Skills to learn first
Learn IP addressing, DNS, Linux, Windows, and basic scripting. Practise documenting your work. You can learn these skills before taking a certification exam.
What defensive security work involves
Defensive security teams monitor systems, investigate alerts, and respond to incidents. Learn to read logs, identify unusual activity, and document your findings.
Start with SOC analyst or security analyst roles. With experience, you can move into incident response, threat hunting, detection engineering, or team management. Responsibilities vary by organisation.
FOUNDATION
Learn security basics
Understand identity, networking, operating systems, security principles, and basic incident handling. Learn to distinguish an observation from a conclusion.
Practice task: Explain an authentication event, a DNS request, and a blocked connection using sanitised lab evidence.
PRACTITIONER
Practise security analysis
Practise alert triage, phishing investigation, log analysis, and concise handover notes. Pick a practical route that matches the tools or roles you are exploring.
Practice task: Create an incident timeline, separate facts from hypotheses, and justify an escalation decision.
ADVANCED
Choose an area of security operations
For Microsoft environments, develop investigation and detection skills around Sentinel and Defender. For incident handling, build a broader response process. These options serve different needs.
Practice task: Write a detection with sample events, demonstrate false-positive handling, and document an incident response decision.
SPECIALISE
Develop incident response and threat hunting skills
Gain practical investigation experience, then choose an advanced certification relevant to your work.
Practice task: Run a documented lab investigation from alert to lessons learned, including gaps in visibility and a tested detection improvement.
Suggested investigation project
Collect logs from lab machines, investigate a simulated failed-login pattern, and write down the timeline. Include your queries, competing explanations, evidence gaps, escalation decision, and recommendations. Use synthetic or sanitised data you can share.
Try the defensive investigation project →Official certification information
Reviewed on 25 October 2026. The study order and projects are suggestions. Check the provider’s website for required exams, eligibility, fees, and renewal rules. Choose the certifications relevant to your goal.