Overview
Your complete guide to The defender's seat and the career
Monitoring and incident response in the SOC, a hands-on investigation from logs to report, governance and frameworks, AI in security, then jobs, certificates and a 20-week plan.
Non-technical and technical learners alike. Every part opens two ways in: a plain path built on an analogy for someone starting from zero, and a detailed path for someone who knows the basics and wants depth.
An animation, then what you need before you start, then the idea with code you run, then a worked example, then review cards and "test your understanding" questions.
Do not leave a part before you can answer its questions without guessing. Reading alone proves nothing.
Pick a topic
A look at The defender's seat and the career
You sit in the defender's seat inside the SOC and investigate a full incident yourself, then see governance and AI, and finally pick your job and walk the 20-week plan.
| Part | Topic | You learn |
|---|---|---|
| 1 | Detection and incident response | The SOC and its tiers, logs, SIEM and SOAR, the response cycle, forensics, what to do if your account is hacked |
| 2 | Hands-on project: investigate an incident from logs to report | Triage, a timeline from several sources, mapping to ATT&CK, scope and indicators, containment, writing the incident report |
| 3 | Governance and frameworks: NIST CSF 2.0 and the national controls | NIST CSF 2.0, ISO 27001, ECC-2:2024, the risk register and risk treatment |
| 4 | AI and security: a weapon for both sides | AI for attackers and defenders, the OWASP Top 10 for LLM apps 2025, prompt injection, excessive agency |
| 5 | Career paths and certificates | Six roles and their skills, Security+ SY0-701 and SY0-801, ISC2 CC, what comes after Security+, law and ethics |
| 6 | The roadmap and a 20-week plan | The plain path, the seven-phase technical path, the free lab, the portfolio |
Done with this lesson?
Sign in to save your progress.