SOC Operations 01
Alert triage & incident response An alert is a lead, not a verdict. Correlate user, host, time, network and process evidence before deciding impact.
Hands-on Five levels
SOC Operations 02
Threat hunting & detection tuning Hunting starts with a hypothesis. An IOC match is context to investigate, not proof of compromise.
Hands-on Five levels
SOC Operations 03
Endpoint, phishing & malware Combine email headers, URL behavior, file evidence and endpoint telemetry. Keep evidence handling separate from production endpoints.
Hands-on Five levels
WAAP & Network 04
Akamai WAF & CDN onboarding CDN delivery and WAF enforcement solve different problems. Review hostname, origin, TLS and security configuration together.
Hands-on Five levels
WAAP & Network 05
Bot management & API protection Bots can be legitimate or abusive. Evaluate behavior and endpoint impact alongside identity and traffic signals.
Hands-on Five levels
WAAP & Network 06
Network controls & segmentation Firewalls and micro-segmentation limit traffic according to policy. Edge execution places supported logic nearer requests.
Mixed exposure Five levels
Vulnerability & Governance 07
Vulnerability assessment & remediation Prioritize findings using exposure, exploitability and business impact rather than a score alone.
Hands-on Five levels
Vulnerability & Governance 08
Audit evidence & SOC reporting Evidence should show what happened, who acted, when and why. A policy document alone does not demonstrate an operating control.
Hands-on Five levels
Identity & CIAM 09
PingOne, DaVinci & device identity PingOne provides identity services; DaVinci orchestrates connected steps. A consumer account, phone and physical device are separate identities.
Current work Five levels
Identity & CIAM 10
OAuth, OIDC & PKCE OIDC adds identity to OAuth. The ID token identifies the user to the client; the access token authorizes access to its intended resource.
Current work Five levels
Identity & CIAM 11
Access governance & lifecycle Authentication proves identity; authorization decides allowed actions; governance checks whether access remains appropriate.
Foundation Five levels
UEM & IT Support 12
Desktop troubleshooting & service operations Troubleshoot from symptoms to evidence. Record reproduction steps, impact and changes so another engineer can continue.
Basic experience Five levels
UEM & IT Support 13
Configuration Manager & Intune Co-management allows Configuration Manager and Intune to manage Windows devices together, with workload ownership deliberately assigned.
Learning goal Five levels
UEM & IT Support 14
Jamf & device lifecycle UEM spans enrollment, configuration, updates, inventory, access and retirement. Apple management has platform-specific workflows.
Learning goal Five levels
AI & Agentic Systems 15
RAG, models & agent orchestration RAG retrieves supporting context; an agent selects actions. Neither automatically guarantees a correct answer or authorized action.
Foundation Five levels
AI & Agentic Systems 16
Responsible AI & guardrails Evaluate accuracy, harm, privacy and accountability against the actual use case. Guardrails require testing and operational ownership.
Foundation Five levels
AI Security 17
AI inventory & runtime protection Inventory models, data, dependencies and tool permissions. Product labels vary; assess the controls each solution actually provides.
Foundation Five levels
Application Security 18
DevSecOps & application posture Security checks belong throughout delivery. SAST inspects code, DAST exercises a running app and SCA analyzes dependencies.
Foundation Five levels
Cloud Infrastructure 19
AWS & Azure architecture Compare compute, network, identity, storage and operations requirements before selecting a cloud service. Managed services still require secure configuration.
Foundation Five levels
Cloud Security 20
Cloud posture, data & access Understand the security problem behind each acronym: configuration, sensitive data, entitlements, workload protection or access.
Foundation Five levels
CXM & RevOps 21
Customer platforms & business outcomes Connect platform capabilities to customer journeys and measurable business goals rather than treating every tool as interchangeable.
Foundation Five levels
Shared Foundations 22
Computer systems & operating systems Reproduce a symptom before changing settings. Permissions, logs and resource limits determine whether a process can operate safely.
Foundation Five levels
Shared Foundations 23
Networking, DNS & TLS Trace resolution, route, transport and application separately. Encrypted transport does not replace application authorization.
Foundation Five levels
Shared Foundations 24
Web, APIs & authorization Validate input and authorize the specific operation and object server-side. A successful login does not authorize every record.
Foundation Five levels
Shared Foundations 25
Data, databases & evidence Preserve provenance and enforce ownership in every query. Data minimization and retention depend on purpose and applicable obligations.
Foundation Five levels
Shared Foundations 26
Software delivery & version control Separate authoring, reviewing, building and release authority. Validate behavior before promoting a change.
Foundation Five levels
Your learning baseline Two years in SOC operations · Brief desktop-support experience · Current identity POC work · Foundational self-study across AI, cloud and enterprise platforms. These labels describe your supplied background; they are not certifications or verified proficiency scores.