Do You Really Need to Start Cybersecurity with SOC? | Open Discussion
SHERIF E. — Cyber Security Analyst
https://youtu.be/1Z0vLZ7PnSA?si=20iKqu8QPtsYY87F
Is SOC really the right starting point for anyone looking to build a career in Cybersecurity?
In this episode of Open Discussion, we take a practical look at the SOC and Blue Team career path and discuss what a SOC Analyst actually does, the differences between L1, L2, and L3 roles, and the technical and soft skills you need to build a strong foundation.
We will also explore the key technologies used in modern SOC environments, including SIEM, EDR, and SOAR, and discuss whether SOC work is simply about Monitoring and Alert Handling or involves much more, such as Threat Hunting, Incident Response, Threat Intelligence, and SIEM Tuning.
Most importantly, we will open the discussion around one key question:
Is SOC really the right starting point for a Cybersecurity career?
If not, what other Cybersecurity paths can beginners consider?
💬 Share your experience and opinion in the comments and let’s keep the discussion open.
2 reactions · 15 comments
Comments
Schomer: Great discussion topic. The traditional L1 triage path is changing rapidly. A lot of entry-level analyst burnout comes from manually chasing repetitive alerts that should be handled at the ingestion layer. If you shift the focus to building robust SOAR pipelines and automated playbooks on day one, the entry-level role becomes much more about active threat hunting and system tuning than just starin
SHERIF E.: Schomer Absolutely agree. L1 still plays an important role in building strong investigation fundamentals, but automation should be part of the learning journey from the start. Understanding how alerts are generated, enriched, correlated, and ultimately automated gives analysts a much deeper understanding of the SOC as a whole. The goal shouldn’t be to eliminate the L1 role, but to move it beyond r
Schomer: Spot on, Sherif. Moving the goalpost from 'alert closure rates' to 'detection engineering engineering' is exactly where the industry needs to go. When an analyst understands the underlying telemetry—how raw connection markers or boundary errors map cleanly into schema objects like STIX 2.1 bundles—they stop just staring at dashboards. It turns an L1 role from passive monitoring into active threat
SHERIF E.: Schomer Exactly. I think that shift is becoming increasingly important. An analyst who understands the telemetry behind an alert and how different data points connect to a broader attack story can add much more value than simply closing alerts against a predefined workflow. Detection engineering, threat hunting, and playbook tuning should complement the core L1 fundamentals, not replace them. Buil
Schomer: Exactly, Sherif. When you can reconstruct that broader attack story instantly, the time-to-mitigation drops to zero. The bottleneck today is that most tools parse this telemetry too late in the execution pipeline. If you don't ingest and structure those raw data points natively at the lowest boundary layers, you are trying to tell an attack story after the breach is already resident in memory. Con