Skip to main content

Study and Review Calendar

Proposed start: 31 Aug 2026Self-pacedFocused blocksRegular one-on-one review
Download calendar (.ics)Subscribe with calendar app

Suggested weekly rhythm​

The assessment indicates very high willingness to allocate learning time, but it also identifies time division between work and learning as a challenge. The IDR therefore uses focused core sessions rather than filling every available hour.

DayTimeActivityOutput
Monday18:30–19:30Theory / primary documentationNotes + one question
Wednesday18:30–20:00Lab / investigationTechnical evidence
Thursday18:30–19:30Documentation / GitHubREADME, timeline or rule notes
Saturday09:00–11:00Deep work / portfolioCompleted weekly artefact
Alternate Wednesday20:00–20:30Mentor / one-on-one reviewFeedback + next actions

The core timetable is about 5.5 hours per week, deliberately lower than the maximum time Nkateko said he is willing to invest. Extra learning time should be optional and targeted, not used to create an unsustainable backlog.

12-week schedule​

Week commencingFocusPrimary output
31 Aug 2026Baseline and SOC foundationsCapability matrix + lab architecture
7 Sep 2026Networking and Windows telemetryEvent-source map
14 Sep 2026Wazuh operationsThree alert-triage records
21 Sep 2026Event 4625 investigationInvestigation pack
28 Sep 2026Detection engineeringTwo tested detection ideas
5 Oct 2026Incident responseTabletop runbook
12 Oct 2026GitHub workflowReviewed evidence repository
19 Oct 2026Cloud securityControl baseline
26 Oct 2026ATT&CK and threat intelligenceTechnique-to-telemetry matrix
2 Nov 2026AutomationPython/PowerShell SOC utility
9 Nov 2026Communication and interviewsIncident brief + interview stories
16 Nov 2026CapstoneMulti-stage case study + next-90-day plan

Review checkpoints​

  • Weekly: record evidence, blockers and learning hours.
  • Fortnightly: one-on-one review of one completed artefact.
  • Day 30: check investigation method, Wazuh confidence and workload sustainability.
  • Day 60: review detection quality, incident-response thinking and communication progress.
  • Day 90: assess portfolio readiness and choose the next specialisation emphasis.

Rescheduling rule​

Missed time is not recovered by doubling the following week. Move the highest-value activity, preserve the evidence outcome and record the reason. Repeated slippage should trigger a scope reduction rather than hidden backlog.