Senior Security Analyst Intro (TryHackMe)
Challenge on TryHackMe: Senior Security Analyst Intro
Journey to Senior
Journey to Senior
Ready to take the next step beyond Level 1? The natural progression is to the SOC Level 2 analyst role, where juniors grow into experienced, decision-making team members. This room serves as a roadmap for getting there: the technical skills, the broader toolkit, and the new challenges and responsibilities to expect. You'll also learn how to develop a senior mindset and prepare for even more advanced roles. Let's get started!
Today, You Will Learn
How middle-senior responsibilities differ from junior ones
Which skills you'd need, and how to prepare for promotion
What a typical day as a SOC Level 2 analyst looks like
New Role, New Duties
SOC Level 2 Definition
The Level 2 analyst is a natural progression from Level 1: a middle- or senior-level technical role responsible for investigating escalated alerts and responding to threats. As Level 2, you are expected to excel at log analysis and take over basic engineering and incident response tasks. In addition, you should have strong soft skills to mentor juniors, take initiative, and properly communicate with different teams.
Typical expectations for L1 and L2 analysts from 0 to 100
New Tasks and Duties
Your schedule will typically be split between shift-based triage of escalated alerts (your core duty) and a range of supportive tasks. We'll cover L2 triage in the next room, but the supportive side of the role can be quite broad. Unless your company has a dedicated L3 position and DFIR team, you may take on lots of senior duties as an L2, for example:
Build new detection rules and run threat hunting exercises
Cooperate with the IT team to configure the network securely
Respond to infections: clean malware and rotate credentials
Participate in, or even lead IR in case of a major intrusion
And, of course, triage complex alerts escalated by Level 1
Importance of Soft Skills
The biggest difference between L1 and L2 is not in technical knowledge, but in the soft skills: responsibility, attitude, and mindset. You will need to mentor juniors and help them grow alongside you, take initiative and lead discussions, communicate effectively within the team and externally, and much more! In the next few rooms, you will learn more about the teamwork and mentorship aspects of the L2.
Answer the questions below
Should you improve tech, soft, or both skills to become L2? Both
Fun of Being SOC L2
Fun of Being SOC L2
We've talked about the duties of Level 2, but what about the benefits? Beyond the higher salary, you'll have a chance to broaden your worldview and grow in different areas: mentorship and leadership, closer cooperation with management, incident handling, engineering tasks, and much more. The role should push you out of your comfort zone and stop you from becoming a narrow specialist, incapable of doing anything beyond your favorite task:
Incident Handling
You'll deal with the most interesting cases, attacks that are too complex for L1 to investigate: infostealers that bypassed prevention, supply chain attacks, insider threats, Active Directory intrusions, and so on. You'll also move beyond SIEM-only triage and start doing on-host investigations, network and malware analysis, and even some OSINT. There, you'll:
Learn how to respond to attacks using EDR or a regular CLI
See the world beyond SIEM: host, cloud, and network points of view
Observe the same attacks you read about in threat reports and blogs
As an L2, you often handle the incident first and find it in the news only a day later.
Engineering Tasks
Only large MSSPs can afford fully analytical L2 roles. Most companies merge L2 duties with detection engineering, SIEM maintenance, and security automation. That's actually great, because the more "side" tasks you take on, the wider your worldview becomes. The broad experience you build here is vital for your growth. Some tasks you can expect:
Simulate an attack and build a detection rule to cover it
Dig deeper into how SIEMs and EDRs work internally
Automate a routine task and make your team's life easier
Have you wondered how most SIEM rules work? As L2, you'll find out!
General Security Tasks
You will dig deeper into how the company operates and what parts of it are covered by SOC. Expect more opportunities to work with IT on patching vulnerabilities, tightening policies, and securing public services. Occasionally, you will help the compliance team, analyze pentest results, or even run red teaming exercises yourself. The skills you can build here:
Learn about corporate processes and the daily life of other departments, especially IT
Discover enterprise software such as SAP, Salesforce, Jira, Stripe, and the M365 suite
Explore new security domains: pentesting, compliance, DevOps, AppSec, and more
By cooperating with IT, you will better understand how companies are breached.
Answer the questions below
Does exploring new security areas help you grow? (Yea/Nay) Yea
L1 vs L2 Mindset Shift
Sense of Responsibility
Level 2 isn't just a technical step up, it's a mindset shift. As a senior, you take responsibility for your team and for the security posture of the whole organization. You can't say "it's not my fault" after a ransomware attack, because everyone now expects ownership from you, not excuses. And the first rule of the senior mindset is simple: never ignore a security concern, whether it was raised by you or someone else.
Whenever you see a security crack, raise the alarm, even if it's not your fault
Scenario
One of the L1 mentioned that we haven't seen any alerts from the servers for two weeks.
In the past, the servers regularly generated False Positives due to IT team actions.
Junior mindset: No logs means no alerts, and no alerts means less work to do.
Senior mindset: No alerts for weeks is not OK. Something is wrong with the logging.
The senior must be 100% sure that the critical servers are well monitored. They would work with engineers to identify the root cause of the issue, run a hunt to detect log tampering attempts, and ensure the team is better prepared next time.
Attacker Mindset
It is recommended that L2 have some red teaming experience because the more you understand how attacks occur, the easier it is to understand the adversary's behavior and predict their next steps. Combined with knowledge of MITRE and the Cyber Kill Chain, the attacker's mindset will help you read between the lines and run your investigations much more quickly and in a more organized way.
Thinking like an attacker helps you complete the attack puzzle:
What happened before the alert, and what's coming next
Scenario
An alert fires for a PowerShell command spawned by the IIS web server.
The command is a simple "whoami". No more commands are seen afterward.
Junior mindset: The command is safe, this is likely expected web server activity.
Senior mindset: Looks like a test of a web shell. Malicious commands will follow later.
Even if the command is safe, the senior would first assume breach and then spend time on deep log analysis or even forensics to prove that it was not a test before the full-scale attack, but rather the expected activity of a web server.
Answer the questions below
What mindset helps you see and predict how incidents unfold? Attacker Mindset
Your Day as Level 2
Challenge
Open the static site by clicking the View Site button below. You will start from a SIEM interface and go through a daily routine of the L2 analyst: triage of escalated alerts, rule development and tuning, and responding to urgent threats. Follow the instructions in the app and get your flag.
View Site
Note: For best experience, open the app in full screen mode.
Answer the questions below
What flag did you get after completing the challenge? THM{much_more_than_alert_redacted}
```Double-Extension File Creation```
index=windows EventCode=11 TargetFilename IN(*.pdf.exe, *.pdf.lnk, ...)
| table _time host user Image TargetFilename
```Double-Extension File Creation```
index=windows EventCode=11 TargetFilename IN(*.pdf.exe, *.pdf.lnk, ...)
NOT TargetFilename IN(C:\\Program Files\\TryHackMeToolkit\\*)
| table _time host user Image TargetFilename
Next Steps
Preparing for Promotion
In this room, you have learned the duties and opportunities of the L2 role. Next, we'd suggest:
| # | Goal | Suggestions |
|---|---|---|
| 1 | Gain SOC technical skills |
Complete the SOC Level 2 Analyst path
Try yourself in different blue challenges
Monitor how L2 in your company operate
2 | Build up attacker's mindset |
Complete rooms from the Red Teaming path
Analyze historical incidents your company faced
Read cyber news, especially technical threat reports
3 | Broaden security awareness |
Discover how other teams in your company work
Volunteer for an engineering task (e.g., fix a rule)
Ask to be involved in the Incident Response tasks
4 | Validate acquired skills |
Consider passing a practical SOC or IR certification
For example, check out TryHackMe's SAL2 certification
(Evaluates both hard and soft skills across 12 domains)
See you in the next room!
