I've always been curious about cybersecurity. Not just "it seems cool," but the real stuff — how systems get broken into, and how someone catches it happening.
So today I'm starting something new: six months of focused learning to go from "interested in this" to "could actually do this job." My goal is to become a SOC analyst — someone who watches for and responds to security threats.
I'll be honest about why: I want this to become a real job, not just a hobby. Both things are true — I like this stuff, and I need it to pay off too.
I'm not a complete beginner. I know some basic networking and Python, and I've already done part of a CCNA course and a cybersecurity bootcamp. But there's a big difference between watching videos and actually being able to look at logs and understand what's happening. That's what I want to fix.
Here's the plan, roughly:
- Build a home lab to practice in
- Learn the tools SOC teams actually use, like Wazuh and the ELK stack
- Practice real incident response, not just theory
- Use Python to automate parts of log analysis
- Build a few real projects I can show in interviews, not just certificates
I can give this about 10-15 hours a week. That's not a lot, so I'm writing here regularly to keep myself accountable. If I have to post about it, I'm less likely to quietly give up.
Today I set up Linux and installed VirtualBox — small step, but everything else builds on it. Next up is creating my first Kali Linux virtual machine.
I also went to a Pure7 cybersecurity training (running July 22-25, 2026). Today had two sessions: SOC Operations, led by Furkan Çelik (Head of Blue Team), and Threat Intelligence, led by Adil Soybalı (Security Engineer).
The most useful part was seeing a full SOC laid out as one system instead of separate buzzwords. Logs come in from everywhere — firewalls, IPS, Windows, Linux, mail servers — into a SIEM. The SIEM checks them against threat detection rules based on MITRE ATT&CK. If something looks bad, EDR/XDR and SOAR kick in to respond, while threat intelligence and vulnerability management feed information into the whole loop the whole time. Reading about SIEM and SOAR as separate terms is one thing. Seeing how they actually connect is another.
Day 1.
Top comments (0)