This certification has been designed by industry experts to validate the advanced, job-ready skills required for mid-level security analysts, focusing on real-world investigation, decision-making, and professional reporting in modern SOC environments.

Analyse complex, multi-stage attack chains across realistic SOC scenarios, identifying how incidents unfold and understanding the full scope of an intrusion from initial access to impact.

Interpret security activity, assess its significance, and apply contextual reasoning to determine the nature, severity, and potential impact of a threat.

Work confidently across SIEM platforms (Splunk, Elastic), EDR consoles, and investigation environments to hunt, correlate, and analyse security events efficiently.

Investigate threats spanning cloud environments, Active Directory, network traffic, and endpoint systems, applying broad analytical skills across the full defensive landscape.

Operate within defined response time expectations, prioritising and progressing investigations in line with real SOC SLA requirements.

Assess multiple alerts and competing incidents, make informed decisions under pressure based on available evidence, and determine what requires immediate action.

Articulate findings clearly through structured reporting tasks, including both executive-level summaries and detailed technical incident reports for DFIR handoff.

An advanced defensive certification validating investigation depth and decision-making maturity.

SOC Level 1 and Level 2 analysts ready to progress to mid-level performance.

SAL2 builds on foundational defensive knowledge and is recommended after SAL1.

It evaluates technical depth, cross-domain coverage, and communication - not just task completion.

Yes. Delivered through realistic SOC simulations.

Mid-level SOC Analyst, Detection Engineer, Threat Hunter, Incident Responder.

Investigation depth, cross-domain analysis, prioritisation, SLA awareness, decision-making, and professional reporting.

The exam includes 12 multi-stage SOC scenarios assessing both technical investigation and higher-level decision or reporting tasks.

Candidates have a 72-hour window to complete all scenarios within the assessment period.

Yes. One free retake is included with your exam purchase.

SAL2 supports progression into mid-level SOC Analyst, Detection Engineer, Threat Hunter, and Incident Response roles.

You can reach out to [email protected] or ask in our Discord server or Subreddit for further assistance.