Training before triage
Before the students start handling the phishing cases that make up so much of the SOC’s daily work, they’re beginning with the basics: networking, how the domain name system works, ASU’s security protocols and how to triage a potential incident. “Once they’ve gotten exposed to that, then we’ll let them loose on doing some actual operational work,” Godsey said.
The students’ system access is also limited at first and will expand as they build skills and trust, following the cybersecurity principle of least privilege. “You should only be provisioned the minimum level of access that you need to do your job,” Godsey said. A dedicated student SOC coordinator checks in with them daily, making sure they have what they need and are working within the guardrails.
The program’s second half moves beyond what Godsey calls the traditional entry-level SOC analyst role, into security orchestration and automated response, and the use of agentic AI in security operations. The goal is to send students into job interviews with a capstone project they can show.
That matters because the cybersecurity talent shortage is more about requisite skills than the number of people interested in the field, said Godsey, who has seen postings for entry-level jobs that demand two years of experience and certifications. “That by definition I would argue is not entry level,” he said.
Manager of Cybersecurity Operations Robert Kamilli offered the students insights into the profession that will boost their employability. “What employers are looking for is that skillset of taking something theoretical, like AI or agentic AI, and actually applying it to the technology stack to move the needle, to create something that actually stands out.”