☁Cloud, DevOps & security

Cybersecurity Analyst

Practise SOC skills: alert triage, SIEM, log analysis, incident response, MITRE ATT&CK, vulnerability management and cloud security.

Questions: 100
Interview Qs: 30
Skills: 10

Start practising

About the role

A Cybersecurity Analyst protects an organisation by watching for attacks, investigating suspicious activity and helping fix weaknesses before attackers use them. Most analysts start in a Security Operations Centre (SOC), where they triage alerts from a SIEM, EDR and email security tools, decide what is real, and escalate or contain incidents.

Day to day, the work involves reading logs (Windows events, firewall, proxy, DNS, cloud audit logs), checking indicators of compromise against threat intelligence, analysing phishing emails, and writing clear incident notes. Analysts also support vulnerability management by prioritising patches using CVSS, EPSS and the CISA KEV catalog together with business context.

As they grow, analysts move into incident response, threat hunting, detection engineering and cloud security. They map activity to MITRE ATT&CK, write and tune detection rules, and help leaders adopt zero trust controls. Strong communication matters as much as technical skill, because analysts must explain risk to people who are not security experts.

Practise by level

easy

Easy challenges

34 questions

medium

Medium challenges

34 questions

hard

Hard challenges

32 questions

Open the full question bank (100 questions) →

Mock interview

easy

Screening round

4 questions · 4 min each · pass 50%

medium

Technical round

5 questions · 4 min each · pass 60%

hard

Final round

6 questions · 3 min each · pass 70%

Skills in this track

Learning roadmap

1
Learn IT and networking basics
Understand TCP/IP, DNS, HTTP/HTTPS, common ports, Windows and Linux administration, and Active Directory. You cannot spot abnormal traffic until you know what normal looks like.
2
Build security fundamentals
Study the CIA triad, threats vs vulnerabilities vs risk, encryption, hashing, PKI, authentication and the OWASP Top 10. Certifications like CompTIA Security+ give a structured path.
3
Practise SOC work in a home lab
Set up a free SIEM (for example Wazuh, Elastic or Splunk Free), forward Windows and Sysmon logs, and investigate sample attacks. Use platforms like Blue Team Labs, LetsDefend or TryHackMe SOC paths.
4
Master incident response and ATT&CK
Learn the incident response lifecycle from NIST SP 800-61, map detections to MITRE ATT&CK tactics and techniques, and practise writing short, clear incident reports.
5
Go deeper: hunting, detection and cloud
Learn hypothesis-driven threat hunting, write Sigma or KQL detections, and study cloud logs such as AWS CloudTrail and Microsoft Entra ID sign-in logs. Learn basic malware triage in a safe sandbox.