Senior SOC Analyst → Threat Hunter

Transferable skills

• MITRE ATT&CK & TTPs
• Detection engineering
• Scripting (Python)
• Network forensics

Skills to learn

• Endpoint & log analysis
• Malware analysis
• Hypothesis design

Step-by-step learning plan

1. 1. Build on your Senior SOC Analyst experience

   2–4 weeks

   Leverage

   • MITRE ATT&CK & TTPs
   • Detection engineering
   • Scripting (Python)
   • Network forensics

   Map transferable skills — MITRE ATT&CK & TTPs, Detection engineering, Scripting (Python) — against what a Threat Hunter needs.

2. 2. Close the partial gaps toward Threat Hunter

   3–6 weeks

   Improve

   • Threat hunting

   Raise Threat hunting to the level a Threat Hunter relies on.

3. 3. Learn the core of the Threat Hunter role

   6–10 weeks

   Learn

   • Endpoint & log analysis
   • Hypothesis design

   Technologies

   CrowdStrikeSentinelOneVelociraptor

   Cover the biggest gaps first: Endpoint & log analysis, Hypothesis design.

4. 4. Master advanced Threat Hunter skills

   6–10 weeks

   Learn

   • Malware analysis

   Technologies

   VolatilityGit

   Handle the advanced topics: Malware analysis.

5. 5. Get productive with the Threat Hunter toolchain

   4–8 weeks

   Technologies

   CrowdStrikeSentinelOneVelociraptorVolatilityGit

   Be hands-on with CrowdStrike, SentinelOne, Velociraptor and the rest of the target stack.

6. 6. Practise Threat Hunter work in real conditions

   4–8 weeks

   Ship a portfolio project or take on Threat Hunter tasks at work.

7. 7. Get certified and position yourself as a Threat Hunter

   4–8 weeks

   Technologies

   GIAC GCFAGIAC GCTIBlue Team Level 2MITRE ATT&CK Defender

   Update your CV and LinkedIn around Threat Hunter, then apply to target roles.

Alternative routes

• Threat Intelligence Analyst → Threat Hunter