You know your SOC team is good. How do you objectively prove it to the wider business?
In cybersecurity, the early career path is well-lit. Entry-level analysts have certifications, training paths, and clear milestones to chase. But somewhere between "junior analyst" and "head of SOC," the road gets murky.
Your mid- senior practitioners are handling real incidents, managing SLAs, escalating to leadership, and holding the line and the way to demonstrate that is… another theory-heavy exam?
That's not good enough. Your team deserves better, and the business deservers better reassurance.
Mind the representation gap
Most defensive security certifications test what people know, but that doesn't necessarily demonstrate what they can do. And even then, they tend to be highly technical and narrowly focused on one or two domains, leaving critical gaps in the broader, multidisciplinary skills real-world defense actually demands. SAL2 was designed differently: assessing both technical and non-technical competencies across multiple domains, because effective security work rarely stays within a single lane.
Memorizing MITRE ATT&CK techniques is not the same as using them under pressure during a live incident. Passing a multiple-choice exam about SIEM architecture is not the same as incident handling across 3 shifts throughout 72 hours while writing stakeholder-ready summaries.
The representation gap between theory and practice in certifications is a genuine business risk for mid-senior SOC analysts. Without any form of objective and rigorous validation of their operational capability, teams are stuck leaning on job titles and tenure. And they come up short, with vulnerability from what’s left unproven. This is especially true during acquisitions, mergers, restructuring or budget reviews.
Finally, a certification that captures readiness
The Security Analyst Level 2 (SAL2) certification from TryHackMe was built to close this gap, in direct response to what practitioners and organizations told us they needed.
SAL2 gets right into what mid-senior analysts need to know to do their jobs well. It puts them inside realistic SOC environments: compromised endpoints, analyst VMs, Splunk or Elastic SIEMs, custom EDR and threat intelligence tools, and asks them to perform. Across 12 scenario-based investigations, candidates are asked to handle incidents, conduct cross-domain analysis across endpoints, networks, and cloud logs, map attacks to MITRE and Kill Chain, and communicate findings clearly. All within a 72-hour window that mirrors the pace and pressure of 3 real shifts.
SAL2 is also a powerful motivator for analysts earlier in their journey. For SOC Level 1 practitioners, it puts a concrete, credible target on the horizon. They can see exactly what mastery at the next level looks like, and work toward it with purpose.
Seniority is stakeholder management
The technical depth is real: Windows and Linux log analysis, AD investigation, malware triage, PCAP analysis, AWS, Entra ID, web topics and detection engineering with Sigma. But so is the operational judgment: incident summary writing, informing customers, timeline building, threat classification, incident scoping and action planning, build response strategy, security hardening and process improvements, SLA management and prioritization. We know that it’s this business-wide communication that actually separates senior analysts from their junior counterparts. A brilliant detection means nothing if the analyst can't explain its significance to a CISO under pressure, or translate a complex incident timeline into language that drives the right business decision. Stakeholder management is more than a soft skill bolted onto a technical role. Communication skills determine whether security work has impact. SAL2 tests both, validating that the analysts can move fluently between the terminal and business-level communication.
Objective proof to reassure leadership
SAL2 gives you something other certifications can't: an objective, third-party benchmark of what your mid-senior team is genuinely capable of under conditions that reflect the job.
That matters when you're making the case to leadership for headcount, tools, or budget. It matters when you're navigating organizational change and need to demonstrate the value and readiness of your people. And it matters in highly regulated industries where "we have documented policies" just doesn’t cut it anymore and stakeholders need meaningful, auditable evidence of operational readiness on the people side.
SAL2 helps you translate team capability into a language leadership can act on, in a certification that your team genuinely values as a meaningful achievement.
Beyond validation, SAL2 is a capability management tool. The teams that retain great analysts are the ones that show them a path forward. It’s a way to show recognize progression and demonstrate the path ahead. Putting a meaningful, rigorous certification in front of your senior team shows that their growth is worth investing in. In a field where talent is scarce and turnover is expensive, it's a strategic investment.
Built with the community, for the community
Like all things on the TryHackMe roadmap, this certification came from customer conversations: with practitioners who were tired of certifications that didn't reflect their reality, and with leaders who needed a credible way to benchmark senior SOC talent.
TryHackMe's community has always been self-selecting for the kinds of people who treat a CTF as a good time. SAL2 is built for that same mindset applied to real investigation, real judgment, real communication and real environments.
If the senior analysts on your team is ready to stop describing what they can do and start objectively proving it. SAL2 is the next milestone.
SAL2 is available now. One free retake included. TryHackMe certificate or QR code upon completion.
Joanna Duffy