. | crowdstrike.com |
Defensive Equipment (Free/Low-Cost)
| Tool | Purpose | Link |
|---|---|---|
| Wazuh | Open-source SIEM/XDR. Great for home labs and learning. | wazuh.com |
| Velociraptor | Endpoint visibility and forensics. Hunt across your fleet. | docs.velociraptor.app |
| TheHive | Incident response platform. Track and manage security incidents. | thehive-project.org |
| MISP | Threat intelligence sharing. Correlate IOCs across your environment. | misp-project.org |
| Sysmon | Windows system monitoring. Essential visibility into endpoint activity. | Microsoft Docs |
Fun Tools from Awesome Lists
Source: awesome-soc
| Tool | What It Does |
|---|---|
| Zircolite | Standalone SIGMA-based detection tool for EVTX and JSON logs |
| DeepBlueCLI | PowerShell module for threat hunting via Windows Event Logs |
| CrowdSec | Collaborative security engine—like fail2ban but crowd-sourced |
| DFIR-ORC | Forensic artifact collection tool from French ANSSI |
| Chainsaw | Rapidly search and hunt through Windows forensic artifacts |
📚 Learning Resources
Free Resources
YouTube Channels:
- 13Cubed - Windows forensics and DFIR deep dives
- John Hammond - Engaging security content, CTF walkthroughs
- Black Hills Information Security - Free webcasts, practical security
Practice Platforms:
- LetsDefend - Realistic SOC simulation environment. Free tier available. Student discount 50%.
- TryHackMe - “SOC Level 1” and “SOC Level 2” paths. Gamified, structured learning.
- CyberDefenders - Blue team CTF challenges. Practice real investigations.
- Blue Team Labs Online - Hands-on defensive labs from Security Blue Team.
Reading:
- MITRE ATT&CK - Know your enemy’s playbook
- SANS Reading Room - Free research papers
- NIST SP 800-61 - Incident handling guide (the actual standard)
Books for Fighters
| Book | Author | Why Read It |
|---|---|---|
| Blue Team Handbook: SOC, SIEM, and Threat Hunting | Don Murdoch | THE practical reference for SOC work. Covers logging, data sources, and real-world guidance. |
| Jump-start Your SOC Analyst Career | Tyler Wall & Jarrett Rodrick | Entry-level guide covering what SOC analysts actually do day-to-day. |
| Cybersecurity Blue Team Toolkit | Nadean Tanner | Practical handbook for blue team tools and techniques. |
| Tribe of Hackers Blue Team | Marcus Carey & Jennifer Jin | Career advice from blue team practitioners. Real stories and guidance. |
| The Practice of Network Security Monitoring | Richard Bejtlich | Classic text on NSM. Foundational concepts that still apply. |
Podcasts
| Podcast | Why Listen |
|---|---|
| Darknet Diaries | True stories of hacking and cybercrime. Context for the threats you’re defending against. |
| SANS Internet Storm Center | Daily 5-10 minute security news. Stay current without doom-scrolling. |
| Risky Business | Weekly security news and analysis. Australian wit included. |
| Detection Engineering Weekly | Newsletter/podcast focused on building better detections. |
🎓 SANS Courses for Fighters
| Course | Cert | Focus | Best For |
|---|---|---|---|
| SEC401: Security Essentials | GSEC | Broad security foundations | Building comprehensive baseline knowledge |
| SEC504: Hacker Tools & Incident Handling | GCIH | Incident response | Understanding attacks to defend better |
| SEC503: Network Monitoring & Threat Detection | GCIA | Network analysis | Deep packet-level understanding |
| SEC450: Blue Team Fundamentals | GBTF | SOC operations | Purpose-built for SOC analysts |
| SEC555: SIEM with Tactical Analytics | GCDA | SIEM optimization | Making your SIEM actually useful |
🏆 Building Your Magic Items
Early Career Achievements:
- Set up a home lab with Wazuh or Security Onion
- Complete TryHackMe SOC Level 1 path
- Earn ISC² CC (it’s free!)
- Write your first detection rule
- Successfully triage 100 alerts (track your stats)
Mid-Career Achievements:
- Earn CySA+ or BTL1
- Build a detection that catches something real
- Mentor a new Tier 1 analyst
- Present a case study to your team
- Contribute to your team’s playbook documentation
Senior Achievements:
- Earn GCIH or equivalent
- Lead incident response for a significant event
- Architect improvements to your SOC’s detection coverage
- Speak at a local security meetup or BSides
- Build automation that saves your team hours per week
🧭 Multiclassing Guide
Adding Ranger Levels (Threat Hunting)
Move from reactive to proactive. Learn to hunt threats before they trigger alerts:
- TryHackMe “Threat Hunting” rooms
- SANS SEC555 for advanced SIEM analytics
- Study MITRE ATT&CK and build hypothesis-driven hunts
“I got tired of waiting for alerts. Now I go find the adversaries myself.”
Adding Wizard Levels (Forensics)
When you want to go deeper on investigations:
- SANS FOR500 for Windows forensics
- Practice with Autopsy and Volatility
- CyberDefenders forensics challenges
Adding Artificer Levels (Detection Engineering)
Build the detections instead of just using them:
- Learn SIGMA rule format
- Study your SIEM’s query language deeply (SPL, KQL)
- Detection Engineering Weekly for current practices
💡 Neurodivergent Learning Strategies
For ADHD:
- Use shift work structure to your advantage—clear start/end times
- Rotate between alert triage, investigations, and documentation to maintain interest
- Gamify your metrics: track alerts handled, detections written, incidents closed
- Body doubling: work alongside teammates even virtually
For Autism:
- Build comprehensive personal documentation and runbooks
- Create systematic workflows for common alert types
- The structure of tiered SOC models can be comforting—embrace it
- Request consistent shift schedules when possible
For Both:
- Leverage pattern recognition as your secret weapon
- Use hyperfocus strategically during complex investigations
- Be direct in escalations—SOC culture often appreciates this
- Build a “second brain” in your notes app for procedures and findings
🎯 Not Sure If You’re a Fighter?
Take the Character Creation Quiz to discover your cybersecurity class and get personalized recommendations!
📖 Continue Your Journey
- View All Classes
- Purple Team: Warlock - If you want to understand the attacker perspective
- Blue Team: Ranger - If you’re ready to start hunting
“The alerts keep coming. You keep defending. That’s the job, and you’re built for it.”