I am halfway through a six-month placement in the SOC in Tallinn, on a Baltic Technical University degree placement. I was asked to write about it honestly, so here is the honest version.
The first three weeks were disorienting. I had done well in a cyber security degree and I could not read a Sentinel query. University teaches you what an attack is; a SOC needs you to know what normal looks like in this specific organisation, and that is not transferable knowledge.
The best thing about it: I was given a real, bounded piece of work in week four — rebuilding the phishing simulation reporting — rather than shadowing for three months. It is now in production and it is used every quarter. Being trusted with something that matters is what made the rest of it make sense.
The hardest thing: the alert queue is not exciting. The overwhelming majority of what a SOC does is establishing that something is fine. Films do not prepare you for this and neither did my degree.
The thing I did not expect: how much writing there is. Every investigation ends in prose that someone else has to be able to follow. Riina reviews mine and the feedback is usually about clarity, not about the technical content.
Placements are advertised through BTU and on the internships page. Applications for the next intake close in October.