Plan your route to a mid-level security role: CySA+ or an alternative, CISSP's experience rule, and building real experience.
Why it matters
You now have the skills of a working security operations analyst: logging and SIEM queries, network detection, incident response, triage, forensics basics, vulnerability management, hardening, cloud posture and ATT&CK. The next step toward a mid-level cybersecurity engineer role is proving those skills to employers and deepening them with real experience. This lesson helps you plan that honestly.
What mid-level roles ask for
Job postings for SOC analyst tier 2, security engineer, incident responder or vulnerability management roles usually ask for some mix of:
- Experience: often 2 to 5 years in IT or security. Help desk, system administration, network administration and SOC tier 1 are common routes in.
- A certification at the analyst or practitioner level, on top of Security+.
- Hands-on skills: a SIEM, an EDR tool, scripting (Python or PowerShell), Linux, one cloud platform.
- Sometimes a degree or a security clearance, especially for government and defence work. A clearance cannot be obtained on your own; an employer sponsors it.
Certification options
Details such as exam codes, objectives, prices and experience rules change. Always check the official pages.
CompTIA CySA+ (Cybersecurity Analyst). The natural next step after Security+ for security operations. It covers security operations, vulnerability management, incident response and reporting, which matches this course closely. CompTIA recommends prior Security+ (or equivalent knowledge) and a few years of hands-on experience, but there is no formal requirement. Official page: comptia.org/certifications/cybersecurity-analyst. Checked on 2026-10-23.
ISC2 CISSP. A senior, management-leaning certification covering eight domains of security. To be certified you need at least five years of cumulative paid work experience in two or more of the domains (a relevant degree or approved credential can count for one year). If you pass the exam without the experience, you become an Associate of ISC2 while you earn it. It is a goal for a few years from now, not the next step. Official page: isc2.org/certifications/cissp. Checked on 2026-10-23.
Other options people combine with or choose instead of CySA+:
- Vendor SIEM and security certifications, such as Microsoft's Security Operations Analyst (SC-200) or Splunk's certifications, if employers near you use those tools.
- Practical blue-team certifications with hands-on exams (for example from Security Blue Team or TryHackMe).
- GIAC certifications (for example GCIH for incident handling): highly regarded, usually expensive, often employer-funded.
- Offensive certifications (CompTIA PenTest+, OSCP) if you want to move toward penetration testing.
- Cloud security certifications from AWS, Microsoft or Google if you are heading toward cloud security engineering.
Pick based on the jobs you want: read 15 to 20 real postings in your area and count which certifications and tools they mention.
Building experience without a security job
Certifications get interviews; experience gets offers. Ways to build it legally:
- A home SOC lab. Wazuh or Security Onion collecting logs from two or three VMs you own; run safe attack simulations (for example Atomic Red Team tests in the lab) and write detections for what you see.
- Free training platforms. TryHackMe's free SOC and blue-team rooms, Blue Team Labs Online free investigations, LetsDefend and CyberDefenders challenges.
- Write-ups. Short, defender-focused notes in a public repository or blog: the scenario, your queries, your timeline, your detection. Follow each platform's rules on what you may publish.
- Open source and community. Contribute Sigma rules or detection content, join local security meetups or BSides conferences, and volunteer for non-profits that need IT help (with written scope).
- Your current job. If you are in IT, ask to help with patching, log reviews or incident tickets. That counts as security experience.
A 6-month plan, as an example
| Month | Focus |
|---|---|
| 1 | Download the CySA+ objectives; rate yourself per objective; build the Wazuh or Security Onion lab |
| 2 | Logging and SIEM queries: write five detections in your lab, one write-up |
| 3 | Incident response and forensics: complete two free investigation challenges, two write-ups |
| 4 | Vulnerability management and hardening: scan your lab with OpenVAS, harden one VM against a CIS Benchmark, document before and after |
| 5 | Practice exams; review weak objectives; update your CV with lab projects |
| 6 | Take the exam; apply for SOC tier 1 or 2 and security engineer roles with your write-ups linked |
Adjust the pace to your life: 5 to 8 hours a week is realistic for most people with a job.
Common mistakes
- Collecting certifications instead of skills. Interviewers will ask you to walk through an investigation; your lab work is what lets you answer.
- Paying for expensive courses before using free ones. Free platforms and official objectives take you a long way.
- Brain dumps. Using leaked exam questions violates certification agreements and can get you banned.
- Waiting until you feel ready. Apply while you study; many people get the job first and the certification paid for afterwards.
Quick recap
- Mid-level security roles want experience, a practitioner certification and hands-on tool skills.
- CySA+ fits security operations well; CISSP needs five years' experience; vendor, practical, GIAC, offensive and cloud certifications are alternatives. Check official pages.
- Build experience with a home SOC lab, free platforms and defender-focused write-ups.
- Make a written plan with dates, and apply while you study.
Try it
Open the Do tab to write your own certification and experience plan.