SOC Residency

COMPETENCY EVIDENCE

How do I know this candidate can actually perform?

Review assessed work, investigation reasoning and communication evidence—not attendance alone.

Sample record — illustrative data, not cohort outcomes

Verified competency record

Candidate
Sample candidate
Recency
Assessed 14 August 2026
Conditions
Guided and independent scenarios

EVIDENCE BY COMPETENCY

Direct-labelled competency evidence
CompetencyEvidenceConfidence
Evidence collection8 assessed itemsDemonstrated
Investigation reasoning6 assessed itemsDeveloping
Escalation judgment4 assessed itemsDeveloping
Incident communication5 assessed itemsDemonstrated

ASSESSMENT CONDITIONS

Evidence is stronger when its context is visible.

  1. 01

    Guided scenario

    Mail triage

    Evidence selected and initial hypothesis recorded
  2. 02

    Independent scenario

    Endpoint correlation

    Process ancestry and command-line reasoning assessed
  3. 03

    Independent scenario

    Identity anomaly review

    Authentication pattern examined across accounts and locations
  4. 04

    Unseen assessment

    Escalation decision

    Priority, uncertainty and recommended response reviewed
  5. 05

    Communication review

    Incident briefing

    Technical finding translated for operations

Confidence is a qualitative summary of evidence quantity, recency and assessment conditions—not an automated candidate score.

HOW RESIDENTS GET HERE

The reasoning chain every scenario is assessed against.

Simulated reasoning chain · fixed illustrative structure
  1. 01

    Observe

    Raw telemetry

    Mail, endpoint, identity, network and cloud events land in the queue.

  2. 02

    Correlate

    Causal chain

    Evidence across sources is linked into a single, testable sequence.

  3. 03

    Infer

    Analyst inference

    A conclusion is stated with its confidence and remaining uncertainty.

  4. 04

    Decide

    Response decision

    A proportionate, defensible next action is recommended and documented.

FOR SOC LEADERS

Evaluate the evidence, not a training claim.

  1. 01Review the competency framework
  2. 02Express interest in evaluating residents
  3. 03Participate in future assessments
  4. 04Interview qualified residents when available

TELL US WHAT YOU NEED

Register your interest as an employer

This goes to the SOC Residency team, not into the candidate application. We will follow up by email.