Home › Career prospects
Career prospects: 36 minutes on the job
This further training prepares you for work as a Junior SOC Analyst. Instead of describing the job, we show you one single alert — from the notification at 9:12 to the case report at 9:48.
First of all: We are a training provider, not a job placement service. We cannot promise you a job. What we do: teach you the craft and practise job applications with you.
One case, from start to finish
9:12, an alert reaches you
SOC stands for Security Operations Center, in other words the security team of a company. Junior means entry level. Here is what a good half hour there looks like.
- 1 9:12 A system reports something on its own
A line appears on your screen: at 3:41 a.m. someone logged in to a computer in the accounting department. A system noticed this and triggered an alert. You are the first person to see this alert.
Alert. That is the word for a system’s message that something unusual has happened. Most alerts are harmless. - 2 9:15 You take it on
One click, and the alert is assigned to you. Everyone in the team can now see that you are working on it. More alerts are waiting in the queue, sorted by urgency. This one is not the most urgent, but it is new.
Triage. Sorting by urgency. The same word as in a hospital emergency department, and it is the core of the work at entry level. - 3 9:24 You look for the evidence
Who owns the computer? What happened just before? Has this alert come up before? The answers are in the log files, where a system records who logged in and when. You find that the same login happened on the three previous nights as well, always at the same time. That looks like an automated maintenance job, not a person.
MITRE ATT&CK. A public collection in which experts around the world have recorded the steps that attackers use. You use it to classify the behaviour. - 4 9:39 You decide
Three options: false alarm, and you close the case; minor incident, and you handle it following a ready-made set of instructions; serious incident, and you pass it on. Here the trail is not enough. The maintenance job is not on any list, and the computer belongs to a person who is on holiday. You pass the case on.
Escalate. Passing it on to the next level. Not a failure, but the intended route: at entry level your job is to recognise things, not to solve everything yourself. - 5 9:48 You write it down
What happened, what you checked, what you decided and why. In short, clear sentences. The colleague who takes over the case has to understand it without asking you. Many beginners underestimate this part; in the job it is a regular part of the daily work.
Case report. The written conclusion of every case. In this job, careful work and clean documentation count, not speed.
That is how it goes all day. How many alerts come in differs a lot from company to company. In between there are questions from inside the company: colleagues send suspicious emails and want to know whether they are genuine. In many teams this is the first task that new colleagues take on by themselves. A whole shift from 8:00 to 16:00 is waiting in the SOC‑Simulator.
The video
The same job in 51 seconds
What a Junior SOC Analyst actually does all day.
The sound is off until you turn it on.
Figures with sources
And how many jobs like that are there?
This question is in the title of the page, so we answer it with sources — including the figure that speaks against the job.
Both are true at the same time. Companies search for a long time and also hire people without relevant training. At the same time, fewer jobs were registered in 2025 than in 2024. Expect a longer application phase and rejections. If you know that beforehand, you will not stop after the third one.
Four kinds of employer
Who advertises jobs like this
Banks and insurance companies, industry, energy and water utilities, hospitals, retail chains, telecommunications.
Over time you get to know the systems of one single organisation very well, and that means you notice more quickly what is not normal there.They look after several customers at the same time. The technical term is Managed Security Service Provider, MSSP for short.
Different environments, and therefore different cases. Work is done to fixed deadlines, often in shifts.Federal government, federal states, local authorities, universities, public hospitals.
Hiring follows the collective pay agreement, and the positions are advertised publicly. Some of them ask for a security clearance or an extended criminal record certificate; what is required is stated in the job advert.In small and medium-sized companies, security is one part of the IT work, alongside user support and administration.
A possible route for getting started. To be honest about it: the share of pure security work is smaller, and you learn less from experienced analysts.An honest question
What these 36 minutes ask of you
- Care with small details — The difference between a genuine and a fake email is often a single swapped letter in the sender’s address. If you look closely, you have an advantage.
- Patience with repetition — The case above was a false alarm, and most of them are. Staying alert when yet again there is nothing behind it is the real difficulty.
- Being able to write — Every case ends with a text that a colleague understands without having to ask. Perfect German is not needed, but well-ordered German is.
- Reading English — Technical texts, alerts and the interfaces of the tools are often in English. In many jobs you do not have to speak it.
- Unusual working hours — Some security teams work around the clock, at night and at weekends too, others only during office hours. Find out early what fits your life.
And what the job is not: an action film. It is work at a screen: reading, comparing, looking things up, deciding, writing it down. Anyone who wants to attack systems themselves should look for a different job.
From the further training
What you use to apply for a job like this
On the last day you have more than a sheet of paper. What happens in those nine months is in the curriculum.
- The certificate of the CYBERSQUAD Akademie — The proof that you completed the further training, with the approval number of the programme. Awarded by the provider itself, not a qualification in a recognised training occupation like the ones from the Industrie- und Handelskammer.
- Up to three certifications from TryHackMe — SEC0, SEC1 and SAL1, each one after you pass the exam, verifiable through Credly. Completing the further training does not depend on them, and the second exam attempt costs you nothing.
- Case reports like the one above — From the SOC‑Simulator. They show how you work on an incident and document it. That is exactly what you are asked about in a job interview.
- Finished application documents — A CV for the German job market, a LinkedIn profile, a GitHub portfolio of small programs you wrote yourself and two practised job interviews: one with a person from HR, one with a specialist in IT security.
What you are missing: work experience in a real company. Every beginner has the same problem here, and we will not pretend otherwise. In an interview, call the simulator what it is: a practice environment. You can still tell them how you worked on a case and wrote it up.
Plain talk
What we commit to and what we do not
- We do not guarantee a job — We are a training provider, not a job placement service. We have no jobs to offer. If someone promises you a job, they are promising something they cannot keep.
- We do not quote a placement rate — Our first group is due to start on 2 November 2026. That is why we do not have any figures on graduates yet. You will not get made-up figures from us, and none that have been made to look better either.
- The salary range above is not a commitment — It describes what is usual on the market, not what you will get. In the final three weeks we practise how people talk about salary in Germany.
- This is what we commit to — 1,400 teaching units of 45 minutes each, fully live with a teacher, Monday to Friday. The approval states: asynchronous components 0. Plus preparation for the three TryHackMe exams, three weeks of job application preparation and the provider’s own certificate if you attend regularly and complete the programme.
- This is what you have to do yourself — Apply. Cope with rejections. Keep going.
Honest answers
Common questions about the job
If your question is not here, call us: 0211 81994488, Monday to Friday. Marsí, our AI adviser, answers first; if you want, a member of our team will call you back. More questions are answered in the frequently asked questions.
Will I definitely have a job after the nine months?
Do I need a degree or vocational IT training?
Do I have to work at night or at the weekend? Can I work from home?
How much English and how much German do I need?
I do not have a German passport, or I am over 45.
Two minutes. Then you know which rule applies to you.
The “AI-Driven Security Operations Specialist” training programme starts on 2 November 2026, nine months full time, online. A Bildungsgutschein can cover the costs. It is a discretionary benefit: the Agentur für Arbeit decides on funding in your individual case.