SecOpsNomad.
LEARN THE BASICS. BUILD TOWARD THE JOB.

Security from Zero
Your first steps toward a blue-team job.

A practical starting point for a SOC analyst or junior security analyst role. Learn the computer basics, build investigations you can explain, and turn that work into applications and interview answers.

15 topics planned · 4 lessons availableStart Week 1
Security from Zero, Week 1: understand the job, observe your PC, explain the evidence. Three steps toward a first blue-team portfolio note.
WEEK 01 · AVAILABLE NOW

Your first investigation starts on your own PC.

Meet the blue team. Use Command Prompt, Task Manager and browser DevTools to see what normal activity looks like.

7-day plan / about 5 hours / one evidence note

Read Week 1

Start with what you have

Week 1 needs a Windows PC and a browser. No certification or paid security tool required.

Leave with evidence

A case note, a log timeline, a reasoned decision: something you can discuss in an application.

Explain your reasoning

Separate what you observed, what you think it means, and what you still need to check.

Study toward a role

Use real job descriptions in your region to choose what to learn next.

15 topics, each with something to show

Published topics are linked below. Remaining topics are planned; release dates are not set. Take the time you need for each skill. Completing the series does not guarantee employment.

  1. Topic 01

    What blue team does, and where to start

    Understand the analyst’s job, inspect your own computer and write your first evidence note.

    Command PromptTask ManagerDevTools
    Read
  2. Topic 02

    Networking an analyst actually uses

    Read an IP address, port, DNS answer and web request, and explain how they connect.

    TCP/IPDNSHTTP
    Read
  3. Topic 03

    Operating systems, users and permissions

    Navigate files, inspect permissions and distinguish users, processes and services.

    WindowsLinux
    Read
  4. Topic 04

    Read your first security logs

    Build a small timeline and separate an observed event from your interpretation.

    Event ViewerAuthentication logs
    Read
  5. Topic 05

    Accounts, authentication and access

    Explain MFA, least privilege and common reasons a sign-in needs investigation.

    MFAIdentity
    Planned
  6. Topic 06

    Triage a suspicious email

    Assess a message, document the evidence and recommend the next check.

    Email headersURLs
    Planned
  7. Topic 07

    Find evidence in a SIEM

    Filter a bounded log sample and explain what a search can and cannot show.

    SIEMKQL
    Planned
  8. Topic 08

    Investigate an endpoint alert

    Follow a process tree and identify the context needed before escalating.

    EDRProcess trees
    Planned
  9. Topic 09

    Make and explain a triage decision

    Assess severity, identify missing evidence and write a clear handoff.

    SOC ticketsTriage
    Planned
  10. Topic 10

    Use threat intelligence with context

    Check an indicator’s source and age, and map behavior without overstating it.

    MITRE ATT&CKThreat intelligence
    Planned
  11. Topic 11

    Your role in incident response

    Separate investigation from containment and know when to involve a senior analyst.

    Incident responsePlaybooks
    Planned
  12. Topic 12

    Automate one useful analyst task

    Parse a small log file and check your result against a manual count.

    PowerShellPython
    Planned
  13. Topic 13

    Build a portfolio case someone can review

    Publish a reproducible investigation with evidence, limits and next steps.

    Case notesPortfolio
    Planned
  14. Topic 14

    Turn your work into applications

    Match genuine project evidence to a role and write accurate CV bullets.

    CVJob descriptions
    Planned
  15. Topic 15

    Work a case and explain it in an interview

    Present your reasoning, handle follow-up questions and plan your next skill gap.

    InterviewCapstone
    Planned