SOC Residency

REMOTE-FIRST · INDIA · APPLICATIONS OPEN

Cybersecurity knowledge is the starting point. Demonstrated capability is the standard.

A selective six-month residency for aspiring SOC analysts who need to turn foundational knowledge into investigation, judgment and defensible communication.

Apply for the Founding CohortEvaluate SOC Talent
Delivery
Remote-first
Commitment
12–15 hrs / week
Admissions
Selective · live

Founding cohort · No payment during application

Simulated incident · fixed illustrative evidence

From one suspicious email to a defensible response

What happened after the user opened the email—and what should the analyst recommend?

  1. 01Observe
  2. 02Correlate
  3. 03Infer
  4. 04Decide

Evidence 01 / 10

Raw evidence

Suspicious email alertMSG-2048 · high priority

A newly registered sender domain and urgent invoice language triggered the mail gateway.

  1. Raw evidence

    Suspicious email alert

    MSG-2048 · high priority

    A newly registered sender domain and urgent invoice language triggered the mail gateway.

THE CAPABILITY GAP

Knowing the concept is different from defending the conclusion.

A simulated queue like the one below is the raw material of the job — mostly noise, sometimes real.

Simulated alert queue · fixed illustrative data

8 open alerts across 5 domains

  • EmailEmail gatewayNewly registered domain · urgent invoice languageHighTriaging
  • EndpointEDREncoded PowerShell spawned from a shortcut fileCriticalEscalated
  • IdentityIdentity provider5 failed sign-ins from 3 countries in 4 minutesHighTriaging
  • NetworkNDRInternal host beaconing to a rare external ASNMediumNew
  • CloudCloud audit logStorage bucket ACL changed to public-readHighNew
  • CloudCloud audit logIAM role granted admin outside change windowMediumTriaging
  • EndpointEDRUnsigned binary written to a user Downloads folderLowNew
  • IdentityIdentity providerMFA method changed shortly after password resetMediumNew

CAPABILITY STANDARD

Understand enough to perform. Perform well enough to defend.

01

Understand

Read what the evidence actually says.

Simulated email evidence
02

Perform

Follow the chain across telemetry sources.

Simulated endpoint telemetry
  1. explorer.exeInvoiceReview.lnk opened
  2. powershell.exe-w hidden -enc … (encoded)
  3. rundll32.exeLoaded from a temp directory
03

Defend

State the decision and its uncertainty.

Simulated response decision

Priority: High

Contained WKSTN-042 · revoked active session

Evidence
3 correlated events across mail, endpoint and network
Uncertainty
Destination infrastructure not yet attributed
Where investigation becomes judgment.

A PROFESSIONAL PROGRESSION

Less instruction over time. More ownership, ambiguity and accountability.

Residents move from guided foundations into independent investigation, triage, documentation and communication—with approximately 12–15 structured hours each week.

Foundations

Guidance
Ambiguity
Ownership
Communication

Job-ready evaluation

Guidance
Ambiguity
Ownership
Communication
See the full progression model

EVIDENCE OVER ATTENDANCE

Competency should be inspectable, not implied.

Assessment records connect scenario conditions, investigation decisions, technical findings and communication quality. Illustrative records never stand in for cohort outcomes.

Sample record — illustrative data, not cohort outcomes
  • Evidence collection8 assessed itemsDemonstrated
  • Investigation reasoning6 assessed itemsDeveloping
See how employers evaluate residents

TWO PATHS

Whether you are building capability or hiring for it.

For employers

Review assessed investigation work and communication evidence before you interview.

Evaluate SOC Talent

SELECTIVE ADMISSIONS

Apply to establish your starting point and readiness for the residency.

Submitting an application does not guarantee acceptance. Shortlisted applicants will be invited to a next-stage assessment before an admission decision and cohort onboarding.

Apply for the Founding Cohort