A SOC is a team of different responsibilities, not a single ladder of increasingly powerful accounts. Vidatta's training material separates incident investigation, detection quality, advisory decisions, architecture and platform operations. Each path asks for a work product that another person can inspect. Reading a guide, completing a disclosed fixture or passing one bounded practical does not establish broad professional competence.
Level 2 analyst — investigate and hand over
The Level 2 analyst takes an alert without inheriting its conclusion. The work is to define the time window, check source coverage, reproduce the relevant events, test credible alternatives and write a handover that names the decision needed next. A strong submission distinguishes the event from the hypothesis and explains what evidence is missing. It does not claim an account was compromised merely because a suspicious pattern appears.
Evidence of competence: a traceable timeline, search terms and scope, source limitations, proportionate priority recommendation and a handover another analyst can continue.
Level 3 analyst — coordinate and verify
Level 3 adds critical review of the handover, correlation across sources, incident coordination and proportionate response planning. The analyst weighs business impact and authority, records decisions and verifies outcomes after approved actions. Leading an incident does not mean personally holding every administrator permission.
Evidence of competence: a decision log with alternatives, named owners and checkpoints; a containment proposal that distinguishes approval from execution; and an independently observed result or an explicit unresolved gap.
Detection expert — measure quality, not just volume
The expert binds a rule proposal to exact source, data population, executor and quality criteria. Fewer matches can be a regression if positive cases disappear. A public exercise may teach a confusion matrix; it cannot establish performance on unseen data or in a running detector. A controlled change needs separate proposal, approval, runtime observation, reversal and restoration evidence.
Evidence of competence: an exact candidate diff, like-for-like positive and benign comparison, stated denominators, uncertainty, regression analysis and a retain-or-change recommendation.
Vulnerability analyst and threat-intelligence practitioner — prioritise with context
A vulnerability list is a starting inventory, not a remediation order. The analyst checks affected assets and software, exploitability signals, exposure, business criticality, source freshness and ownership. Threat-intelligence and OSINT findings need provenance and confidence; an indicator match alone does not establish an incident. These paths support L2/L3 and advisory decisions rather than replacing them.
Evidence of competence: a sourced prioritisation, documented exceptions, an accountable remediation owner and a measurable closure check. Native Microsoft Defender or Sentinel proficiency requires work in the licensed product; a local analogue must be labelled as such.
Consultant — turn evidence into an accountable choice
The consultant defines a useful scope, interviews without leading the witness, builds defensible findings and presents options with costs and limits. Consultancy is an advisory path, not simply the next rank after detection engineering. The responsible business owner accepts risk; the consultant provides a recommendation that can be assigned and tested.
Evidence of competence: a finding register and decision paper that separate observed facts from assumptions, compare credible alternatives and define who will verify success.
SOC security architect — make the whole system defensible
The architect examines how people, policy, services, data flows, monitoring, identity and recovery fit together. A design review should name the authoritative source, trust boundary, failure mode, operational owner and acceptance test for each important claim. The training route maps broad competencies to practical builds, but a map is a syllabus, not proof that every build or installed journey has passed.
Evidence of competence: a decision record and architecture map with trade-offs, evidence requirements, failure and recovery scenarios, and honest status labels for implemented, tested, held and planned elements.
Platform engineer and administrator — keep the evidence trustworthy
The engineer makes the SOC dependable enough for analysts to work: scoped access, service health, event freshness, change control, backups, recovery, audit and handover. Application administration and privileged host maintenance use distinct authorities. An engineer can repair a mechanism, but cannot issue a learner's grade or silently become the reviewer.
Evidence of competence: diagnosis with alternatives, exact change scope, before-and-after checks, negative tests, recovery proof and a report of what remains uncertain. A green health endpoint alone does not prove detector correctness or a usable restore.
AI and configuration specialists — govern changes and data
Configuration work starts with an exact baseline and target, permissions, canary, drift observation and restoration test. AI work starts with dataset admission and lineage, then controlled comparison and independent quality review. A technical training smoke or a few generated answers does not prove a model is suitable for SOC decisions.
Evidence of competence: versioned input and model records, a bounded evaluation plan, independent review, effective-state checks and a clear stop or rollback rule.
Red and Purple Team — test only inside an authorised boundary
Red Team work tests an agreed objective under explicit rules of engagement. Purple Team work connects controlled behaviour to expected telemetry, detection and response learning. The useful output is not an attack demonstration alone; it is a behaviour-to-evidence map, a measured detection gap and a safe improvement plan. Isolated lab designs must remain separate from production and from any unissued exercise.
Evidence of competence: written scope, permitted targets and timing, capture provenance, SOC receipt, positive and benign controls, stop conditions and cleanup. A planned isolation design is not evidence that an exercise has been commissioned.
Reviewer and exercise operator — preserve independence
Vidatta also distinguishes the person who issues or assesses learner work from the operator who repairs or commissions platform services. The learner records what they did; the reviewer evaluates it; the operator keeps the mechanism available. A protected receipt, version and source pointer let those parties reconcile a result without inventing a success or penalising a learner for a platform defect.
The common thread across every role is simple: say exactly what was observed, what was inferred, what was authorised, what actually changed and what would prove the outcome. That is the habit the platform is designed to teach.