Security Analyst Training

# Training paths

SOC analyst training paths by starting point, with real costs

Published Published by Security Analyst Training

Most “how to become a SOC analyst” roadmaps give one list for everyone. In practice the right next step depends on three things: what you already know, what you can spend, and what you need the next step to prove. This guide walks through worked examples from our training planner, using prices from each provider’s official page.

Path 1: new to IT, minimal budget, wants a recognised credential

  1. TryHackMe Premium for three months — $16.99/month on the monthly plan[TryHackMe], so $50.97. Use this step to get comfortable with networking, Linux and Windows before SOC-specific material.
  2. ISC2 Certified in Cybersecurity (CC) — $199 for the exam[ISC2]. No work experience is required. Keeping it costs a $50 annual maintenance fee and 45 CPE credits per three-year cycle.
  3. Later: CompTIA Security+ — widely used as a baseline credential; we could not verify CompTIA’s voucher price on our check date, so check the CompTIA store.

Verified total for steps 1–2: $249.97, before tax, with ISC2’s $50/year fee on top once certified.

If you can spend more on structure, the Google Cybersecurity Certificate costs $49/month on Coursera in the US after a 7-day trial, and Google says many learners finish in three to six months[Grow with Google]. Four months would be $196.

Path 2: in IT, moderate budget, wants proof of hands-on skill

  1. Blue Team Level 1 (BTL1) — £399 GBP for training and exam, with four months of course access, browser labs, one 24-hour practical exam and one free resit[Centri (BTL1)].
  2. Later: CyberDefenders CyberRange — $25/month for investigation labs[CyberDefenders], to keep skills current.

The planner skips the fundamentals step here on the assumption — ours, not a provider’s — that help-desk and admin staff already work with networks and operating systems daily. For the alternatives — CCDL1, HTB CDSA and TryHackMe SAL1 — see practical SOC certifications compared.

Path 3: targeting a Microsoft or Splunk SOC

If job ads you are interested in name a specific SIEM, a vendor exam can be a direct signal:

  • Microsoft SC-200 — $165 in the US, 100 minutes, renewed for free each year through an online assessment on Microsoft Learn[Microsoft Learn].
  • Splunk Certified Cybersecurity Defense Analyst — $130 per attempt, 66 multiple-choice questions in 75 minutes, no prerequisites[Splunk].

Newcomers to IT should still do a fundamentals step first; the planner adds one automatically.

Path 4: already a Tier 1 analyst

  • CompTIA CySA+ — CompTIA recommends about four years in a SOC or vulnerability analyst role[CompTIA], which makes it a natural step up rather than a starting point. Price not verified on our check date.
  • GIAC GCIH — $999 per attempt, $499 to renew[GIAC]. Realistic mainly when an employer pays.

How to choose between the paths

  • You keep getting filtered out of applications: prioritise a recognised credential (Path 1).
  • You get interviews but struggle with technical questions: prioritise a practical exam and labs (Path 2).
  • Your target employers all use one SIEM: add the matching vendor exam (Path 3).

Run your own combination in the planner, or compare every option in the certifications table.

Certification records used here

Sources

  1. TryHackMe: tryhackme.com/pricing — checked 2026-10-22, rendered in a headless browser
  2. ISC2: www.isc2.org/certifications/cc — checked 2026-10-22, rendered in a headless browser
  3. Grow with Google: grow.google/certificates/cybersecurity/ — checked 2026-10-22, direct HTTP fetch
  4. Microsoft Learn: learn.microsoft.com/en-us/credentials/certifications/security-operations-analyst/ — checked 2026-10-22, rendered in a headless browser
  5. Splunk: www.splunk.com/en_us/training/certification-track/splunk-certified-cybersecurity-defense-analyst.html — checked 2026-10-22, direct HTTP fetch
  6. CyberDefenders: cyberdefenders.org/pricing/ — checked 2026-10-22, rendered in a headless browser
  7. Centri (BTL1): www.centri.org/certifications/blue-team-level-1 — checked 2026-10-22, direct HTTP fetch
  8. CompTIA: www.comptia.org/en-us/certifications/cybersecurity-analyst/v4/ — checked 2026-10-22, direct HTTP fetch
  9. GIAC: www.giac.org/certifications/pricing — checked 2026-10-22, rendered in a headless browser

Related guides