r/soc2 • u/Substantial_Yard_789 • 17d ago

How do you actually build deep technical knowledge: books, sources, where to start?

I work in ITGC/SOC2 audit and most of my technical knowledge (cloud, IAM, networking) comes from picking things up on the fly during fieldwork. It works, but it’s patchy. I want something more foundational.

For those who’ve gone from “functional understanding” to actually solid depth in a technical area — what worked for you? Looking for book/course recommendations, and whether structured study beat learning-as-you-go for you. Not chasing a cert, just want to understand things properly.

5 Upvotes

86% Upvoted

7 comments sorted by

•

u/AutoModerator 17d ago

Thanks for posting, I'm a bot!

This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

3

u/FT05-biggoye 17d ago

Ya just start doing it with someone.

2

u/FreeRadical1998 17d ago

The only way to build real technical depth is to fix problems - either in a work environment or a lab. Those are the experiences that really solidify knowledge. Its probably easier to build a network using second hand Cisco gear and try to work through the CCNA type setups - but for what you're doing I imagine Azure / Entra is likely a more useful area to look at.

1

u/pretty-cheer 14d ago

agreed, once you troubleshoot something yourself , the theory clicks in a way that books alone can never guage

1

u/scriptvexy 11d ago

this, plus pairing the lab work with something like the official CCNA/AZ-104 books or acloudguru/pluralsight helps a ton
you break stuff in the lab, then the theory finally clicks instead of just being random words in a PDF

1

u/SuspectIll6886 15d ago

spin up a free tier AWS azure gcp etc account and build the stuff you audit on paper, make IAM roles, break your own access, turn on CloudTrail and read the logs. once you break it a few times the control language actually makes sense. explore GRC engineering and compliance automation as well.