NOOB2ROOT — What Three Years in a SOC Taught Me About Breaking In

When I walked into a Security Operations Centre for the first time, I thought I had a pretty good idea of how attacks worked.

I'd just finished my studies. I had my eJPT. I'd scanned boxes, popped shells in labs, and felt like I understood the offensive side of the house reasonably well. What I didn't understand, at all, was what happens on the other side of the wire when you do those things.

What does a blue team actually see? Which of my "quiet" lab techniques would light up a dashboard? Who's watching, and what do they do about it?

I had no idea. I was in for a session.

This is the story of the two and a half years I spent in a SOC, and why I think it was the best possible preparation for a career in breaking in.

#Walking in green

Nobody hands you a manual that says "here's what a SOC is really like." You learn by drinking from the firehose.

The first thing that hit me was the sheer volume. Thousands of events, hundreds of alerts, dozens of dashboards. Every login, every process, every email, every DNS query leaves a trace somewhere. In a lab, you're the only one on the network. In the real world, you're a single thread in an enormous, noisy tapestry, and the defenders' whole job is to pull on the threads that look wrong.

That reframing changed how I thought about offensive security before I'd even been there a month.

#The stack I had to learn (fast)

A SOC isn't one tool. It's an ecosystem, and I had to get comfortable with all of it:

SIEM platforms — plural. Different customers, different platforms, different query languages. Learning to think in queries rather than in clicks was one of the most valuable skills I picked up.
Endpoint detection and response — seeing process trees, command lines, and parent-child relationships in real time.
Email security — phishing, malicious attachments, spoofed senders, and all the ways people try to get a foot in the door through an inbox.
Identity and cloud security — sign-in logs, risky users, impossible travel, conditional access, and the reality that for many organisations, identity is the perimeter now.
Network security telemetry — firewalls, proxies, and DNS, where so many investigations either start or get confirmed.
Automation and orchestration — playbooks that enrich, triage, and sometimes respond before a human even looks.
Threat intelligence — taking indicators and context and turning them into something actionable.

Working for a large organisation gave me the opportunity to learn a huge amount. But the cherry on top was that we were a big managed security service provider. That meant I wasn't looking at one environment — I was looking at many. Different industries, different architectures, different levels of maturity, different ideas of what "normal" looks like.

If you want to understand how varied real-world environments are, there aren't many better places to be than an MSSP.

#What the blue side taught me about the red side

This is the heart of it. Here's what sitting on the defensive side taught me about offence.

1. Your lab habits are loud. Plenty of things that feel routine in a lab — broad scanning, aggressive enumeration, spraying credentials, running commands straight out of a cheat sheet — look very obvious from the other side. Once you've triaged those alerts yourself, you stop assuming you're invisible.

2. Context is everything. A single event rarely tells the whole story. What makes an analyst sit up is when something doesn't fit: the wrong parent process, the wrong user, the wrong time, the wrong location. Understanding what "normal" looks like in an environment is just as important to an attacker as it is to a defender.

3. Detection is layered. You might slip past one control, but there's usually another watching from a different angle — endpoint, identity, network, email. Real adversaries have to think about all of them at once, and so should anyone doing authorised testing.

4. Defenders are human. Analysts work queues. They get tired. They see the same benign alert for the hundredth time and start to recognise patterns quickly — sometimes too quickly. That's not a criticism; it's a reality of the job, and it's something every organisation needs to design around.

5. The best offensive work makes defence better. Once you've been the person who has to write up an incident, you understand that the real value of a pentest or red team isn't the shell — it's what the blue team learns from it. That mindset is exactly why I'm drawn to purple teaming and detection engineering today.

#Putting in the hard yards

I'll be honest: the SOC alone wasn't going to get me where I wanted to go. I had to put the hard yards in outside of the day job.

While working my SOC duties, I went after:

PNPT — to sharpen the practical, real-world side of penetration testing.
SC-200 — to go deep on Microsoft's security operations stack.
GCIH — to formalise my incident handling knowledge and understand attacker techniques from a responder's point of view.
AZ-900 — to build a solid foundation in cloud, because so much of what we defend (and attack) lives there now.

Balancing study with SOC work isn't easy. There were plenty of evenings and weekends that went into labs and notes instead of downtime. But every certification fed back into the job, and the job fed back into the certifications. Learning something new in the course and then seeing it in a real alert the following week is one of the most satisfying feelings in this field.

Going over and above isn't about collecting badges. It's about making sure you actually understand what you're looking at.

#The honest part: burnout is real

If you enjoy learning, SOC work is genuinely rewarding. You'll see more in a year than many people see in five.

But SOC burnout is not a myth.

Triaging the same false positive again and again wears you down. The repetition can make you sloppy — and in a SOC, sloppy is dangerous. The one time you close an alert on autopilot could be the one time it was real.

A few things I learned about looking after myself:

Take the break. A proper holiday — not a long weekend spent checking the queue — is how you recharge. Come back rested and you come back sharper. I always came back ready to go at 1000%.
Keep learning. New skills and side projects kept the work interesting and gave me something to look forward to beyond the alert queue.
Speak up about noise. Repetitive false positives are a tuning problem, not a personal failing. Raising them helps the whole team.

Look after yourself. The attackers don't take holidays, but you're no use to anyone if you're running on empty.

#From noob to root

That's what this blog is about. I came into the industry not really knowing what I was getting into, and I've been learning my way up ever since — from the SOC floor to offensive security.

Everything I do on the offensive side today is shaped by those years watching the alerts roll in. I think about what the analyst will see. I think about what will help the blue team get better. And I never assume I'm invisible.

If you're sitting in a SOC right now wondering whether it's the "right" path into offensive security: it absolutely can be. Soak it all up. Put in the hard yards. And take your holidays.

More to come.

— Zee