Class Central is learner-supported. When you buy through links on our site, we may earn an affiliate commission.

Cyber Defense & SOC Analyst Certificate Program

Overview

This leads to the complete federal security operations credential and prepares you for Federal SOC Analyst, Detection Engineer, and threat hunter roles, and for CompTIA CySA+ and the GIAC GCIH and GMON credentials. Learners start with how a federal SOC actually functions, its roles, workflows, tooling, and the standards it answers to, then move into responding when something is found, and finish by learning to go looking before an alert fires.

The progression is deliberate: monitoring and triage first, response second, and hunting last, because hunting is only meaningful once you know what normal looks like and what happens when you find something. Aligns to NIST SP 800-61 Rev 3, SP 800-53 RA-10, the CSF 2.0 Detect and Respond outcomes, and the DoD Diamond Model.

Syllabus

SOC Foundations for Federal Cyber Defense and Operations Course

How FISMA, OMB policy, NIST guidance, and CISA directives combine to govern federal SOC operations.
SOC organizational models and Tier 1–3 responsibilities set against the NICE Workforce Framework.
The federal SOC's mandatory log sources and the current OMB M-26-14 requirements.
Detection engineering and MITRE ATT&CK coverage mapping for alert triage and prioritization.
The NIST SP 800-61 Rev. 3 incident response lifecycle and the CISA federal response playbooks.
Federal incident reporting duties, and how SOC findings feed RMF and the ATO lifecycle.
SOC performance metrics, the common toolset, and DoD 8140.03 career pathways.

Federal Incident Response for Agency Practitioners Course

Governance and the legal and policy basis for federal IR (FISMA, NIST SP 800-61 Rev. 3, OMB, CISA).
Detecting and classifying incidents with NCISS and the federal incident categories.
Determining which mandatory reporting obligations apply and meeting the deadlines.
Containment, eradication, and recovery carried out without compromising evidence.
Post-incident reviews that drive real program improvement.
Tabletop exercise design and facilitation, including a MSEL.
Working a simulated incident from detection through to the after-action report.

Threat Hunting and Detection Engineering Course

A repeatable hunting capability founded on RA-10, CSF 2.0, and the Diamond Model.
A plan/conduct/report hunt cycle keyed to CSF 2.0 Detect outcomes.
Findings structured on the Diamond Model's four vertices, with pivots into related activity.
Adversary behavior mapped to MITRE ATT&CK via CISA's six-step process and the Decider tool.
ODNI structured analytic techniques applied against confirmation bias and anchoring.
Program maturity benchmarked on the CSF 2.0 Implementation Tiers.
The detection engineering lifecycle run from requirement to retirement, validated per NIST SP 800-115.
Defensible performance measures built from SP 800-53 assessments and SP 800-55.