Home › Career prospects
Career prospects: 36 minutes on the job
This further training prepares you for work as a Junior SOC Analyst. Instead of describing the job, we show you one single alert — from the notification at 9:12 to the case report at 9:48.
First of all: We are a training provider, not a job placement service. We cannot promise you a job. What we do: teach you the craft and practise job applications with you.
One case, from start to finish
9:12, an alert reaches you
SOC stands for Security Operations Center, in other words the security team of a company. Junior means entry level. Here is what a good half hour there looks like.
- 1 9:12 A system reports something on its own
A line appears on your screen: at 3:41 a.m. someone logged in to a computer in the accounting department. A system noticed this and triggered an alert. You are the first person to see this alert.
Alert. That is the word for a system’s message that something unusual has happened. Most alerts are harmless. - 2 9:15 You take it on
One click, and the alert is assigned to you. Everyone in the team can now see that you are working on it. More alerts are waiting in the queue, sorted by urgency. This one is not the most urgent, but it is new.
Triage. Sorting by urgency. The same word as in a hospital emergency department, and it is the core of the work at entry level. - 3 9:24 You look for the evidence
Who owns the computer? What happened just before? Has this alert come up before? The answers are in the log files, where a system records who logged in and when. You find that the same login happened on the three previous nights as well, always at the same time. That looks like an automated maintenance job, not a person.
MITRE ATT&CK. A public collection in which experts around the world have recorded the steps that attackers use. You use it to classify the behaviour. - 4 9:39 You decide
Three options: false alarm, and you close the case; minor incident, and you handle it following a ready-made set of instructions; serious incident, and you pass it on. Here the trail is not enough. The maintenance job is not on any list, and the computer belongs to a person who is on holiday. You pass the case on.
Escalate. Passing it on to the next level. Not a failure, but the intended route: at entry level your job is to recognise things, not to solve everything yourself. - 5 9:48 You write it down
What happened, what you checked, what you decided and why. In short, clear sentences. The colleague who takes over the case has to understand it without asking you. Many beginners underestimate this part; in the job it is a regular part of the daily work.
Case report. The written conclusion of every case. In this job, careful work and clean documentation count, not speed.
That is how it goes all day. How many alerts come in differs a lot from company to company. In between there are questions from inside the company: colleagues send suspicious emails and want to know whether they are genuine. In many teams this is the first task that new colleagues take on by themselves. A whole shift from 8:00 to 16:00 is waiting in the SOC‑Simulator.
The video
The same job in 54 seconds
What a Junior SOC Analyst actually does all day.
Subtitles in all seven languages of this site. Scenes and voice were created with AI.
Figures with sources
And how many jobs like that are there?
This question is in the title of the page, so we answer it with sources — including the figure that speaks against the job.
Both are true at the same time. Companies search for a long time and also hire people without relevant training. At the same time, fewer jobs were registered in 2025 than in 2024. Expect a longer application phase and rejections. If you know that beforehand, you will not stop after the third one.
Four kinds of employer
Who advertises jobs like this
Banks and insurance companies, industry, energy and water utilities, hospitals, retail chains, telecommunications.
Over time you get to know the systems of one single organisation very well, and that means you notice more quickly what is not normal there.They look after several customers at the same time. The technical term is Managed Security Service Provider, MSSP for short.
Different environments, and therefore different cases. Work is done to fixed deadlines, often in shifts.Federal government, federal states, local authorities, universities, public hospitals.
Hiring follows the collective pay agreement, and the positions are advertised publicly. Some of them ask for a security clearance or an extended criminal record certificate; what is required is stated in the job advert.In small and medium-sized companies, security is one part of the IT work, alongside user support and administration.
A possible route for getting started. To be honest about it: the share of pure security work is smaller, and you learn less from experienced analysts.From the further training
What you use to apply for a job like this
On the last day you have more than a sheet of paper. What happens in those nine months is in the curriculum.
- The certificate of the CYBERSQUAD Akademie — The proof that you completed the further training, with the approval number of the programme. Awarded by the provider itself, not a qualification in a recognised training occupation like the ones from the Industrie- und Handelskammer.
- Up to three certifications from TryHackMe — SEC0, SEC1 and SAL1, each one after you pass the exam, verifiable through Credly. Completing the further training does not depend on them, and the second exam attempt costs you nothing.
- Case reports like the one above — From the SOC‑Simulator. They show how you work on an incident and document it. That is exactly what you are asked about in a job interview.
- Finished application documents — A CV for the German job market, a LinkedIn profile, a GitHub portfolio of small programs you wrote yourself and two practised job interviews: one with a person from HR, one with a specialist in IT security.
What you are missing: work experience in a real company. Every beginner has the same problem here, and we will not pretend otherwise. In an interview, call the simulator what it is: a practice environment. You can still tell them how you worked on a case and wrote it up.
What it can look like
What your CV can look like for these jobs
Five invented examples of people from completely different careers, with the job titles they would search for. The CVs are in German, which is how people apply in Germany. The job titles appear exactly as they do in German job ads.
Matching jobs
Common titles you can search for:
- (Junior) SOC Analyst (m/w/d)
- Junior Security Analyst
- Junior Cyber Security Analyst
- IT Security Analyst
- Security Operations Analyst
- Incident Response Analyst (Junior)
Portfolio projects on GitHub
Built, not just “Python skills”.
alert-triageSorts alerts by urgencybrute-force-watchDetects series of failed logins in log filesshift-handoverBuilds the handover to the next shift
Cases from the SOC simulator
Seven weeks of shifts, realistic alerts.
- 3 a.m., 14 forwarding rulesAccount taken over, escalated cleanly
- The maintenance job at 3:41No person behind it, still passed on
- The printer driverMalware, machine isolated
We build your application with you in the last three weeks: CV, LinkedIn profile and two practice interviews, one with an HR person and one with a specialist from IT security.
Check fundingWe are a training provider, not a job placement service. We cannot promise a job, a particular salary or that you will pass the exams.
Two minutes. Then you know which rule applies to you.
The “AI-Driven Security Operations Specialist” training programme starts on 4 January 2027 (planned), nine months full time, online. A Bildungsgutschein can cover the costs. It is a discretionary benefit: the Agentur für Arbeit decides on funding in your individual case.