SOC Analyst Training Program
This SOC analyst training in Toronto teaches the work of a security operations centre (SOC) analyst as it is actually done: a queue, limited time, and a decision to make on each alert. You work with real log, network and endpoint telemetry throughout.
Ten weeks covers triage, investigation, security information and event management (SIEM) workflows, escalation writing and the habits that keep quality steady when volume rises.
- Duration
- 10 weeks
- Format
- Live online, instructor-led
- Prerequisites
- Security Essentials: Network, Endpoint and Cloud
- Class size
- Capped at 12 learners
What you will be able to do
- Triage an alert queue and defend the order you worked it in
- Separate a true positive from noise using corroborating telemetry
- Write a SIEM query that answers a specific investigative question
- Pivot from a single indicator of compromise to the full scope of activity
- Map observed behaviour to MITRE ATT&CK techniques
- Produce an escalation note a senior analyst can act on without asking questions
- Tune a noisy detection without losing the behaviour it was built for
- Hand over an open investigation cleanly at shift change
Course outline
6 modules
- Tiers, shifts and how work actually flows
- Service levels, metrics and what they distort
- The alert lifecycle from source to closure
- Case management and evidence hygiene
- Working with threat intelligence feeds
What you need before you start
- Completion of Security Essentials or equivalent working knowledge
- Familiarity with the command line on Windows or Linux
- Ability to read log output without being intimidated by it
- A machine that can run a browser based lab comfortably
Who this course is for
- Helpdesk and IT staff targeting a first SOC role
- Junior analysts who want structure behind what they already do
- Network administrators moving into monitoring work
- Security graduates who have theory but no queue experience
- Managed service provider technicians taking on client monitoring
Where this leads
Prepares you for
CySA+
Awarded by CompTIA
The syllabus follows the CompTIA CySA+ analyst domains closely. CompTIA is the certifying body and issues the credential; the academy provides the training only. Booking, fees and the exam attempt are arranged directly with CompTIA.
Questions about this course
More in cyber defence
Entry-levelSecurity Essentials: Network, Endpoint and Cloud
A ten week security essentials course in Toronto covering network, endpoint, cloud, identity and cryptography foundations for new defenders.
10 weeks · live online
Contact for pricingView outline
CorePractical Open Source Intelligence
Practical OSINT training in Toronto: build sock puppets, geolocate imagery, mine corporate records and turn findings into a written analytic product.
6 weeks · live online
Contact for pricingView outline
CoreEnterprise Defender: Advanced Security Essentials
An eight week enterprise defender course in Toronto for blue team staff who need deeper network analysis, incident handling and malware triage skills.
8 weeks · live online
Contact for pricingView outline
Ready to launch your cyber security career?
Join the next live online cohort. No experience required, just bring the curiosity.