Want a sequenced plan instead of a list? Join the structured learning tracks

Cert Atlas

TryHackMe SAL2

TryHackMe Security Analyst Level 2

Defensive Intermediate TryHackMe
Target job title
SOC Analyst (Tier 2) / Incident Responder
Level
Intermediate. Assumes fundamentals and some hands-on time; typical first-job or first-promotion certs.
Prerequisites
SAL1, or comfort with alert handling, log analysis and investigation workflows.
Official page
TryHackMe

Recent updates

Launched 25 March 2026 with NCC Group. Grades both technical and communication skills; valid for three years.

Reviewed 2026-10-02. Source. Confirm exam details on the official page before booking.

Where it sits in Defensive Security

  1. Entry BTL1 TryHackMe SAL1 CompTIA Security+ Google Cybersecurity Microsoft SC-900 ISC2 CC CCDL1
  2. Intermediate HackTheBox CDSA TryHackMe SAL2 CompTIA CySA+ CompTIA SecAI+ SPLK-5001 OSDA GCIH Microsoft SC-200
  3. Advanced BTL2 CCDL2 CompTIA SecurityX

Natural next steps: BTL2, CCDL2, CompTIA SecurityX.

Preparing for TryHackMe SAL2?

Structured learning tracks

Membership with role- and cert-based learning tracks: roadmaps, cheat sheets, assessments, exclusive writeups and member pricing on notes.

Join the learning tracks

Coaching & cert roadmaps

One-to-one guidance and a roadmap built around your background, target role and timeline, so you stop guessing which cert comes next.

See coaching programs

Prep resources & cheat sheets

Cheat sheets, command references and exam-day extras for when you already know the material and need it fast and in one place.

Browse prep resources