Transitioning into SOC Analysis in Canada: The Exact 90-Day Blueprint
How candidates from non-technical backgrounds can navigate Canadian hiring requirements and land entry-level L1 analyst roles in Calgary and remote.
Most people who ask us how to get into a security operations centre have the same two problems: they do not know what the job actually involves day to day, and their CV does not survive the first filter. Ninety days is enough to fix both.
Days 1–30: build the vocabulary
Networking and operating system fundamentals first — TCP/IP, DNS, HTTP, Windows event logging, Linux process basics. You cannot triage an alert about a protocol you cannot describe. Spend the month reading logs, not watching lectures.
Days 31–60: work real telemetry
Get into a SIEM and stay there. Ingest something noisy, write detections, break them, and tune them. The hiring signal is not that you have used Splunk — it is that you can explain why an alert fired and what you did next.
Days 61–90: build the evidence
- Three written investigations, each with the alert, your reasoning, and the outcome.
- A CV structured around those investigations rather than around courses attended.
- A LinkedIn profile that names the tooling in the first two lines.
- Ten mock interviews, at least three of them uncomfortable.
What Canadian employers ask for
In Calgary and remote postings, the recurring requirements are alert triage experience, comfort with a ticketing workflow, clear written English and a demonstrable understanding of escalation. Certifications help you past filters; written investigations get you through the panel.
Our Cyber Security Analyst cohort is built to compress this timeline, with CV construction and mock interviews included in the six weeks.