How do I move from SOC L1 to L2 faster?

Practical steps: (1) Master 1 SIEM platform deep (typically Splunk for Bangalore SOCs); (2) Earn Splunk Power User Certified or equivalent; (3) Volunteer for night shift incident handling — gets you hands-on with real incidents (not just runbook execution); (4) Document case studies from your investigations — build a portfolio you can reference in L2 interviews; (5) Learn Sigma rule writing + contribute to detection engineering; (6) Master MITRE ATT&CK enough to discuss in interviews; (7) Add a specialisation: cloud (AWS Security Specialty), threat intel, or detection engineering. Realistic timeline: 18-24 months L1 → L2 with focused effort. Faster: 12-15 months if you handle a real major incident well.