SOC Level 2
5 Based on 213 reviews- 73,713 Learners
- 287 Courses
Security Operations (SOC) 201 is an advanced course designed to elevate your ability to detect, investigate, and respond to complex cyber threats at scale. Building on the foundational skills from SOC 101, this course focuses on developing an effective investigative methodology and mastering the responsibilities of an Incident Responder or Threat Hunter.
Request More InfoUpcoming Class Schedule
$1,999.00
Sep 21 - Sep 23, 2026
9:00 AM - 5:00 PM Eastern- VILT
- Dec 07 - Dec 09, 2026
- 9:00 AM - 5:00 PM Eastern
- VILT
Through hands-on labs and realistic scenarios, you’ll investigate sophisticated threats across enterprise environments, applying advanced techniques aligned with the MITRE ATT&CK framework. The curriculum emphasizes proactive threat hunting as part of a continuous detection and response cycle, helping analysts identify active threats, uncover security gaps, and improve future investigations.
By the end of the course, you'll be equipped with the mindset, tools, and methodologies needed to confidently investigate incidents, trace root causes, and respond effectively to advanced adversaries.
This course includes an Exam Vouchers for TCM Security’s Practical SOC Analyst Professional (PSAP) certification – Launching September 2025. Each exam voucher includes 1 exam attempt and is valid for 12-months from the course completion date or certification release date.
Develop a robust and reliable investigator's mindset to approach incidents methodically Learn industry-standard methodologies and tools for detecting, hunting, and responding to cyber threats across enterprise environments Gain experience performing incident response and threat hunting at scale Learn to investigate and identify advanced adversary tactics following the MITRE ATT&CK framework, including execution artifacts, lateral movement, credential theft, living off the land techniques, persistence, defense evasion, command and control, and many more Learn to perform effective attack timeline analysis, and guide effective incident response and remediation efforts Investigate the root cause of security incidents by uncovering the entry pointWho should attend SOC Level 2 Course
Prerequisites for SOC Level 2 Course
SOC Level 2 Course Outline
Resources
FAQs on SOC Level 2
SOC 201 is designed for Tier 2 and Tier 3 Security/SOC Analysts, Incident Responders, Threat Hunters, and Digital Forensic Examiners who already have foundational SOC knowledge and want to advance their defensive security skills.
Participants should have completed SOC 101 or possess equivalent experience, including Networking and Operating System Fundamentals, Security Operations Fundamentals, Network Traffic Analysis, Endpoint Security Monitoring, Log Analysis, SIEM experience, and basic digital forensics exposure. This course does not cover basic analysis tools.
You will develop an investigator’s mindset for methodical incident response, learn industry-standard threat hunting and detection methodologies, and gain hands-on experience investigating advanced adversary tactics using the MITRE ATT&CK framework, including lateral movement, credential theft, persistence, and defense evasion.
The course covers modern adversary tactics, incident response fundamentals, and threat hunting methodologies on Day 1, followed by anomaly detection techniques, threat report analysis, and hands-on labs for hunting execution, persistence, defense evasion, and command and control activities on Day 2.
You will learn to perform effective attack timeline analysis, investigate root causes of security incidents by identifying entry points, and conduct incident response and threat hunting at enterprise scale using real-world forensic artifacts and structured investigative techniques.