The defender's seat and the career

Monitoring and incident response in the SOC, a hands-on investigation from logs to report, governance and frameworks, AI in security, then jobs, certificates and a 20-week plan.

OverviewMonitoring and incident response in the SOC, a hands-on investigation from logs to report, governance and frameworks, AI in security, then jobs, certificates and a 20-week plan.
Detection and incident responsePrevention will fail one day; the question is how late you notice. You meet the security operations centre, SIEM and SOAR, the NIST incident response cycle, and write a script yourself that finds failed sign-ins in a log.
Hands-on project: investigate an incident from logs to reportYou sit in a SOC analyst's seat in front of a full incident: an alert and three log sources (sign-ins, the web server and the firewall). You build the timeline, map each step to an ATT&CK tactic, decide the scope and indicators, then write a one-page incident report that a manager and an engineer both understand. That report is the strongest piece in your portfolio.
Governance and frameworks: NIST CSF 2.0 and the national controlsHow security turns from scattered reactions into a programme with goals, owners and measures: the six NIST CSF 2.0 functions, ISO 27001, the national Essential Cybersecurity Controls ECC-2:2024, and risk management with a register you build yourself.
AI and security: a weapon for both sidesHow attackers use AI for phishing and voice cloning, how defenders use it for detection, and the new risks in language-model apps from the 2025 OWASP list: prompt injection, excessive agency and more.
Career paths and certificatesWhere you want to stand: SOC analyst, incident responder, pen tester, application security, cloud security, or governance. Then the certificates worth it now, with current facts: Security+ between SY0-701 and SY0-801, and the state of ISC2 CC after the free programme ended.
The roadmap and a 20-week planTwo paths for two goals: a plain two-week path to protect yourself and your family, and a technical 20-week path in 7 phases, each with a goal, sources, a hands-on task and a test that tells you when it is done. With a free lab you set up yourself.
Wrap-up and resourcesThe takeaways and glossary of this track.