Cyber Defense Analyst (SOC)
- Home
- Career Tracks
- Cyber Defense Analyst (SOC)
Detect, triage and respond on the evidence
A three-stage track for analysts who monitor, triage and respond in a security operations center (SOC). It builds from Security+ fundamentals to hands-on detection and incident response and CySA+ exam preparation, with the 72-hour DFARS 252.204-7012 incident-reporting clock built into the exercises.
The track at a glance
| Stage | Focus | You leave able to |
|---|---|---|
| 1 · Foundational | Security Fundamentals & CompTIA Security+ Prep | Explain and apply core security controls, and sit the Security+ exam. |
| 2 · Specialization | SOC Operations & Detection | Triage alerts, write and tune detections, and document findings others can follow. |
| 3 · Certification | Incident Response & CompTIA CySA+ Prep | Run an incident from detection to report, and sit the CySA+ exam. |
Stage 1 — Security Fundamentals & CompTIA Security+ Prep
Threats, identity and access, secure architecture, hardening, monitoring basics and governance, plus preparation for the CompTIA Security+ exam. New to IT? Start with the IT Support to Security track.
Stage 2 — SOC Operations & Detection
Log sources and SIEM triage, alert tuning, endpoint and identity telemetry, mapping activity to MITRE ATT&CK, threat intelligence basics and vulnerability management.
Stage 3 — Incident Response & CompTIA CySA+ Prep
The incident handling lifecycle (NIST SP 800-61), containment and evidence preservation, DFARS 252.204-7012 reporting and image preservation, a hands-on response capstone, and preparation for the CompTIA CySA+ exam.
DoD 8140 alignment
The certifications this track prepares for appear in the DoD 8140 qualification matrix as foundational qualification options for these DCWF work roles:
| Certification | Work roles (DCWF code) |
|---|---|
| CompTIA Security+ | 511 Cyber Defense Analyst, 531 Cyber Defense Incident Responder, 541 Vulnerability Assessment Analyst, and other cybersecurity and IT work roles |
| CompTIA CySA+ | 511 Cyber Defense Analyst, 531 Cyber Defense Incident Responder, 541 Vulnerability Assessment Analyst |
Based on the DoD 8140 qualification matrix (version 2.1, effective 19 September 2025). The proficiency level a certification satisfies differs by work role, and your contract sets what applies, so we confirm it person by person in a Workforce Readiness Assessment. A certification covers foundational qualification only; resident (on-the-job) qualification and at least 20 hours a year of continuous professional development can also apply.
Roles you’ll be ready for
Cyber Defense Analyst, Cyber Defense Incident Responder and Vulnerability Assessment Analyst.
About the exam preparation. VIS builds and teaches its own preparation material for the CompTIA Security+ and CySA+ exams. VIS is not a CompTIA or ISC2 training partner and this is not official courseware. Exam vouchers are bought separately from the certification body. CompTIA Security+ and CySA+ are trademarks of CompTIA.
Frequently asked questions
Who is this track for?
Analysts in or moving into a security operations center, IT staff who handle alerts, and responders on defense-contractor teams.
Is this official CompTIA training?
No. VIS builds and teaches its own exam-preparation material and is not a CompTIA training partner. Exam vouchers are bought separately from CompTIA.
What experience do I need?
Stage 1 assumes basic IT and networking knowledge. If you are new to IT, start with the IT Support to Security track.
How is it delivered?
Live-virtual, instructor-led cohorts. Cohorts run once minimum enrollment is met; next dates announced soon.
Start the track
Cohort-based and live-virtual. Join the next cohort.
Next cohort: dates announced soon
Live virtual, instructor-led
Per stage (one live-virtual cohort each):
Stage 1 · $499
Stage 2 · $899
Stage 3 · $899
Full track, all 3 stages: $1,899 — save $398, no code needed
10% off Stage 1 with FALL10. Teams of 3 or more: team pricing on request; private cohorts are quoted per cohort.
Cohorts run once a minimum number of participants enroll. If yours doesn’t fill, we move you to the next date or refund you in full.
RegisterRequest a QuoteTrack stages
Training a team?
Start with a Workforce Readiness Assessment: we map each person to a DCWF work role and recommend the right stage. Private team cohorts are available.