The work itself
What you would spend time doing
Triage alerts, build a timeline from several sources and decide when the evidence justifies escalation. Shift handovers and clear uncertainty matter as much as tool familiarity.
Defensive · SOC
Defensive / SOC → Detection Engineer
Security monitoring work that rewards careful investigation and defensible escalation.
Explore the work, check your starting point and try one scoped task before committing to a course or exam.
Try this pathway in practiceThe route
From Junior SOC Analyst (Tier 1) to Detection Engineer
- Starting roleJunior SOC Analyst (Tier 1)Read the broader role guide
- Target roleDetection Engineer
A general route, not a personal plan. Linked guides describe the broader role family; a junior or support starting point may have a narrower remit. Compare the responsibilities with the actual vacancy.
Phased progression
Build foundations, demonstrate the work, then choose how to deepen or broaden your responsibility.
Progress through demonstrated capability and agreed responsibility. These stages are not a fixed timetable or a salary ladder.
Build the foundations
Foundations
Practical focusBuild literacy and lab habits. These are study options, not mandatory exams; choose the platform relevant to your target work.
Something to demonstrateA short account of what you can already do and the next gap to investigate.
In focus Splunk Core Certified User · BTL1
Demonstrate readiness
First role in this route
Practical focusExplore Junior SOC Analyst (Tier 1) responsibilities. Check the supervision and prior experience expected; demonstrate the relevant work before increasing your scope.
Something to demonstrateAn incident timeline and escalation note separating observed events, hypotheses and unanswered questions.
In focus Junior SOC Analyst (Tier 1)
Demonstrate reliable practice
Specialisation
Practical focusTake on a scoped responsibility, test your decisions and collect feedback. Add a credential only where it supports that work.
Something to demonstrateA test record and feedback showing how you improved a piece of work.
In focus CySA+ · Microsoft SC-200
Broaden responsibility
Deepen, lead or move sideways
Practical focusDetection Engineer or SOC Lead. Operate the platform, then design what feeds it.
Something to demonstrateExamples of broader ownership, with the scope and responsibility agreed.
In focus GCIA
Your starting point
What to bring to this route
Build familiarity with authentication, networks and operating-system events. A training lab can demonstrate investigation habits; ask what support exists before taking live incident decisions.
Ask a course provider or employerWho reviews escalations, and how does the team learn from false positives and missed incidents?
The verdict
You want supervised experience investigating security signals Shift work doesn't break you (and you've actually checked, not just assumed).
Alert volume, shift arrangements and escalation support shape this job. Ask how analysts gain feedback and whether they can improve detections alongside triage.
Certification sequence
Study options, not a checklist. Choose for the work you need to demonstrate, then check the provider’s current requirements and renewal terms.
Primary
Explore these first
Compare the subject with the work you want to do. Check eligibility before committing.
- Security+Threats, access controls, secure infrastructure and the basics of running a security function.
- CySA+Develop skills in threat detection, analysis and incident response.
- Microsoft SC-200Investigating and responding to threats using Microsoft's security-operations tools, including Sentinel and Defender.
Supporting
For a particular platform or gap
Choose one when its syllabus addresses a gap you need to practise.
Long-term
As your responsibility grows
Revisit when your scope changes. Experience and renewal requirements still apply.
Practical projects
Produce something you can explain, test and improve with feedback.
A scoped starting exercise
Try the work before choosing the route
Use a synthetic set of sign-in events with one unusual login. Compare timing, source and account behaviour, then decide what further evidence you need before escalating.
What to keepAn incident timeline and escalation note separating observed events, hypotheses and unanswered questions.
Free text worksheet · no account needed. Add your checks, results and feedback as you work.
Review the evidence
- Can you explain why this is suspicious without assuming every unusual event is malicious?
- Have you recorded a plausible benign explanation and the evidence that would change your assessment?
Label planned, simulated and completed work accurately. A practice exercise helps you test your interest and reasoning; it does not establish production experience or guarantee an interview.
Detection EngineerThreat HunterIncident Responder
- ·GRC route (lower technical bar)
- ·Cloud route then pivot to cloud security
Realistic expectations
Check these assumptions against the course, vacancy or team you are considering.
Misconception
That a title or credential establishes readiness by itself. Readiness depends on investigating a signal, explaining uncertainty and escalating safely.
Readiness check
Readiness depends on investigating a signal, explaining uncertainty and escalating safely. A transition to detection or response needs evidence of those additional responsibilities, not a fixed period in Tier 1.
What this is based on
Practitioner assessment checked against published external evidence.
Last reviewed: September 2026 · UK market · Confidence: indicative
Where this fits