Software development
Artificial Intelligence
Cloud
View all courses
Learn
Connect
Blog
Resource hub
Featured resource
2025 Tech Upskilling Playbook
Tech Upskilling Playbook

Build future-ready tech teams and hit key business milestones with seven proven plays from industry leaders.

Check it out
  • Learning Path
    • Libraries: This path is only available in the libraries listed. To access this path, purchase a license for the corresponding library.
  • Core Tech
    •

Cyber Defense Analyst | Work Role ID: 511 (NIST: PD-WRL-001)

27 Courses
12 Labs
51 Hours
Skill IQ

A **cyber defense analyst** uses data collected from a variety of cyber defense tools (e.g., IDS alerts, firewalls, network traffic logs.) to analyze events that occur within their environments for the purposes of mitigating threats.

This path will get you started on your journey to becoming a cyber defense analyst! Begin with the fundamental concepts of networking and cyber literacy through hands-on labs, dive into the essential skills necessary to perform the day-to-day functions of a cyber defense analyst and then expand your skill set with, automation, deeper/advanced concepts and additional knowledge from adjacent roles!

This path aligns to the Knowledge, Skills, Abilities and Tasks (KSAs) within the **Workforce Framework for Cybersecurity (CSWF)** and the **DoD Cyber Workforce Framework (DCWF)** for the work role of:

**Cyber Defense Analyst** Work Role 511 or PD-WRL-001

Get started
Content in this path
Fundamentals

Begin your learning journey with the fundamental concepts of networking and security!

Course
Network Protocols for Security: TCP and UDP
  • by Brandon DeVault
  • 20m
  • Feb 09, 2023
Lab
Network Protocols for Security: TCP and UDP
  • by Brandon DeVault
  • 2h 5m
  • Aug 04, 2025
Course
Network Protocols for Security: DNS
  • by Brandon DeVault
  • 17m
  • Sep 28, 2023
Lab
Network Protocols for Security: DNS
  • by Brandon DeVault
  • 2h 5m
  • Aug 04, 2025
Course
IT Security Champion: Encryption
  • by Kevin James
  • 17m
  • Jan 30, 2024
Lab
Network Analysis: Network and Host Discovery
  • by Craig Stansbury
  • 45m
  • Aug 04, 2025
Course
IT Security Champion: Network Security Monitoring
  • by Christopher Rees
  • 17m
  • Mar 25, 2024
Lab
Network Analysis: Packet Capture
  • by Miguel Saavedra
  • 50m
  • Aug 04, 2025
Course
Windows Endpoint Security: Scheduled Tasks
  • by Michael Teske
  • 21m
  • Apr 28, 2023
Course
Scripting for Security: Windows
  • by Michael Teske
  • 40m
  • Aug 21, 2024
Lab
Scripting for Security: Windows
  • by Michael Teske
  • 1h 5m
  • Aug 05, 2025
Skill Essentials

Now that you know the fundamentals, dive into the essential skills necessary to perform the day-to-day functions of a cyber defense analyst including network analysis, and security event triage!

Lab
Assets and Topology: Vulnerability Analysis
  • by Zach Roof
  • 2h
  • Aug 05, 2025
Course
Conducting Network Vulnerability Analysis
  • by Kevin Cardwell
  • 2h 28m
  • Jul 31, 2025
Lab
Investigate Cyber Network Attacks with Wireshark
  • by Laurentiu Raducu
  • 55m
  • Aug 05, 2025
Course
Advanced Cyber Defense Analysis with Wireshark
  • by Sean Wilkins
  • 2h 31m
  • Jan 26, 2023
Course
Security Event Triage: Operationalizing Security Analysis
  • by Aaron Rosenmund
  • 54m
  • Jul 31, 2025
Course
Security Event Triage: Monitoring Assets and Topology
  • by Daniel Lachance
  • 1h 36m
  • Jul 31, 2025
Course
Security Event Triage: Detecting Malicious Traffic with Signature and Session Analysis
  • by Guillaume Ross
  • 1h 59m
  • Jul 31, 2025
Course
Security Event Triage: Leveraging Existing Security Device Alerts
  • by Daniel Lachance
  • 1h 18m
  • Jul 31, 2025
Course
Security Event Triage: Detecting Network Anomalies with Behavioral Analysis
  • by Aaron Rosenmund
  • 2h 1m
  • May 07, 2019
Course
Security Event Triage: Monitoring Network Application Services
  • by Alan Monnox
  • 2h 32m
  • Jul 31, 2025
Course
Security Event Triage: Revealing Attacker Methodology in Web Application Events
  • by Aaron Rosenmund
  • 2h 9m
  • Jul 31, 2025
Course
Security Event Triage: Analyzing Live System Process and Files
  • by Cristian Pascariu
  • 1h 34m
  • Jul 31, 2025
Expanded Skillset

It's time to expand your skill set with tools, and more advanced concepts! This section gives you a brief introduction into many, additional skills that you will find helpful as a cyber defense analyst. We have full training paths on all of these skills; see the Supplemental Skill Paths section to learn more.

Course
Elastic Stack: Getting Started
  • by Aaron Rosenmund
  • 1h 41m
  • Feb 25, 2025
Course
Network Analysis with Arkime
  • by Josh Stroschein
  • 45m
  • Dec 11, 2020
Lab
Network Analysis: Session Data and Signatures
  • by Sean Wilkins
  • 1h 38m
  • Aug 05, 2025
Lab
Signatures and Sessions: Malware HTTP Analysis
  • by Zach Roof
  • 1h 25m
  • Aug 05, 2025
Course
Security Event Triage: Detecting System Anomalies
  • by Aaron Rosenmund
  • 1h 47m
  • Jul 31, 2025
Course
Security Event Triage: Statistical Baselining with SIEM Data Integration
  • by Cristian Pascariu
  • 1h 31m
  • Jul 31, 2025
Adjacent Skill Knowledge

Now that you've mastered all the skills for a cyber defense incident responder, learn about additional cyber roles and their responsibilities.

Course
Information and Cyber Security GRC: Governance
  • by Dominique West
  • 1h
  • Nov 09, 2023
Course
Information and Cyber Security GRC: Risk Management
  • 1h 36m
  • Feb 27, 2024
Course
Information and Cyber Security GRC: Compliance Assessment and Reporting
  • by Jacob Ansari
  • 1h 55m
  • May 15, 2023
Course
Security Engineering: Secure Networks
  • by Chris Jackson
  • 1h 43m
  • Aug 13, 2024
Course
Incident Response: Detection and Analysis
  • by Aaron Rosenmund
  • 2h 19m
  • Dec 16, 2021
Lab
Network Attacks: Reverse Shells
  • by Rishalin Pillay
  • 1h
  • Aug 04, 2025
Course
Sandworm: C2 over HTTP Emulation
  • by Matthew Lloyd Davies
  • 5m
  • Nov 12, 2024
Lab
Sandworm: C2 over HTTP Emulation Lab
  • by Matthew Lloyd Davies
  • 55m
  • Aug 05, 2025
Course
Sandworm: Keylogging Emulation
  • by Matthew Lloyd Davies
  • 5m
  • Nov 18, 2024
Lab
Sandworm: Keylogging Emulation Lab
  • by Matthew Lloyd Davies
  • 30m
  • Jul 30, 2025
Try this learning path for free
Access this learning path and other top-rated tech content with a free trial.
Free individual trial
Free team trial
What You'll Learn
Prerequisites
  • None
Related topics
  • dcwf
  • nice framework
  • cyber security
  • information security
Not sure where to start?
With over 500 assessments to choose from, you can see where your skills stand and receive adaptive learning recommendations to fill knowledge gaps in as little as 10 minutes.
Learn more
Learn with the best
Brandon DeVault
Brandon DeVault
Brandon DeVault is a Security Researcher focused on threat hunting at CrowdStrike. He is also a member of the Florida Air National Guard with a variety of offensive and defensive experience. Prior to joining CrowdStrike, Brandon worked full-time as an author with Pluralsight and at Elastic, creating and delivering security content. He also worked with Special Operations Command, where he had two deployments to Afghanistan on deployable communications teams. His experience spans incident response...
Kevin James
Kevin James
As a seasoned technologist with over 30 years of wide-ranging expertise in information technology roles across diverse industries, Kevin is passionate about finding effective and economical solutions to business problems. His passion for teaching technical subjects allows him to have a particular style that imparts information yet teaches at the same time. He enjoys working with Linux, Unix and Windows Operating Systems and combined with a deep knowledge of software platforms as varied as Ap...
Craig Stansbury
Craig Stansbury
Craig has over 10 years of IT experience, including working on Palo Alto Firewalls, Cisco Routes and Switches, Microsoft Servers, and VMWare ESXi. Craig started in IT in the United States Marine Corps and began teaching his Marines all the design and implementation concepts that they needed to know. He loves when his students have the "lightbulb moment" and are able to understand the concepts he is teaching them. Aside from teaching, Craig also owns a business that consults with enterprises to h...
Christopher Rees
Christopher Rees
Chris is a professional information technologist, author, trainer, manager and a lifelong learner. He is married with 3 beautiful children and interested in working out, spending time with family and friends and being creative whenever possible. He has been an author for over 25 years and has created over 60 IT Certification training courses. Chris really enjoys helping people advance in their careers through training and personal development.
Miguel Saavedra
Miguel Saavedra
Miguel Saavedra is an author, solutions architect, and Instructor specializing in AWS, big data, automation, and security. He has worked in several companies in the finance/fintech, education, and medical industries as well as some government projects. He has published and conducted research on both cloud and on-premise solutions for big data focusing on network analytics, and machine learning. He also designs highly available and automated CICD toolchains for high throughput microservices on AW...
Michael Teske
Michael Teske
Michael Teske is a principal security author with Pluralsight helping people build their skills toolkit. Michael has 25+ years of experience in the IT Ops/Cloud/Cybersecurity industry including 17 of those years as an IT instructor at a technical college, focusing on Microsoft server infrastructure, security and automation. Michael attained his MBA with an emphasis in Computer Information System Security several years ago. Michael still keeps up with the industry as an independent consultant in ...
Zach Roof
Zach Roof
Zach describes himself as “an ordinary guy who’s extraordinarily curious about technology.” This curiosity has led to roles in Software Development, Application Security, DevOps, and Security Engineering. Currently, Zach is the Lead Security Engineer at Credible where he helps lead the security vision of a highly sensitive Fintech product. Outside of his day job, Zach has spoken at SyntaxCon, created cybersecurity tutorials through Securing The Stack, led an AWS Meetup group, and has provided cy...
Kevin Cardwell
Kevin Cardwell
Kevin Cardwell provides consulting services for companies throughout the world and is an adviser to numerous government entities across the globe. He is an instructor, technical editor, and author for computer forensics and hacking courses. He is author of Building Virtual Pentesting Labs for Advanced Penetration Testing, first and second edition.
Laurentiu Raducu
Laurentiu Raducu
It all began in highschool, when Laurentiu first started his path in the computer science journey. Initially he started with C++, and fell in love quickly with the prospect of learning to develop software. Thanks to his passion for chess, his first computer program was a console-based ASCII chess game developed in C++. After a while, during university, Laurentiu started to experiment with other OOP programming languages, like Java, Kotlin or Python. He started to play with different tech stacks ...
Sean Wilkins
Sean Wilkins
Sean Wilkins, with over two decades of experience in the IT industry, serves as a distinguished networking consultant and contributor at Tech Building Blocks. His professional journey spans multiple prominent enterprises, underlining his extensive field expertise. Sean's credentials include esteemed certifications from Cisco (CCNP/CCDP), Microsoft (MCSE), and CompTIA (A+ and Network+). Academically, he has achieved a Master’s of Science in Information Technology, specializing in Network Architec...
Aaron Rosenmund
Aaron Rosenmund
Aaron M. Rosenmund is a cyber security operations subject matter expert, with a background in federal and business defensive and offensive cyber operations and system automation. Leveraging his administration and automation experience, Aaron actively contributes to multiple open and closed source security operation platform projects and continues to create tools and content to benefit the community. As an educator & cyber security researcher at Pluralsight, he is focused on advancing cyber secur...
Daniel Lachance
Daniel Lachance
Daniel Lachance, CompTIA Security+, CompTIA A+®, CompTIA Network+®, CompTIA Server+, CompTIA Cloud Essentials, MCITP, MCTS, MCSA, is the owner of Lachance IT Consulting Inc. He is the author of the CompTIA Server+ Certification All-in-One Exam Guide, CompTIA Cloud Essentials Certification Study Guide, and co-author of CompTIA Security+ Certification Practice Exams. Mr. Lachance is an experienced trainer having delivered IT training in Canada and the Caribbean since the 1990s on topics ranging f...
Guillaume Ross
Guillaume Ross
Guillaume Ross is an experienced information security professional, providing services to many organizations as the lead consultant and founder of Caffeine Security Inc. Having worked in multiple verticals, from Fortune 50 to startups, his specialty is providing the right security program and architecture for each specific environment and company, and leading blue teams.
Alan Monnox
Alan Monnox
Alan is the Lead Architect for the cyber security company Reveille Security. He is also the author of the book Rapid J2EE Development published by Prentice Hall. Alan’s tenure in the IT industry goes back over several decades and during that time he has been fortunate to work on many large-scale systems for a range of business-sectors and industries, including energy, finance, retail and healthcare. His core skills are in information security, solution architecture, and systems integration. Much...
Cristian Pascariu
Cristian Pascariu
Cristian took part in auditing and implementation of infosec capabilities to uplift security posture. He managed codification efforts to extract indicators of compromise and created rules in the scope of defending against new emerging threats. He has also developed tools and scripts to overcome security gaps within the corporate network. Cristian has mentored L1 and L2 analysts to increase triage efficiency and combat new threats. He has experience in the field of Application Security and has pr...
Josh Stroschein
Josh Stroschein
Josh is an experienced malware analyst and reverse engineer and has a passion for sharing his knowledge with others. He is a reverse engineer with the FLARE team at Google, where he focuses on tackling the latest threats. Josh is an accomplished trainer, providing training at places such as Ring Zero, BlackHat, Defcon, Toorcon, Hack-In-The-Box, Suricon, and other public and private venues. Josh is also an author on Pluralsight, where he publishes content around malware analysis, reverse engineer...
Dominique West
Dominique West
With 10 years in the Technology industry, Dominique West currently manages Datadog's compliance management function within the Information Security Department. As a leader, she is responsible for maintaining and executing the regulatory compliance roadmap, ensuring that it supports the business, sales and revenue objectives while maintaining alliance with existing information security standards. Prior to her time at Datadog, Dominique worked for as a Senior Cloud Security Consultant for Ernst ...
Jacob Ansari
Jacob Ansari
Jacob Ansari worked on Pluralsight courses that cover the topic of PCI DSS Standards.
Chris Jackson
Chris Jackson
Chris Jackson is a cybersecurity professional with years of experience in identifying security incidents, securing applications and security training. Over the years, he has tested web applications for vulnerabilities, helped deploy SIEM platforms and more. He is passionate about teaching cybersecurity and committed to learning new technologies.
Rishalin Pillay
Rishalin Pillay
Rishalin is a prolific author and cybersecurity expert. He has authored several video courses on Pluralsight, as well as three books: "Learn Penetration Testing", "Offensive Shellcode from Scratch." and "Ethical Hacking Workshop". He is also a technical contributor to many other books on topics such as dark web analysis, Kali Linux, offensive security, and SECOPS. He has received the Microsoft Content Publisher Gold and Platinum awards for his contributions to the cybersecurity industry. Rishal...
Matthew Lloyd Davies
Matthew Lloyd Davies
Matt is a cyber security author and researcher here at Pluralsight. A certified penetration tester and incident handler, he created Pluralsight's CompTIA Pentest+ Specialized Attacks courses as well our courses on wireless, ICS/OT and hardware hacking. Matt has also helped to build our security labs portfolio; labs that help you get hands-on to understand the threats and vulnerabilities your organization faces today. With a background in Chemical Engineering, Matt's focus is on the security ...

Get started with Pluralsight

View individual plans View team plans