Plot a route
Pick where you are now and where you want to get to. Atlas draws a realistic route, lets you optimise it for time, cost or coding, and explains what each step actually asks of you.
Optimise for
Your next step
IT Support → SOC Analyst
Prepare evidence for this move first.
- One alert or incident you worked end to end, written up in a page
- A log source you can describe in detail, including what it misses
A lab can show learning, not production ownership. Label examples honestly and keep confidential information out.
Build my Route BriefClassroom mode. No account; the brief is not saved to this machine.
Stretched route, one hop does most of the work
SOC Analyst to Detection Engineer is roughly a £32k step on TechWaymark's estimates. A gap that size is not closed by the next certification. It is closed by operating evidence: something you owned, at production scale, that the interview can be taken through end to end. Without that, this is the hop where the route stalls.
IT Support to Detection Engineer is reachable but uncommon. The endpoint depends on org context, timing and trust, not just skill progression.
- Reachability
- Stretch
- Timeline
- ~3–5 years · +£38k · 2 hops
An intermediate role to consider before Detection Engineer: SOC Analyst or Defender/Sentinel Engineer. Authored detections and a maintained content lifecycle can support the move.
Sigma or query fluency without testing and maintenance. Show shipped or clearly labelled lab detections, tuning decisions and observed false positives.
Reachable, not typical. Expect timing, org context, and trust to do more of the work than skill progression.
Of the hops on this route, TechWaymark rates this one weakest (documented). That makes it the likeliest place for a plan to stall, and it is a judgement about the transition, not a measured failure rate. The cost is named as Biggest risk above.
Salary and time figures are TechWaymark practitioner estimates, not survey data.
- BottleneckIT Support↓ SOC AnalystAdjacent pivot
Most SOC analysts come through support, alert triage rewards ticketing instincts.
~1–2y on step·+£6k·documented - Common hopSOC Analyst↓ Detection EngineerSpecialisation
Detection engineering is the natural senior path out of SOC.
TradeoffYou move from reacting to writing the rules others react to. Mistakes are now systemic, not individual.
~2–3y on step·+£32k·common
What the labels on this route mean
- Adjacent pivot
- Cross-domain move documented in real careers. Senior in your old lane, mid-level in the new one for a year or so.
- Pacing: documented
- TechWaymark rates this real but not the default: it turns up in career histories without being the obvious next move.
- Specialisation
- Narrower remit within the same domain. You go deeper on one thing and adjacent doors quietly close.
- Pacing: common
- TechWaymark rates this a load-bearing transition: the move the rest of the route is built around. A judgement about the transition, not a measured rate.
Most of the calendar time on this route sits here. If you're impatient, this is the step to question.
The full interactive map is easier to explore on a larger screen.
Stretched route, one hop does most of the work
SOC Analyst to Detection Engineer is roughly a £32k step on TechWaymark's estimates. A gap that size is not closed by the next certification. It is closed by operating evidence: something you owned, at production scale, that the interview can be taken through end to end. Without that, this is the hop where the route stalls.
Of the hops on this route, TechWaymark rates this one weakest (documented). That makes it the likeliest place for a plan to stall, and it is a judgement about the transition, not a measured failure rate. The cost is named as Biggest risk above.
This destination calls for specialist evidence and an opportunity to take on the work. Progress depends on your experience, the organisation and available roles; the plotted route is not a prediction of promotion.
Authored steps carry TechWaymark's own written rationale. Inferred steps are derived from the shape of the graph alone and deserve stronger scrutiny before you plan around them. Salary and time figures are TechWaymark practitioner estimates, not survey data.
- 1IT SupportSOC AnalystAdjacent pivot
Most SOC analysts come through support, alert triage rewards ticketing instincts.
~1–2y on step·+£6k·documented - 2SOC AnalystDetection EngineerSpecialisation
Detection engineering is the natural senior path out of SOC.
TradeoffYou move from reacting to writing the rules others react to. Mistakes are now systemic, not individual.
~2–3y on step·+£32k·common
What the labels on this route mean
- Stretch route, endpoint is ambitious, not typical
- How trustworthy this route is, not just whether it exists. Common means load-bearing. Stretch means possible but slow or org-dependent. Compressed means Fewest steps mode has skipped realistic dwell. Rare means an uncommon hop plus an aspirational endpoint.
- Adjacent pivot
- Cross-domain move documented in real careers. Senior in your old lane, mid-level in the new one for a year or so.
- Pacing: documented
- TechWaymark rates this real but not the default: it turns up in career histories without being the obvious next move.
- Specialisation
- Narrower remit within the same domain. You go deeper on one thing and adjacent doors quietly close.
- Pacing: common
- TechWaymark rates this a load-bearing transition: the move the rest of the route is built around. A judgement about the transition, not a measured rate.