A 30-60-90 day onboarding plan for SOC analysts

Your SOC is hiring; that’s awesome news. The hard part? Getting new analysts up to speed without overwhelming them or slowing down your team. 

The facts are: you don’t have 6 months to onboard new SOC analysts, and threat actors won’t politely wait for them to be ready. The average SOC ramp-up time is over six months, but in that time, undertrained analysts lead to higher dwell times, more missed alerts, and a heavier load on already stretched senior staff. 

And it’s no surprise burnout rates are sky-high: 84% of cybersecurity professionals report stress, fatigue, or burnout, costing enterprises up to $626 million in lost productivity in the US and £130 million in the UK every year. 

Structured onboarding shortens ramp-up, reduces errors, and helps retain skilled staff before burnout sets in. That makes onboarding your primary risk mitigation strategy.

The cybersecurity talent gap is nowhere more visible than in the SOC. Demand for security analysts is expected to be 150% higher than the average growth across all occupations, but once you hire them, how do you help them thrive?

DOWNLOAD: 30-60-90 day SOC Analyst onboarding checklist

This blog outlines a structured and effective approach to onboarding new SOC talent, all mapped to relevant HTB Academy content and Dedicated Labs, so your hires become high-impact team members sooner rather than later.

Why onboarding is a security must-have

The cybersecurity skills gap is growing. Time and resources to train new hires are limited. And burnout in the SOC is all too real, with pressure building as each alert comes in. Without a plan, your SOC isn’t just inefficient; it’s vulnerable:

• New analysts drown in information without knowing what’s important, increasing dwell time and missed alerts.

• Managers spend too much time hand-holding, pulling focus from critical threat-hunting and response.

• Teams churn faster, taking time, trust, and institutional knowledge with them while feeding into the industry-wide burnout crisis, where 74% of cybersecurity professionals report taking time off for work-related mental health reasons.

With a structured plan:

• Analysts know what’s expected and when.

• Managers can measure progress and support development.

• The whole SOC gains strength, resilience, and talent that sticks.

58.3% of cybersecurity professionals prefer machines and hands-on labs over videos or templates to improve DFIR skills.

What makes an effective SOC onboarding plan?

Whether your SOC is three people or thirty, the best onboarding plans share these traits:

• Role-specific: Aligned to the work your team actually does

• Progressive: Builds from foundational knowledge to autonomous action

• Hands-on: Not just slide decks; real tools, labs, and incidents

• Flexible: Adapts to your stack and priorities

• Transparent: Everyone knows what “success” looks like

Threat Range strengthens each of these traits by providing a realistic, controlled environment where your team can apply skills, be observed, and sharpen their skills without live-incident risk.

WHAT IS THREAT RANGE?

How to use Threat Range in your SOC onboarding

Threat Range is a realistic, high-octane cyber range crafted specifically for defensive teams. It simulates full attack chains across enterprise environments, while analysts detect, investigate, collaborate, and respond under pressure—the way they would in ‘real life’.

Within the realm of onboarding, Threat Range serves three critical purposes:

• Context: Showing how isolated alerts add up in real incidents

• Benchmarking: Offering objective insight into analyst readiness

• Collaboration: Pressure-testing communication and decision-making

Rather than replacing other types of training materials, Threat Range complements them perfectly. Look at it this way: labs and CTFs build skills, but Threat Range validates whether those skills are translating into real-world effectiveness.

The 30-60-90 day plan for SOC Analysts

Here’s how we break it down, with mapped HTB Academy modules and labs to support each stage.

Days 0–30: Foundations and familiarization

Focus: Understand the SOC ecosystem and build technical fundamentals.

Goals:

• Get oriented with SOC processes, tools, and team workflows

• Learn the basics of triage, detection, and escalation

• Start foundational cybersecurity learning

Suggested HTB resources

• Academy courses:

• Security Monitoring & SIEM Fundamentals

• Intro to Network Traffic Analysis

• Working with IDS/IPS

• Defensive Labs:

• Entry-level blue team challenges and incident simulations

• Meerkat

• BFT

Incident Handling, Network Traffic Analysis, and Server Log Analysis ranked as the top 3 skills for SOC analysts.

On the job activities:

• Meet onboarding buddy or mentor

• Start regular 1:1 check-ins

• Track progress via onboarding tracker

• Shadow live alert triage and investigations

• Begin distinguishing high-signal alerts from background noise

Milestones:

• Completes orientation + foundational modules

• Begins contributing to low-priority triage

• Demonstrates familiarity with tooling

• Knows where and when to escalate

By the end of the first month, your analyst should have transitioned from an observer to an active participant in SOC workflows. They should be fluent in the basic operation of your tools, able to spot straightforward security events, and confident in escalating issues appropriately. Analysts should understand not only how alerts are generated, but how attacker behavior looks across the environment. This helps build early intuition and reduces alert fatigue later on.

This early confidence reduces the burden on senior analysts and builds a strong foundation for deeper technical work in the coming months. And getting your analysts operational faster doesn’t just improve SOC coverage; it lightens the load on senior staff, cutting down on overtime and out-of-hours pressure that are key drivers of burnout.

Days 31–60: Practice and situational awareness

Focus: Build confidence with SOC tools and start responding independently.

Goals:

• Handle alerts with minimal guidance

• Learn how to detect anomalies and correlate data

• Participate in a mock incident or internal threat hunt

• Understand how early detection decisions affect response outcomes

Suggested HTB Content:

• Academy courses:

• Network Traffic Analysis

• Detection Engineering

• Windows Logging Fundamentals

• YARA and Sigma for SOC Analysts

• Defensive Labs:

• Mid-level blue team incident response labs

• Exitiablis

• Pulse

• GroundZero

Threat Range: Here, Threat Range acts as a formal evaluation checkpoint. Analysts take part in various defensive scenarios that reflect real attacker behavior, allowing managers to observe:

• Investigation depth and prioritization

• Decision-making under intense pressure

• Communication and collaboration

• Confidence using tools and processes 

Unlike ad hoc mock incidents, Threat Range gives you consistent, repeatable scenarios that make progress measurable and skill gaps more visible. 

On-the-job activities:

• Resolve real alerts using internal playbooks

• Submit a detection or tuning suggestion

• Contribute to retrospective or threat hunt

• Submit detection or tuning suggestions

Milestone:

• Completes intermediate modules

• Comfortable with alert queues

• Participates in post-incident review

• Completes first Threat Range benchmark

At this stage, analysts should be shifting gears from learning mode into operational mode. They’re not just following instructions, they’re proactively identifying anomalies, contributing to incident debriefs, and suggesting detection improvements. 

Their growing autonomy means faster alert handling and fewer delays in the SOC’s incident response chain. Here, new analysts are equipped to help ease bottlenecks and lower the chronic workload stress that 89% of cyber professionals say fuels burnout.

Days 61–90: Autonomy and progression

Focus: End-to-end responsibility and measurable readiness.

Goals:

• Own investigations end to end, from detection through to response

• Take ownership of a security domain (e.g. EDR, threat intel, or log tuning)

• Complete a deep-dive lab or simulation

• Demonstrate consistent, high-quality decision-making

43.8% of security professionals believe cloud security skills will be the top priority for analysts over the next five years.

Suggested HTB content:

• Academy courses:

• Threat Hunting

• YARA Rules

• Malware Traffic Analysis

• Defensive Labs:

• Advanced blue team labs or targeted simulations

• HorsePanda-D

• Superset-D

• Ore

Get certified: HTB Defense Operations Analyst 

• Threat Range: This is where Threat Range functions as a readiness check, not a training exercise. Analysts are evaluated on how they perform when faced with realistic attack chains, time pressure, and incomplete information. 

  • Where applicable, scenarios can be aligned with the organization’s real tooling stack, further minimizing the gap between training and production.

   

On-the-job activities:

• Lead a mock incident or create internal training resource

• Suggest new alert logic or automation ideas

• Mentor or support next incoming analyst

• Defend against full Threat Range scenarios that test detection quality, escalation accuracy, and response speed

Milestone:

• Completes onboarding plan

• Completes Threat Range readiness scenario

• Demonstrates independent analysis

• Has clear next-step goals for growth (certification or skill milestone)

• Defines next six-month development goals with manager

TRY THREAT RANGE TODAY

By the 90-day mark, your analyst should be a trusted and dependable member of the SOC, able to take ownership of investigations and drive them to resolution. 

Final thoughts: Going from new hire to SOC powerhouse

Onboarding is more than a welcome email, intro slide, and tool access.It’s the difference between a SOC that catches threats in minutes and one that lets them linger for days. The faster your analysts are operational, the stronger your defenses and the better your business outcomes.

With a 30-60-90 day plan, your SOC gains consistency. Your analysts gain confidence. And your team retains top talent who know they’re growing, not guessing. HTB is here to help make that journey real, hands-on, and effective.