The task
Two parts: a researched analysis of how real SOCs work, and a reflective plan for your own path into one. This week is orientation, so the project is about understanding the profession you are entering — grounded in real research, not generic description.
Part A — How a real SOC works (roughly 1,000 words)
Research real SOC operations — job postings, published SOC descriptions, talks and write-ups by practitioners, MSSP service descriptions. Then write:
1. The operating model
How a SOC is actually structured and staffed. Tiers, shifts, roles. Compare in-house and MSSP models — how does watching one organisation differ from watching many, and what does that mean for the analyst's day? Given that much Nigerian SOC work is at MSSPs, treat that model seriously.
2. The tooling
What real SOCs actually run. SIEM (you are learning one), EDR, SOAR, threat intelligence. You do not need deep knowledge of each — name them, say what category each is and what problem it solves, and note where Wazuh sits in that landscape and what it does and does not cover.
3. The metrics and their traps
The metrics real SOCs are judged on, and — using this week's lecture — at least two ways those metrics distort behaviour. Ground it: find or reason out a concrete example of a metric pushing analysts toward the wrong action. This section separates people who understand SOCs from people who have only read the brochure.
4. The reality
An honest picture of the work, drawn from practitioners' own accounts where you can find them. The good and the hard — shift work, alert fatigue, the repetition, and what makes it worthwhile. Avoid both the glamour and the cynicism; aim for the truth a working analyst would recognise.
Part B — Your path (roughly 600 words)
1. The target
Find two or three real SOC analyst job postings you could realistically aim for after this course, Nigerian or remote. For each, list what it requires and honestly assess yourself against it — what you will have by Week 12, and what gaps remain.
2. The plan
Given those gaps, a concrete plan: what you will build in this course (your detection portfolio, your investigation write-ups), and what you would pursue beyond it — a certification, home-lab practice, a specialism. Specific and realistic, not "I will keep learning."
3. The honest self-assessment
One paragraph: what about this work genuinely appeals to you, and what concerns you? Shift work, the pressure, the repetition of Tier 1 — name what worries you honestly. Going in clear-eyed is how people last in this profession rather than burning out in a year.
How this is marked
| Weight | What is being assessed |
|---|---|
| 25% | Part A3 — genuine understanding of metrics and how they distort, with a concrete example |
| 25% | Part A — accurate, researched, real (not generic filler) |
| 20% | Part B1 — honest self-assessment against real job requirements |
| 15% | Part B2 — a specific, realistic plan |
| 15% | Honesty throughout — this is where the reflective sections earn their marks |
Notes
- Cite your sources. Real postings, real write-ups. A project built from one AI summary is transparent and scores poorly — use sources, read them, cite them.
- This is the least technical project in the course. Every week after is hands-on. Use this one to make sure you actually want the job you are training for — that clarity is worth the week.
Submit
Push as week-01-soc-analysis.md in your analyst notebook, sources listed. Submit the link on this lesson.