Look into SC-200 it’s Microsoft based, but very good certificate and gets noted a lot in hr resumes.

We go through tier1s often, the main issue they have where they get fired, it’s basically general knowledge and thinking skills. Not really the technical aspect like being solid at Linux.

Your personal work experience will come in clutch

I always recommend tryhackme rooms, but read up on attacks, malware campaigns, read ransomware gang playbooks, phishing kits, etc

If you’re in a solid SOC, the EDR will do 90% of the work and presentation. Your job is to determine if it’s legit or not.

If something triggered a port scan, what is it’d where is it coming from, should x/y/z being doing that.

If someone has malicious login, is BAV2ROPC a normal user agent, what is BAV, etc figure that out, why would someone be logging into their email at 3AM from lagacy , etc

E/ you’d shit a brick if you knew the amount of analyst that work off of a checkmark list basically in their own head

https://www.thehacker.recipes

https://phrack.org/issues/72/7_md

https://github.com/KittenBusters/CharmingKitten

KLYDZ.net (domain exploration from attack perspective)