ViewTube

🚨 Job offer accepted!!!!!

One of our Forge members just landed a SOC role.

And what helped them most?

Not another cert.

It was the labs, investigations, SOC simulator, weekly questions, meetings, and CTFs.

Basically… reps.

That’s why I keep saying hands-on practice matters.

Watching videos is useful, but you also need to actually investigate things, make mistakes, and learn how to explain your thought process.

Huge congrats to them 👏

If you feel like you need more of that kind of practice and want to learn more, join the free community and lets have a chat.

FREE COMMUNITY 👉 https://skool.com/mydfir-community/about

How to give yourself a better shot in a SOC interview

You can’t control who else applies.

You can’t control whether another candidate has more experience.

But you can control what happens when the interviewer starts digging into how you think.

Because one of the worst places to discover a gap in your investigation skills is during the interview.

You struggle through the question.

The interview ends.

Then you’re back to applying, waiting, and hoping for another opportunity to prove yourself.

That’s an expensive way to find out what you need to work on.

Here’s what I would work on before the interview:

1. Stop measuring readiness only by certifications and completed labs

Those can build knowledge...
They don’t automatically mean you can explain how you would investigate when nobody is guiding you.

2. Start working investigations where nobody tells you what to check next

Decide what you’re trying to determine.
Figure out what evidence could answer it.
Make the decision.
Follow what you find.
Pivot when you need to.

3. Write the investigation down

What happened?
What evidence supports your conclusion?
What are you assuming?
What can’t you determine with the data available?

4. Have someone challenge your reasoning

Why did you check that first?
Why did you stop there?
Why didn’t you widen the scope?
What would change your conclusion?

Because when an interviewer starts questioning your thought process, that shouldn’t be the first time anyone has challenged how you investigate.

Find those gaps while you’re practicing.

Not while someone is deciding whether to hire you.

That’s exactly how we’ll be training inside the MYDFIR SOC Investigation Cohort.

APPLY HERE 👉 https://mydfir.com/cohort

Another MYDFIR Forge member landed the job 🔥

After years of trying to break into cybersecurity, they just received an offer for a Cyber Operations Analyst role.

What really stood out to me:
“Everything Steven teaches here aligns so well with the actual job responsibilities and the types of questions and scenarios you’ll encounter during an interview.”

This is why we focus so much on actually doing the work.

Huge congratulations on the new role!! 👏

MYDFIR SOC Investigation Cohort is LIVE

The job market is already difficult... Getting the interview is difficult.

So when you finally get that opportunity, I want you to be in the best position possible to take advantage of it.

When you finally get one, I don’t want: “Walk me through how you’d investigate this.” to be the question you weren’t prepared for.

That’s why I created the MYDFIR SOC Investigation Cohort.

For six weeks, we’re focusing on one thing: Investigations.

Every week, you’ll:

- See how I approach an investigation and the decisions behind it.
- Work through an investigation together.
- Take on an investigation yourself.
- Make decisions based on the evidence you have.
- Get direct feedback on your work.
- Write investigation reports.
- Explain and defend your conclusions...LIVE

Because knowing the tools is one thing.
Knowing what to do when the alert is yours is different.

The goal isn’t to memorize the right answer, It’s to learn how to find it.

So when someone asks you how you would approach an investigation, you’re not trying to remember something you watched in a course.

- You have actual reps behind your answer.
- You’ve investigated cases before.
- You’ve gotten stuck before.
- You’ve had your reasoning questioned before.
- You’ve written the report.
- You’ve defended your conclusion.
- And you’ve learned how to work through it.

And just as importantly, you’re building proof that you’ve done the work.

When an interviewer asks about your experience, you have investigations, reports, decisions, and examples you can actually speak to.

I’m accepting a maximum of 30 people because I need to be able to review your work, challenge your thinking, and give you meaningful feedback.

If investigations are the gap you’re trying to close, applications are now open!

APPLY HERE: https://mydfir.com/cohort

You can’t control who else is interviewing

You might be competing against...

Someone with years of SOC experience.
Someone with a degree.
Someone with more certifications.

You can’t control that.

You can’t control how difficult the job market is either.

What you can control is how prepared you are when someone finally gives you the opportunity.

When they ask: “Walk me through how you would investigate this.”

Can you explain your thought process?
Can you tell them what you would look at first and why?
Can you scope beyond the alert?
Can you explain what the evidence supports and what it doesn’t?
Can you defend your conclusion when they start challenging your reasoning?

You may not be able to manufacture two years of professional SOC experience.

But you can build investigation reps.

You can have your reasoning challenged.
You can get direct feedback on where your investigation breaks down.
You can write investigation reports.
You can practice explaining and defending your decisions.

And you can repeat that process until you become less dependent on someone telling you what to do next.

That is exactly what I’m building the MYDFIR SOC Investigation Cohort around.

A premium 6-week hands-on program that is dedicated on teaching you one thing…

How To Investigate.

This is not another SOC course that will teach you what a SIEM or EDR is.

This is a program that is designed to take you from "I don't know what to do with this alert" to "Give me the alert. I have a process for working through it." 💪

After 10 years in SecOps, this is what I’d focus on

I went from a Tier 1 analyst who questioned his own investigations to someone trusted to work through unfamiliar cases and train other analysts.

And one of the biggest things I’ve learned is this.

Knowing security is not the same as knowing how to investigate.

You can have certifications.
You can understand the tools.
You can complete labs.

But when someone asks

“Walk me through how you’d investigate this.”

Can you clearly explain what you would do?
Why you would do it?
What evidence you would want?
What would make you widen the scope?
What would change your conclusion?

And can you defend your decisions when they start pushing back?

That’s what I want to work on with 30 aspiring SOC analysts.

This will not be another broad SOC course.
This will be six weeks focused on investigations.

Applications opening soon!

Interested?

I turned down a promotion because I didn’t trust myself

When I landed my first Tier 1 SOC analyst role, I thought getting the job meant I was ready.

I quickly realized I wasn’t. 😅

I received very little training. Everyone around me was busy trying to meet SLAs, asking for help wasn’t always easy, and I constantly questioned whether I was investigating things correctly.

When someone challenged my findings, I rarely felt confident defending my answer.

Eventually, I had an opportunity to move up to Tier 2...but I turned it down.

It wasn't because I didn’t want the opportunity, but because I was scared. I couldn’t see myself as a Tier 2 analyst nor did I think I was ready, and I didn’t tell anyone that was the real reason.

After that, whatever confidence I had left took a hit.
I had the job so many people were trying to get, yet I was sitting there wondering whether security operations was even the right path for me.

So I left the SOC and moved into vulnerability consulting because I thought maybe the pentesting route would suit me better, and this felt like the first step in that direction.

I did it for about a year...and I hated it.

Looking back, I hadn’t left because I suddenly discovered I wanted to become a pentester. I left because I didn’t trust myself as an investigator.

Eventually, I went back to security operations and started putting in the reps.

- More investigations.
- More mistakes.
- More questions.
- More responsibility for my own decisions.

Over time, things changed.

I soon became the person responsible for training other analysts. That experience shaped the way I teach cybersecurity today. 

Knowing security concepts is one thing. Knowing what to do when an alert is yours, nobody is giving you the answer, and you have to defend your conclusion is something completely different.

A lot of what I’m building today comes directly from what I wish I had when I was that Tier 1 analyst questioning every decision I made.

You finally get the SOC interview. Then they ask this…

“Walk me through how you would investigate this.”

- What do you say?
- What would you look at first? Why?
- What would make you pivot?
- How far would you scope it?
- What evidence would support your conclusion?

That is where knowing SOC concepts and knowing how to investigate become two different things.

Another certification can give you more knowledge.

But eventually you need reps making investigative decisions, explaining those decisions, getting challenged on them, and doing it again.

The job market is already difficult enough.

When you finally get the opportunity, you want to be able to give it your best shot.

That’s the gap I’m working on solving…more details coming soon 💪

If your goal is to land your first SOC analyst role, what are you currently focusing on the most?

Working on something new for aspiring SOC analysts who have spent months learning but still do not feel confident investigating when there is no walkthrough or answer key.

The goal...help you become the kind of analyst who can take an unfamiliar alert and know how to work the problem.

Who is interested?