Speaker 1: Welcome back to the deep dive. We're here to cut
Speaker 1: through the noise from your source stack and get you
Speaker 1: right to the good stuff exactly. Today we're tackling something
Speaker 1: really important, mapping out an accelerated path into a security
Speaker 1: operations center analyst role. It's that key first step in cybersecurity.
Speaker 2: It really is, and it's high stakes, definitely high reward.
Speaker 2: The timing for looking at this is well, it's critical.
Speaker 2: Our sources are saying the industry needs something like sixty
Speaker 2: two percent growth just to meet current demands.
Speaker 1: Sixty two percent, that's huge. But what's interesting and what
Speaker 1: we saw on the hiring sources is this kind of paradox.
Speaker 1: The problem isn't strictly a lack of applicants.
Speaker 2: Yeah, not exactly.
Speaker 1: It's finding the right kind of applicants, people who've got
Speaker 1: that tech foundation, sure, but also the critical thinking you
Speaker 1: need for well triage.
Speaker 2: Precisely the SEC analyst job. Yeah, it's often the entry
Speaker 2: point with the lowest barrier technically speaking, but you're expected
Speaker 2: to perform from day one, right, and the sources they
Speaker 2: really nail what that first year feels like. It's overwhelming,
Speaker 2: Like drinking from a fire hose is the classic phrase.
Speaker 1: Huh yeah, I've heard that. One.
Speaker 2: Our goal here is pretty simple, really, we want to
Speaker 2: help shorten that, you know, that really uncomfortable period, get
Speaker 2: you the knowledge to go from feeling swamped to being
Speaker 2: productive faster.
Speaker 1: Okay, let's talk about the scale here, the opportunity. You're
Speaker 1: looking at the US Bureau of Labor statistics, they projected
Speaker 1: cybersecurity analyst roles to grow thirty two percent over ten years.
Speaker 2: Thirty two percent. Compare that to what five percent for
Speaker 2: all other jobs combined in the US. It's massive growth.
Speaker 1: It really puts it in perspective.
Speaker 2: And remember when cybersecurity folks were designated essential workers. That
Speaker 2: just underlined how serious the shortage is. We're talking like
Speaker 2: almost half a million open cyber jobs in the US
Speaker 2: alone when these sources were written, half a million.
Speaker 1: Wow. And this leads to what our source is called
Speaker 1: the revolving door opportunity, which sounds maybe negative, but it's
Speaker 1: actually an advantage for someone trying to get in.
Speaker 2: Definitely a challenge for hiring managers, yeah, but good for applicants.
Speaker 2: The average time an analyst stays with one company, it's
Speaker 2: only like one to three years.
Speaker 1: Usually before they move up or move on exactly.
Speaker 2: So positions are just constantly opening up. It means there's
Speaker 2: this built in career ladder.
Speaker 1: So if you're hitting the job boards, what titles should
Speaker 1: you focus on? The sources mentioned three specific ones.
Speaker 2: Yeah, the top three entry level ones they recommend are
Speaker 2: security analyst, Information security analyst, and the one we're really
Speaker 2: digging into today, Security Operations center analyst or SoC analyst.
Speaker 1: Okay, and you mentioned earlier the SoC analyst role might
Speaker 1: start out paying a bit less than the others, but
Speaker 1: it has the best trajectory.
Speaker 2: Why is that exposure? Simple as that in the SoC
Speaker 2: you are right there, hands on with the biggest security tools.
Speaker 2: You see every alert the company generates, you're alerting constantly, constantly,
Speaker 2: you get practical real time experience and triage, detection response,
Speaker 2: all of it. That experience being in the trenches, that's
Speaker 2: the most valuable, most transferable skill sets. Starting out out
Speaker 2: sets you up perfectly for bigger roles, specialization, more money
Speaker 2: down the line. It really is the crucial first step.
Speaker 1: All right, let's unpack the skills you absolutely need. This
Speaker 1: is how you show your that right kind of candidate.
Speaker 1: We talked about the prerequisites exactly.
Speaker 2: You need a technical baseline. Think around the level of
Speaker 2: knowledge you'd get studying for CERTs like Network Plus and
Speaker 2: Security Plus up. That kind of foundational understanding.
Speaker 1: And networking is ground zero, right, The absolute plumbing of
Speaker 1: how everything connects online.
Speaker 2: Couldn't have set it better. You need to understand the
Speaker 2: layered models, like the difference between the conceptual OSI model,
Speaker 2: the seven layer one and the.
Speaker 1: More practical TCPIP model the four layer one that actually runs.
Speaker 2: The Internet precisely. And addressing is key. We all know
Speaker 2: we're running out of IPv four addresses the thirty two
Speaker 2: bit ones, and IPv six.
Speaker 1: Is coming slowly but surely.
Speaker 2: But as a SOOC analyst, you're going to spend a
Speaker 2: lot of your time focused on public IPS versus private ips,
Speaker 2: specifically that RFC nineteen eighteen private address.
Speaker 1: Okay, here's the so what moment? Then? Why does an
Speaker 1: analyst need to have those three private IP ranges memorized?
Speaker 1: You know, the tens dot, the one ninety two dot
Speaker 1: one sixty eight, the one seventy two dot sixteen.
Speaker 2: Because that's where internal traffic should live. If you suddenly
Speaker 2: see an alert, say showing a private IP address trying
Speaker 2: to talk directly to the outside Internet. That's a huge
Speaker 2: red flag. Ah because it's nonrootable. It shouldn't be trying
Speaker 2: to leave exactly. It means something inside your network might
Speaker 2: be compromised and trying to phone home or move laterally
Speaker 2: in unexpected ways. Knowing that big companies often use the
Speaker 2: ten point zero point zero po eight range just gives
Speaker 2: you a sense of scale for what you're watching.
Speaker 1: Got it? That makes it instantly practical. Okay. Beyond IPS
Speaker 1: TCP versus.
Speaker 2: UDP, right, TCP is your reliable connection. It uses that
Speaker 2: three way handshake. Think file transfers, things where you need
Speaker 2: every single bit to arrive correctly.
Speaker 1: Okay.
Speaker 2: Then there's UDP, sometimes called the unreliable dang protocol. It's
Speaker 2: fast connectionless good streaming where losing a packet isn't the
Speaker 2: end of the world.
Speaker 1: But from a security angle, well think about it.
Speaker 2: Attackers often prefer reliable TCP for things like command and
Speaker 2: control channels because they need that guaranteed communication back and
Speaker 2: forth makes sense. But UDP, because it's fast and connection lists,
Speaker 2: they might use it for things like data exfiltration, fast
Speaker 2: DNS tunneling, maybe speed and stealth over perfect reliability.
Speaker 1: That has a whole new layer, and of course the ports.
Speaker 1: You got to know your common ports and protocols cold.
Speaker 2: Oh, absolutely twenty and twenty one for FTP, twenty two
Speaker 2: for SSH, port ad HTTP four forty three for ssltls.
Speaker 2: You need to spot those instantly in logs, no hesitation and.
Speaker 1: Kind of overarching all this networking stuff is that core
Speaker 1: security principle, the CIA.
Speaker 2: Triad confidentiality, integrity availability. Yep, every attack, every control maps
Speaker 2: back to one of those three launch a denial a
Speaker 2: service attack.
Speaker 1: You're hitting a availability exactly. So if CIA is what
Speaker 1: we're protecting, where are attackers focusing? The sources were pretty
Speaker 1: clear on this.
Speaker 2: The end point overwhelmingly. That Verizon report sided's something like
Speaker 2: ninety percent of malware infections start with email. Phishing is
Speaker 2: still king ninety percent.
Speaker 1: That's staggering.
Speaker 2: And when you're looking at those endpoints, you have to
Speaker 2: know the risks of the OS. Windows. Yeah, it's everywhere,
Speaker 2: but lots of places still have old unsupported versions running
Speaker 2: Windows seven even older.
Speaker 1: Sometimes and if users have local admin rights on those.
Speaker 2: Big trouble, huge risk escalation.
Speaker 1: What about max lex Unix systems.
Speaker 2: Generally maybe less susceptible to mass malware, but often they
Speaker 2: get hit because of misconfigurations, big security holes left open
Speaker 2: by mistake. Plus they run powerful scripting tools like Python.
Speaker 2: If an attacker gets in, they can use those native
Speaker 2: tools to move fast and do a lot of damage.
Speaker 1: Okay, fundamentals down, Let's step into the actual sc paint
Speaker 1: the picture for us. The sources mentioned the classic setup.
Speaker 2: Yeah, the dark room, wall to wall screens, maybe a
Speaker 2: big global threat map up somewhere. That's the stereotypical image.
Speaker 2: And sometimes it's true that's your.
Speaker 1: New office and right at the center of it all.
Speaker 1: The tool you'll be glued to is the.
Speaker 2: SAM, the SAM Security Incident and Event Management System. Absolutely,
Speaker 2: it's the heartbeat of the sec. Analysts call it the
Speaker 2: single pane of glass.
Speaker 1: Let's clarify what it actually does, pulling in logs from everywhere, right, firewalls, servers, laptop, everything.
Speaker 2: But critically, it then normalizes those logs. You mentioned this earlier,
Speaker 2: and it's crucial. Think about time zones, oh.
Speaker 1: Right, logs from London, Tokyo, New York all time.
Speaker 2: Stamp differently exactly and maybe in different formats too. The
Speaker 2: SUM cleans that up standard format adjusted timestamps, so you
Speaker 2: can actually trace an attack step by step across the globe.
Speaker 2: If that normalization breaks, you're basically trying to solve a
Speaker 2: puzzle with all the pieces having the wrong time written
Speaker 2: on them. It's chaos.
Speaker 1: Yeah, I could see how that would be impossible. And
Speaker 1: the good SEMs now are using you eba.
Speaker 2: User entity and behavior analytics esflow watching for weird user activity,
Speaker 2: stuff that deviates from their normal baitin and you know,
Speaker 2: being able to casually mention vendors like Splunk or cure
Speaker 2: it r or Elastic in an interview. It shows you
Speaker 2: the landscape.
Speaker 1: Okay, good tip. Now alongside the CM.
Speaker 2: There's sower so security orchestration, automation and response. Yeah, big topic.
Speaker 2: The key takeaway from the sources is it's not there
Speaker 2: to replace analysts.
Speaker 1: It's a force multiplier exactly.
Speaker 2: It's there to make the analyst more effective, faster, and
Speaker 2: frankly happier.
Speaker 1: How does it do that? Practically? Speaking for a junior.
Speaker 2: Analyst, think about the boring, repetitive stuff copying an IP address,
Speaker 2: pasting it into five different thread Intel websites. I kind
Speaker 2: of think the grunt work that leads to bring out
Speaker 2: SR automates that so maybe a phishing email comes in
Speaker 2: sim flags the attachment. SR can automatically sandbox the attachment,
Speaker 2: check the sender's IP against block lists, maybe even block
Speaker 2: the IP on the firewall if it's definitely bad. All
Speaker 2: in seconds.
Speaker 1: Well, okay, so it's streamlines things, keeps responses consistent and
Speaker 1: cuts down the time it takes to spots thing MTTD
Speaker 1: and respond MTTR.
Speaker 2: Precisely major goals for any SCR.
Speaker 1: One last thing on the sec environment the terminology. Getting
Speaker 1: these terms mixed up seems like a big deal.
Speaker 2: Huge deal, especially during an actual incident. There's a funnel
Speaker 2: basically based on volume and severity.
Speaker 1: Okay, start us at the bottom most common security logs.
Speaker 2: That's just the raw data firewall logs, network flows, Windows
Speaker 2: event logs, tons of it.
Speaker 1: Yeah.
Speaker 2: Up a level you get a security event. This is
Speaker 2: usually a notification from a tool like the SIMIM, A
Speaker 2: rule fired based on analyzing those logs. Still pretty common.
Speaker 2: Next incident this is less common. An incident gets declared
Speaker 2: when you suspect sensitive data might have been lost or exposed.
Speaker 2: This kicks off the formal incident response process.
Speaker 1: In the top level, the rarest one.
Speaker 2: The security breach. This is critical a breach means it's
Speaker 2: verified that sensitive personal data was lost or stolen. This
Speaker 2: usually requires legal involvement, public notification.
Speaker 1: It's serious and the crucial advice.
Speaker 2: Here as a new analyst, do not use the word
Speaker 2: breach ever, unless you're CISO or the legal team specifically
Speaker 2: tells you to. That word has massive weight. Stick to
Speaker 2: event or incident until told otherwise.
Speaker 1: Okay. Final hurdle getting the job. The interview. It tests
Speaker 1: the technical stuff we covered.
Speaker 2: Definitely, network plus as security plus level knowledge, the OSI model,
Speaker 2: TCQUDP ports, CIA, TRIAD, all that, but just.
Speaker 1: As important, maybe more so, our critical thinking and cultural fit.
Speaker 2: Absolutely, and they often test this with scenario questions. One's
Speaker 2: designed to gauge your soft skills, your judgment, like the example.
Speaker 1: And the sources. The VP of HR emails you they
Speaker 1: need a policy exception right now to access their personal
Speaker 1: cloud drive. They say, it's urgent business. What do you do?
Speaker 2: Yeah, that's a classic. What are they testing?
Speaker 1: Well? First, do you get easily intimidated by a VP? Second?
Speaker 1: Do you understand risk? You can't just say.
Speaker 2: Yes, right, You can't just make that call yourself. You
Speaker 2: need to explain politely but firmly, that policy applies to everyone,
Speaker 2: even vps, and you need to escalate it. Tell them
Speaker 2: you'll need to get management or risk assessment involved to
Speaker 2: approve an exception.
Speaker 1: It shows you understand process and aren't just going to
Speaker 1: break rules under pressure.
Speaker 2: And the other thing they're looking for in those scenarios
Speaker 2: and technical questions too, is honesty. The sources were unanimous
Speaker 2: on this. The absolute last thing a SoC manager wants
Speaker 2: is a know.
Speaker 1: It all so one who guesses confidently but is totally
Speaker 1: wrong exactly.
Speaker 2: If you don't know an answer, just say so. Say
Speaker 2: I'm not sure about that specific detail, but here's how
Speaker 2: i'd find out, or I'd need to look that up.
Speaker 2: But my understanding is X. Show you're willing to learn,
Speaker 2: not bluff.
Speaker 1: That makes sense. We also pulled some great real world
Speaker 1: advice from the analysts featured in the Sources. One analyst
Speaker 1: Kaaliel Davis really hammered home that experience is king. Search
Speaker 1: and degrees help, sure, but hands on work often counts
Speaker 1: for more, especially early on.
Speaker 2: Yeah, and Matthew Arius, a Tier three analyst, shared something
Speaker 2: I thought was really insightful. He wished he'd left his
Speaker 2: ego go out the door sooner listen more to everyone,
Speaker 2: regardless of their title. He also mentioned imposter syndrome, which,
Speaker 2: let's be honest, almost everyone feels starting out in this field.
Speaker 1: That's comforting to hear, actually, and for actually finding the job.
Speaker 1: Networking came up again and again.
Speaker 2: Relentlessly go to local meetups def con. Besides, if you can,
Speaker 2: the security community is smaller than you think, and connections matter.
Speaker 1: Finally, there was a great point from a SoC director
Speaker 1: about mindset assume goodwill.
Speaker 2: Oh I like that one too. Not every weird alert
Speaker 2: is some malicious insider trying to steal secrets. A lot
Speaker 2: of the time it's just someone clicked a bad link
Speaker 2: by mistake.
Speaker 1: Keeping that perspective helps avoid burnout. Right, Yeah, let's you
Speaker 1: focus on the real threats. So wrapping this all up,
Speaker 1: this deep dive really shows that success here isn't just
Speaker 1: about the tech, the networking, the someme know how. It's
Speaker 1: blending that with well being humble, honest and thinking critically.
Speaker 2: Totally agree. The demand is undeniable. The sec role is
Speaker 2: that perfect long lunch pad, and hopefully the stuff we've
Speaker 2: covered today gives you the operational context, the confidence to
Speaker 2: make that fire hose phase feel a bit less intense
Speaker 2: and maybe even shorter.
Speaker 1: Yeah. Absolutely, And as you move forward in this field,
Speaker 1: which is challenging, but as the sources say, incredibly rewarding,
Speaker 1: maybe keep this final thought in mind. It kind of
Speaker 1: sums up the attitude you need.
Speaker 2: It's a great quote around here. However, we don't look
Speaker 2: backwards for very long. We keep moving forward, opening up
Speaker 2: new doors and doing new things because we're curious and
Speaker 2: curiosity keeps leading us down new paths.
Speaker 1: Couldn't say it better myself. That's our deep dive for today.
Speaker 1: Thanks as always for sharing your sources and letting us
Speaker 1: walk through the essentials of becoming an SEC analyst. We'll
Speaker 1: catch you on the next one.