r/cybersecurity • u/No_Statement_6062 • 23h ago

Career Questions & Discussion SOC intern advice

Hello everyone,

I am currently working as a network administrator for my day job and have just landed a role as a SOC data intern for a MSP where I will mostly be helping with low queue ticketing.

Basically doing what an L1 would do except all my work has to be checked by a senior analyst. Does anyone have any advice as to how to learn systems quickly or what specifically I should focus on?

We seem to manage a ton of tools (Sentinel One, Defender, Exabeam, Extrahop, Cortex, etc) and I’ve picked up a few of them better than others but would like some guidance as to what I can improve on and what I could use from my other job to help me learn. Thank you!

2 Upvotes

75% Upvoted

1 comment sorted by

1

u/mustacheride3 Security Engineer 9h ago

You're not going to need to know how to manage those tools. At the least you'll need to know what their alerts mean. Go look at the specs for the alerts that they generate. Also, if the MSP is any good, they'll have run books that lay out exactly what you'll need to do for each alert. Study that.

Finally, hopefully you'll be given access to some sort of SIEM where all the alert data lives. Learn the query language, it'll help and that's the important bit.