The help desk is a better security bootcamp than it gets credit for: you already troubleshoot under pressure, read logs when the ticket makes no sense, and translate between users and systems. What you're missing is proof — and a deliberate sequence gets you there without wasting a year on the wrong cert.
This is the path we've watched work: A+, Network+, Security+, then CySA+ — in that order, for a reason. Expect 12 to 18 months end to end while working full time. Anyone promising three months is selling something.
The path, in order
| Cert | What it's for |
|---|---|
| A+ (2–3 months) | Hardware, OS, and troubleshooting fundamentals. It's the baseline vocabulary of IT — and it's skippable if you've already survived two years on a help desk. |
| Network+ (2–3 months) | Packets before threats. You cannot judge “suspicious traffic” without knowing what normal traffic is — subnets, ports, protocols, and what a handshake should look like. |
| Security+ (2–3 months) | The HR filter. Rightly or wrongly, this is the line on the resume that gets a SOC application past screening — and it's the DoD 8570 baseline if government work is on your map. |
| CySA+ (3–4 months) | The actual job: log analysis, detection, incident response, threat hunting. This is the one that maps to what a SOC analyst does at 2 a.m. |
Why this order matters
Each cert covers the blind spot the next one assumes away. Security+ questions assume you can read a network diagram without sounding it out — that's Network+. CySA+ assumes the entire Security+ vocabulary and spends its time on analysis instead of definitions. Jumping straight to the destination cert means learning three layers at once, badly, under exam pressure.
Getting SOC-ready beyond the certs
Certs open the interview; the interview is won with evidence you've touched the tools. None of this requires spending money — it requires evenings.
- Run a home SIEM. Security Onion or a free Splunk instance ingesting your own home network logs teaches more about alert fatigue than any chapter on it.
- Write three detections. Pick three common attacks (brute force, port scan, suspicious PowerShell) and build the alert logic yourself. “I wrote detections for…” is an interview line that lands.
- Frame your help desk years as tier-1 triage — because that's what they were. Prioritizing incidents, escalating with clean notes, de-escalating angry humans: that's SOC work with a different queue.