How I’m Starting My Cybersecurity Journey: From Student to SOC Analyst

Featured image starting the CyberSec Path journey

I’m not a cybersecurity expert. I’m a student who got curious about how attacks actually happen, how defenders catch them, and how security teams respond when something goes wrong and that curiosity turned into a decision to learn this properly, out loud, in public.

This is the first post on CyberSec Path, and I want to start by being honest about where I actually am: at the beginning. I’m not here to teach you things I’ve mastered. I’m here to document what I’m learning as I learn it, mistakes included.

Cybersecurity can look overwhelming when you first start. There are hundreds of tools, different technologies, many career paths, and a constant stream of new threats to understand. My goal isn’t to learn everything at once. I want to build a strong foundation, practice consistently, and gradually turn theory into skills I can actually use.

Why I Started Learning Cybersecurity

For me, it started with a simple question: when a company gets breached, what actually happens behind the scenes? Not the headline version — the technical version. Who notices first? What do they look at? How do you go from “something looks off” to “here’s exactly what happened and how we stop it”?

That question kept pulling me in. The more I read about attacks, the more I wanted to understand the defensive side — how logs tell a story, how an alert becomes an investigation, and how analysts piece together what an attacker did from scattered fragments of evidence.

I also became interested in the fact that cybersecurity is not only about tools. A good defender needs curiosity, patience, attention to detail, and the ability to ask the right questions. An alert by itself does not explain an incident. Someone has to investigate it, understand the context, and decide what should happen next.

My Goal: Becoming a SOC Analyst

Right now, my direction is clear even if my skills aren’t fully there yet: I want to work toward a SOC Analyst role on the Blue Team side.

To me, becoming job-ready means being able to understand what is happening on a system or network, recognize suspicious activity, investigate evidence, and communicate findings clearly. It is a long-term goal, so I’m approaching it one skill at a time.

• Log analysis — reading logs and understanding what they’re telling me
• Threat detection — recognizing what normal looks like so I can spot what isn’t
• Incident investigation — following evidence from first alert to root cause
• Security monitoring — understanding how SOCs watch environments
• Windows security — understanding enterprise Windows activity
• Linux security — understanding systems and logging
• Networking — understanding traffic and how attacks move through networks

What I’m Currently Learning

Right now, my learning is spread across a few core areas. These topics are connected, so I don’t see them as completely separate subjects. Networking helps me understand traffic, operating-system knowledge helps me understand events, and logging helps me investigate what happened.

• Cybersecurity fundamentals
• Networking fundamentals
• Linux — command line, file systems, permissions, and logging
• Windows security
• Windows Event Logs
• Sysmon and endpoint visibility
• SIEM concepts
• SOC workflows
• Incident detection and investigation
• Security tools
• Malware analysis in isolated, safe lab environments

Building Practical Cybersecurity Labs

One thing I’ve realized quickly: reading about security concepts and actually seeing them happen are two completely different experiences.

So I’m building my own practical lab environment — controlled, isolated virtual machines where I can safely generate logs, experiment with Sysmon configurations, and get comfortable with what security monitoring actually looks like from the inside. It’s not fancy. It’s a set of VMs, some logging tools, and a lot of trial and error.

The lab gives me something that a textbook cannot: the ability to repeat a scenario. I can make a change, observe the resulting events, investigate them, make another change, and compare what happened. That repetition is helping me understand not only what a tool does, but why the resulting data matters.

The goal isn’t to break things for the sake of it. It’s to understand, in a safe and contained way, what defenders are actually looking at when they investigate something — and to build that instinct through repetition rather than just reading definitions.

A controlled virtual lab for hands-on security monitoring and analysis

Why I’m Choosing Practical Learning

I could spend all my time reading theory and collecting certifications. Certifications matter, and I’m not dismissing them. But there’s a real gap between knowing the definition of a SIEM and actually sitting down, opening a set of logs, and figuring out whether an alert is a false positive or a real problem.

Theory tells you what a brute-force attack is. Practice is staring at a wall of failed login attempts and having to decide whether this is noise or something worth escalating.

That’s the gap I’m trying to close for myself and honestly, it’s the gap a lot of beginners in cybersecurity struggle with. It’s easy to memorize terms. It’s harder to develop judgment. Judgment comes from doing the work repeatedly until patterns start to feel familiar instead of abstract.

That is also why I want the content on CyberSec Path to be practical whenever possible. Instead of only saying “this tool is useful,” I want to explain what I used it for, what I observed, what went wrong, and what I learned from the process.

Why I Created CyberSec Path

I started CyberSec Path because I wanted a place to document all of this honestly not a highlight reel, but the actual process.

Learning in public also gives me a reason to stay consistent. When I write something down, I have to understand it well enough to explain it. When a lab doesn’t work, documenting the troubleshooting process can turn a frustrating mistake into something useful for the next person.

That means writing about:

• Things I learn, as I learn them
• Labs I build, including the ones that don’t go as planned
• Tools I try out and what I think of them
• Problems I run into along the way
• Solutions I eventually figure out
• Small cybersecurity projects I work on
• SOC and Blue Team concepts as I understand them
• Career and certification lessons as I go through the process myself

What Readers Can Expect

Going forward, here’s what I’m planning to write about on this blog.

Whenever possible, I want to write about things I’ve actually tried, tested, and learned from myself. When something is based on research rather than my own hands-on experience, I’ll make that clear instead of presenting it as personal experience.

• Cybersecurity tutorials for beginners
• SOC Analyst-style labs and walkthrough
• Blue Team exercises and detection concepts
• Linux and Windows security basics
• Security tools I’m learning and using
• Log analysis practice and examples
• Practical, hands-on projects
• Certification guidance based on my own research and experience
• General cybersecurity career guidance for students

What Comes Next

I’m not going to promise you a fully built-out SOC lab series next week, because that wouldn’t be honest I’m still building the foundation. What I can promise is that the next few posts will start getting into specifics: my lab setup process, the first tools I’m getting comfortable with, and early notes from working through logs and events.

Over time, I want these posts to connect into a practical learning path. Someone should be able to read about a concept, try a small exercise, understand the result, and then move on to something slightly more advanced.

If you’re a student, a beginner, or someone trying to pivot into cybersecurity the same way I am, I think you’ll recognize a lot of this journey. Stick around this is genuinely just the start.

Conclusion

I don’t have all the answers yet. I’m not a SOC Analyst I’m a cybersecurity student working toward that goal, one log file and one lab session at a time. CyberSec Path is where I’m going to document that process, mistakes and all, in the hope that it helps someone else walking the same path.

This journey is going to take time. There will be confusing topics, broken labs, and plenty of moments where I have to go back and relearn something I thought I already understood. That’s fine that’s the process. The goal is just to keep moving forward.

Learn. Practice. Build. Secure.

Originally published at http://cybersecpath3.wordpress.com on September 4, 2026.