Harees Ahmed is a Level 2 SOC Analyst at SEP2, a Leeds-based cyber security specialist that's been running a 24/7/365 Security Operations Centre since 2023.
He's also one of our SAL2 Founding Operators, among the very first people to sit and pass the SAL2 exam, TryHackMe's practical certification built for mid-to-senior SOC roles.
Harees started using TryHackMe as a college student nearly eight years ago, and he's still using it now, multiple years into a live SOC career. The platform didn't stop being useful once he had a job. If anything, it’s helped him to stay current while facing a threat landscape that never slows down. Along the way, he’s brought several of his colleagues with him on the TryHackMe journey, earning credentials while building practical skills that prove real capability.
On staying with the platform long after college
How long have you been learning with THM?
I've been learning with TryHackMe for about 7 to 8 years now! I actually started utilising the platform back when I was in college studying for my IT course, so it has been a core part of my cybersecurity journey from the very beginning.
How did you first hear about it?
My college teacher first introduced it to our class as a learning resource, and I've been consistently using it ever since.
What do you like about THM?
I absolutely love the sheer volume and variety of content available. In my current role as a Level 2 SOC Analyst, I find that there is incredibly relevant, hands-on work that ties directly into my day-to-day responsibilities. Beyond that, the platform offers certifications and learning paths tailored to so many different job titles. It means there is always something new to learn and practice, regardless of your specific niche in the industry.
On why hands-on exposure builds muscle memory
Why do you think hands-on exposure is crucial to keeping skills current?
Cybersecurity is an incredibly dynamic field, and threats evolve daily. Reading about a new vulnerability or attack vector is very different from actually seeing what it looks like in network logs or understanding how it behaves in an environment. Hands-on exposure bridges the gap between theoretical knowledge and practical application. It builds the crucial muscle memory needed to respond quickly and effectively when you're dealing with a real incident in the SOC.
On finding time to study around alert fatigue
What makes continuous upskilling challenging while working within cybersecurity?
The biggest challenge is undoubtedly finding the right balance. As an Analyst, managing the daily volume of alerts and operational duties can be mentally taxing, which sometimes leads to alert fatigue. Finding the time and energy to study or jump into a lab after a demanding shift can be difficult. Additionally, the threat landscape shifts so rapidly that it can sometimes feel overwhelming to pinpoint exactly which new tool or vulnerability you should focus your energy on first.
On advice for breaking in
What is one piece of advice you'd give someone thinking of breaking into the space or trying to advance?
Focus on the fundamentals and get as much practical experience as you possibly can. Platforms like TryHackMe are brilliant because they allow you to learn by doing in a safe, guided environment. I also highly recommend consistency over cramming—spending just 30 minutes to an hour a day in a lab is far more effective than trying to study for ten hours over the weekend. Finally, don't be afraid to break things in your lab; figuring out how to fix them is often where the most valuable learning happens.
On going for SAL2 early
What made you decide to go for SAL2 early, before it was widely known?
Going for the SAL2 certification early felt like a natural step for me because it directly aligns with my current role as a Level 2 SOC Analyst. I was immediately drawn to the practical nature of the exam. Instead of just testing theoretical knowledge, it features a fully hands-on environment that closely simulates real-life SOC shifts and incident investigations. Knowing that I was among the very first cohort to tackle and pass such a rigorous, realistic assessment made the achievement even more rewarding.
On being a founding operator
What does being a founding operator mean to you, within your organisation or the broader community?
Being recognised as a Founding Operator is an incredible honour. It has already opened up some fantastic professional opportunities and allowed me to network with a brilliant community of forward-thinking defensive security professionals. Within my own organisation, it has given me a great platform to champion practical, continuous upskilling. It proves that we aren't just collecting paper credentials, but are actively validating the hands-on skills needed to protect our environments against complex, multi-stage threats.
On turning his own results into the pitch
Have you (or someone) brought THM into your org already?
Yes, I did!
How did you make the case for it internally?
After passing the certification myself and experiencing the direct, positive impact it had on my own day-to-day work in the SOC, I knew it would benefit the wider team. I essentially used my own experience as a proof of concept. I approached management and explained how the hands-on nature of the platform could help standardise and elevate the skills of our other analysts.
On ten analysts getting certified
What was the adoption like? Did you have to push, or did the team take to it?
The team took to it brilliantly, and the adoption has been incredibly successful. Since I first suggested it, we have had 10 analysts within the company successfully achieve their SAL1 certification. It didn't require a heavy push because the value was immediately obvious. Crucially, I've seen a noticeable improvement in the quality of their daily work and investigations since they completed the training and passed the exam.
On getting budget sign-off
What would you tell someone trying to get sign-off from their manager or procurement?
I would advise them to lead with tangible results. Show management how hands-on training directly translates to better operational efficiency, sharper incident response, and higher-quality work. If you can, take a pathway or an exam yourself first to act as the living proof of the platform's value. Managers and procurement are far more likely to sign off on a tool when you can point to real-world performance improvements right next to the price tag.
On why he's not done learning
What is your next goal on THM?
My immediate goal is to keep cracking on with the labs and modules that directly relate to my defensive role, keeping my day-to-day skills as sharp as possible. I'm also eagerly keeping an eye out for more advanced certifications to drop on the platform so I can jump straight into the next challenge!
On the road to pre-sales
What is your next goal in your career and life?
In terms of my career, I want to continue building deep, hands-on technical experience in the SOC. Once I have that solid practical foundation firmly under my belt, my ultimate goal is to transition into a Cybersecurity Pre-Sales role. I firmly believe that having a strong technical background is essential for pre-sales, as it allows you to truly understand a client's challenges, speak their language, and recommend the best solutions.
