What I learned from the TryHackMe SOC Level 1 path

2026-06

I chose the SOC Level 1 path because it lines up directly with what I want to do in cybersecurity right now. A SOC analyst role is one of the few genuinely entry-level positions in this field-a place where you can get started without prior professional experience and build the foundation everything else rests on. Longer term I'm drawn to either the red team side or security engineering toward DevSecOps, but both of those realistically expect experience first. SOC L1 is where that experience begins, so it's where I decided to focus.

What the path covers

The path is built around the day-to-day work of a security operations centre, and it's broader than I expected. It moves through cyber defence frameworks like the Cyber Kill Chain and MITRE ATT&CK, cyber threat intelligence, network security and traffic analysis, endpoint and Windows event monitoring, SIEM platforms, and an introduction to digital forensics and incident response. The thread connecting all of it is the core SOC loop: detect a suspicious signal, investigate it, understand what actually happened, and decide how to respond.

What surprised me

What I enjoyed most was the balance between theory and hands-on work. A large number of rooms don't just explain a concept, they hand you an actual problem and ask you to solve it. That's where the material really stuck.

My favourite parts were working inside a SIEM, using tools like Splunk and VirusTotal, and mapping activity against the MITRE ATT&CK framework. There's a particular satisfaction in tracing an incident back to its origin and seeing how a chain of events that began with something like a phishing campaign connects, step by step, into a full picture. Breaking an alert down into its individual pieces and following how they fit together is the part of this work I find most rewarding.

The hardest material for me was the cryptography and encryption tasks. That's the area where I still have the most to learn, and it's high on my list of things to study more deeply rather than something I'm going to pretend I've already mastered.

Tips if you're starting it

The best advice I can give is to ask for help the moment you get stuck, instead of grinding against the same wall for hours. That might mean a friend, searching for the answer online, or using an AI assistant. What matters is that you use the help to understand every step needed to solve the task, not just to reach the answer and move on.

The same goes for the lessons themselves: don't read them mechanically. Read for understanding, and if something isn't completely clear, slow down and dig into it. I often ask an AI assistant to simplify an explanation or give me concrete examples until a concept genuinely clicks. The goal isn't to finish the path, it's to be able to explain what you did and why.