Professor Simon's IT and Cybersecurity Podcast

Someone reports an email and says, "This looks weird." You have a queue, a few minutes, and a message you shouldn't click anything in. Where do you start? In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through a five-step first-look routine for a reported suspicious email: scope, read, check, compare, and decide.
I use one made-up example, an access-expiry message that looks like it comes from a document-sharing service, to show how to read a message safely, weigh the sender, authentication results and links without treating any single clue as proof, ask the reporter what they did without blaming them, and choose between closing with a supported reason, asking for more information and escalating. I leave the example's final answer open on purpose.
This episode is for IT professionals moving into security, and early-career practitioners, including junior SOC analysts and help desk staff, who receive suspicious email reports. If your team's process says something different, your team's process wins.
▶️ Companion YouTube Video: https://youtu.be/LLfsNu6cewc
📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/phishing-email-triage-first-look-routine
🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠⁠
🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠⁠
📸 Instagram • X • TikTok: @profsimononline

Your lead asks you to show that a security control is working. You open the console, and everything is green. Is that proof? In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through four questions for answering an evidence request honestly: what are we trying to prove, what evidence would actually show that, can we trust what we're looking at, and what can't we prove yet.
I use a made-up example, endpoint protection on company laptops with invented numbers, to show what a settings screenshot and a console report can and cannot establish, how to check that evidence can be trusted, and why two lists that do not match cannot yet be treated as a protection gap. I finish with a short fictional evidence note you can model.
This episode is for IT professionals moving into security, and early-career practitioners, who are asked to gather, check and explain evidence within their own responsibilities. I am not telling you what any auditor wants.
▶️ Companion YouTube Video: https://youtu.be/TzOjSPYWNvc
📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/prove-security-control-works-what-to-show
🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠⁠
👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠⁠
🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠⁠
🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠⁠
🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠⁠
💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠⁠
📸 Instagram • X • TikTok: @profsimononline

You are working an alert and something catches your eye: an AI tool you have never heard of. Is it a problem? You do not know yet, and what makes it uncomfortable is not knowing whether it needs you to do anything at all.
In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through three steps for handling it without overstepping: notice, document and escalate. It is for early-career analysts and IT professionals moving into security. I am not asking you to go looking for AI tools. I am talking about what you do when one turns up during your normal, authorized work, in an alert, a log entry, a ticket or something a colleague mentioned.
I use a made-up example: an alert showing activity consistent with an attempted file upload from a user's device to a site that appears to be an AI summarization tool. From the alert alone, you cannot tell whether the transfer completed, what information, if any, the site received, or whether the tool is approved.
Notice: work out what you can establish from the evidence you are authorized to see. An unfamiliar AI tool is not automatically prohibited, and it is not automatically dangerous either. Separate what the evidence shows from what it does not, and write down what you cannot answer as unknown.
Document: write notes someone else can use to decide. Keep what you observed apart from what you are assuming, and keep the notes lean.
Escalate: follow your organization's procedure and hand the question to someone who can decide, using a five-point message, with a sample.
I leave the ending of the example open on purpose. The example is made up.
▶️ Companion YouTube Video: https://youtu.be/Cy9C6lQlr2s
📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/shadow-ai-in-an-alert-security-analyst ⁠
🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠⁠
👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠⁠
🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠⁠
🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠⁠
🌐 Website: ⁠⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠⁠
💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠⁠
📸 Instagram • X • TikTok: @profsimononline

You have been closing alerts for months, and it still feels like you are not getting anywhere. What should you build next?
In this episode of Professor Simon's IT & Cybersecurity Podcast, I give you a practical way to think about what to build as a security or SOC analyst, in three parts: depth, ownership and direction. It is for analysts somewhere between their first few months and their third year. I am not assuming your organization has tiers or a standard promotion ladder.
Depth: understand why an alert fired, pay attention to repeats, learn the systems involved and write investigation notes someone else can follow.
Ownership: take responsibility for small improvements within your authority, share findings clearly and help newer teammates when it is appropriate.
Direction: ask for specific feedback, find out what more responsibility looks like where you work, keep a record of your contributions and build a realistic growth plan.
I also give you one thing to do this week. This is professional judgment and not a rule for every employer, and none of it promises a promotion. The example is made up.
▶️ Companion YouTube Video: https://youtu.be/TIIzUIV-G2M
📝 Companion Blog Post: Companion blog post: ⁠https://professorsimon.com/blog/soc-analyst-career-growth-beyond-closing-alerts
🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠⁠
👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠⁠
🎯 Cybersecurity Interview Prep Pack: ⁠⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠⁠
🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠⁠
🌐 Website: ⁠⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠⁠
💼 LinkedIn: ⁠⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠⁠
📸 Instagram • X • TikTok: @profsimononline

You've landed your first SOC job. Now what?
Your first 90 days as a SOC analyst aren't about knowing everything or being the fastest person on the team. They're about learning your environment, building consistent habits, and developing the judgment to know when to investigate further and when to ask for help.
In this episode of Professor Simon's IT & Cybersecurity Podcast, I walk through a practical approach to your first three months:
Days 1 to 30: Learn the environment, tools, workflows, and escalation procedures.
Days 31 to 60: Build a repeatable investigation routine and improve your documentation.
Days 61 to 90: Develop judgment, recognize unusual details, and understand your authority.
I also discuss how to respond when you make a mistake, including communicating promptly, separating facts from assumptions, and documenting what you learned.
This is a practical framework, not a guaranteed onboarding schedule. The mistake scenario is fictional.
Resources:
📘 First SOC Shift: https://professorsimon.com/books/first-soc-shift
▶️ Companion YouTube Video: https://youtu.be/BohwoRWVDvY
📝 Companion Blog Post: Companion blog post: https://professorsimon.com/blog/first-90-days-as-a-soc-analyst
🎧 More Podcast Episodes: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/podcast⁠⁠⁠⁠⁠⁠
👉 Need help with your IT or cybersecurity career? Work with me: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/guidance⁠⁠⁠⁠⁠⁠
🎯 Cybersecurity Interview Prep Pack: ⁠⁠https://professorsimon.com/products/cybersecurity-interview-prep-pack⁠⁠
🔗 Resources, blog & more: ⁠⁠⁠⁠⁠⁠https://professorsimon.com/links⁠⁠⁠⁠⁠⁠
🌐 Website: ⁠⁠⁠⁠⁠⁠https://professorsimon.com⁠⁠⁠⁠⁠⁠
💼 LinkedIn: ⁠⁠⁠⁠⁠⁠https://www.linkedin.com/in/leonardsimon⁠⁠⁠⁠⁠⁠
📸 Instagram • X • TikTok: @profsimononline