For most beginners, the scope of cyber security in Nepal starts in a monitoring seat, not a hacking one. The usual first job is a Tier-1 SOC analyst, who watches security alerts, decides which ones are real, and passes the serious ones up.
SOC stands for security operations centre. It is the team that watches a company's security alerts, often day and night. In Nepal these teams sit in banks, fintech companies, telecoms, internet providers and IT firms, because that is where money and data sit.
What is the scope of cyber security in Nepal for a beginner?
Job posts show it more honestly than any blog. A Head of Security Operation Center post at eSewa, which closed in April 2026, asks that person to run 24/7 monitoring and to lead L1, L2 and L3 analysts. L1 is the first tier. That is where new people start.
A Junior SOC Analyst (L1) post on KumariJob for a Kathmandu company, which closed in December 2025, lists the daily work plainly. Watch alerts from the SIEM. Review logs. Judge how serious each alert is. Escalate the real ones. Write everything down.
We think this is the right door in, even if you want to become a penetration tester later. Testing gets the attention online. But a monitoring seat shows you what real attacks look like in real logs, and that makes you a better tester.
What does a junior SOC analyst do in a normal week?
A SIEM is one screen that collects logs from many machines and raises an alert when something looks wrong. A junior analyst's week turns around that screen. Most of it falls into three kinds of work.
Working the alert queue
Most of a shift is a list of alerts. For each one, you decide if it is real or a false positive. A false positive is an alert that fired on normal activity.
Take a common one: a burst of Windows event 4625, "An account failed to log on". Microsoft's documentation for event 4625 explains the fields you read. Logon Type 3 means the attempt came over the network. Type 10 means Remote Desktop. Status 0xC000006A means a wrong password, and 0xC0000064 means a user name that does not exist.
So the same alert can mean two different things. One staff member who forgot a password after a long holiday is normal. Dozens of Type 10 failures from an outside address at 2 a.m., across many user names, is not.
The question that matters most is what happened next. MITRE ATT&CK, the public catalogue of attacker techniques, files this under Brute Force (T1110). Its detection note looks for many failed logins followed by a success from the same address or user. A failure is noise. A failure followed by a success is your escalation.
Checking phishing reports
Staff forward emails they do not trust. Your job is to find out who really sent them. In the Gmail app, Google's help page on checking if a message is authenticated says to tap View details, then View security details. You look for "Mailed by" and "Signed by". If they do not match the bank the email claims to be from, you have a phishing case.
Writing it down
Every alert you close needs a short note: what you saw, what you checked, and why you closed it or passed it on. The KumariJob post asks for exactly this, "according to established procedures". At the end of a shift, you write a handover note so the next analyst knows what is still open.
What are the boring parts?
Many alerts turn out to be normal activity. You will close the same kind of false alarm again and again, and you still have to write each one down.
Monitoring around the clock means someone covers nights and holidays. The KumariJob L1 post also lists keeping security documents and procedures up to date, which is slow, careful work.
You also do not "hack" anything in this seat. When an alert is real, you hand it to L2, who investigates deeper. If that sounds dull, be honest with yourself before you pick this field.
What do Nepal job posts ask a junior for?
Read the requirements, not the title. The KumariJob L1 post asks for:
- a bachelor's degree in computer science, IT or a related field,
- 1 to 2 years of cyber security work,
- familiarity with SIEM tools, firewalls and IDS,
- TCP/IP, DNS and HTTP/S as they relate to monitoring,
- at least one certification or training in security.
An older Nepal Clearing House post on merojob, from 2022, asked for Wireshark, event log analysis and basic SIEM rules. So "junior" posts still ask for some experience. Written triage notes from labs are your best proof that you can already do the work. The KumariJob career blog also names IT support and junior network admin as entry roles. Both put you close to the firewalls and logs a SOC watches.
How does Saarathi's course cover this seat?
At Saarathi Academy in Old Baneshwor, Kathmandu, the Cybersecurity and Ethical Hacking course trains for two junior jobs: web and API VAPT analyst, and Tier-1 SOC analyst.
Week 10 is this seat. You work alerts in the Wazuh SIEM, which is free and open source. You read Windows events 4624, 4625, 4672 and 4688 in recorded logs. You check phishing headers with SPF, DKIM and DMARC, map real alerts to MITRE ATT&CK, and work a short shift that ends with a handover note.
Weeks 1 to 5 come first: the terminal, networks, Linux and reading logs. We recommend 16GB of RAM for Week 10, because Kali and Wazuh run together. With 8GB you can follow most weeks one machine at a time. Each classroom batch has up to 10 students, and mentors still do the job they teach.
Try the work tonight, free
On a Windows laptop, lock the screen. Type a wrong password three times, then log in. Open Event Viewer, go to Windows Logs, then Security, and filter for 4625. Read the Logon Type and the Status. Then find the 4624 success that came right after.
Now write three lines: what happened, what you checked, and your verdict. That is an L1 triage note. If no 4625 shows up, failed logon auditing is off on that laptop. That is a lesson too, because a SOC can only see what someone chose to log.
The full week-by-week plan is on the course page, and the syllabus is public before you pay.
Top comments (0)