Cyber Defense & SOC Analyst Certificate Program (Self-Paced)
IDCYSE.DSA.SP

Self-paced online training with expert support Certificate with 3 courses

Work inside a federal SOC with confidence, from alert triage through incident response to proactive threat hunting.

$2,675 38 clock hours Live Support Start anytime

This program includes

  • 38 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Access to class recordings (30 days)
  • Verified digital certificate of completion
  • Learn at an accredited institution
  • Credits: 3.8 CEUs

This is the self-paced version. For live instruction, take the Cyber Defense & SOC Analyst Certificate Program.

Working on the investigation and evidence side instead? See the Digital Forensics and Incident Response Certificate Program.

This leads to the complete federal security operations credential and prepares you for Federal SOC Analyst, Detection Engineer, and threat hunter roles, and preparation for CompTIA CySA+ and the GIAC GCIH and GMON credentials. Learners start with how a federal SOC actually functions, its roles, workflows, tooling, and the standards it answers to, then move into responding when something is found, and finish by learning to go looking before an alert fires. The progression is deliberate: monitoring and triage first, response second, and hunting last, because hunting is only meaningful once you know what normal looks like and what happens when you find something. Aligns to NIST SP 800-61 Rev 3, SP 800-53 RA-10, the CSF 2.0 Detect and Respond outcomes, and the DoD Diamond Model.

Read more

Courses in this Certificate Program

This is the recommended order, but some courses may be taken in a different order.

Download Syllabus PDF

Unit 1 14 Hours

SOC Foundations for Federal Cyber Defense and Operations Course (Self-Paced)

This course prepares you to operate effectively inside a federal Security Operations Center, whether you're new to SOC work or an analyst who wants to solidify the federal standards and terminology behind the job. Unlike generic SOC training, every operational topic—log collection, continuous monitoring, detection engineering, and incident response—is grounded in the statutes, policy memoranda, and technical standards that actually govern federal cyber defense.

  • How FISMA, OMB policy, NIST guidance, and CISA directives fit together to govern federal SOC operations
  • SOC organizational models and Tier 1–3 responsibilities, mapped to the NICE Workforce Framework
  • The log sources a federal SOC must collect, and current requirements under OMB M-26-14
  • Detection engineering and MITRE ATT&CK coverage mapping, applied to alert triage and prioritization
  • The incident response lifecycle under NIST SP 800-61 Rev. 3 and the CISA federal response playbooks
  • Federal incident reporting obligations, and how SOC findings connect to RMF and the ATO lifecycle
  • SOC performance metrics, the common toolset, and career pathways mapped to DoD 8140.03

Unit 2 12 Hours

Federal Incident Response for Agency Practitioners Course (Self-Paced)

This course equips federal incident response practitioners with the operational knowledge to detect, contain, and recover from cybersecurity incidents while meeting FISMA, US-CERT, and OMB mandatory requirements. Participants develop practical skills across the full NIST SP 800-61 Rev. 3 incident response lifecycle, from preparation, detection and analysis, containment, eradication and recovery, and post-incident review.

  • Governance and legal/policy basis for federal IR (FISMA, NIST SP 800-61 Rev. 3, OMB, CISA).
  • Detect and classify incidents using NCISS and federal incident categories.
  • Identify which mandatory reporting obligations apply and meet the deadlines.
  • Contain, eradicate, and recover while preserving evidence.
  • Run post-incident reviews that drive program improvement.
  • Design and facilitate tabletop exercises (including a MSEL).
  • Walk a simulated incident from detection to after-action report.

Unit 3 12 Hours

Threat Hunting and Detection Engineering (Advanced) Course (Self-Paced)

Take your existing threat hunting and detection engineering skills and build them into a defensible program, using a methodology sourced entirely from NIST, CISA, and DoD publications. You will learn a repeatable hunt process, bias-reducing analytic techniques, the full detection lifecycle, and the validation and metrics that prove risk is going down.

  • Stand up a repeatable hunting capability grounded in RA-10, CSF 2.0, and the Diamond Model
  • Run a plan/conduct/report hunt process tied to CSF 2.0 Detect outcomes
  • Structure findings across the Diamond Model's four vertices and pivot across related activity
  • Map adversary behavior to MITRE ATT&CK using CISA's six-step process and the Decider tool
  • Apply ODNI structured analytic techniques to counter confirmation bias and anchoring
  • Benchmark program maturity against the CSF 2.0 Implementation Tiers
  • Run the detection engineering lifecycle end-to-end, with validation per NIST SP 800-115
  • Produce defensible performance measures using SP 800-53 assessments and SP 800-55
A group of adult learners sits in a classroom, smiling and engaged in a government training session.
A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.
A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Related Courses: Compare to the Cyber Defense & SOC Analyst Certificate Program (Self-Paced)

These related courses share skills and topics with the Cyber Defense & SOC Analyst Certificate Program (Self-Paced). Select up to two and tap Compare selected courses to view a side-by-side comparison.

  • SOC Foundations for Federal Cyber Defense and Operations Course (Self-Paced)
    14 hours $1,249

    This course prepares you to operate effectively inside a federal Security Operations Center, whether you're new to SOC work or an analyst who wants to solidify the federal standards and terminology behind the job. Unlike generic SOC training, every operational topic—log collection, continuous monitoring, detection engineering, and incident response—is grounded in the statutes, policy memoranda, and technical standards that actually govern federal cyber defense.

  • Federal Incident Response for Agency Practitioners Course (Self-Paced)
    12 hours $1,049

    Run a federal incident response program end to end, organized the way NIST now organizes it: from governance and readiness, through detection and the one-hour CISA notification clock, to recovery and continuous improvement.

  • Threat Hunting and Detection Engineering (Advanced) Course (Self-Paced)
    12 hours $1,049

    Take your existing threat hunting and detection engineering skills and build them into a defensible program, using a methodology sourced entirely from NIST, CISA, and DoD publications. You will learn a repeatable hunt process, bias-reducing analytic techniques, the full detection lifecycle, and the validation and metrics that prove risk is going down.