UK

United Kingdom · Technology and data · Entry Level (0-2 years)

Associate SOC Analyst

As an Associate SOC Analyst, you are the first line of defence against digital threats, learning the ropes while keeping our systems secure.

Here is the whole job, in plain words. What it is, a real day, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

Start my Associate SOC Analyst plan, free

Free to start: a plan built for this role, and a Future Fluency module to try first. No card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Upskilling a team in this role? Talk to us

  • Experience bandEntry Level (0-2 years)
  • Direct reportsNo direct reports
  • Reports toCybersecurity Support Analyst (L2) or SOC Team Lead
  • UK framework levelUsually someone starting out, or keeping a process running

Also advertised as Junior Cybersecurity Analyst · Security Operations Centre Analyst (Entry) · Tier 1 Security Analyst

Built on 43,079 real UK job descriptions we analysed · grounded in qualifications employers recognise

Two short quizzes about you

1From this job to a course

The qualifications matched to this job

Cambridge OCR Level 3 Cambridge Technical Introductory Diploma in IT Cambridge OCR · Level 3 · covers 1 of 11 standards
Cambridge OCR Level 3 Cambridge Technical Subsidiary Diploma in IT Cambridge OCR · Level 3 · covers 1 of 11 standards
Cambridge OCR Level 3 Cambridge Technical Extended Diploma in IT Cambridge OCR · Level 3 · covers 1 of 11 standards
Cambridge OCR Level 3 Cambridge Technical Certificate in IT Cambridge OCR · Level 3 · covers 1 of 11 standards
Cambridge OCR Level 3 Cambridge Technical Diploma in IT Cambridge OCR · Level 3 · covers 1 of 11 standards
NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma) NCFE · Level 3 · covers 5 of 11 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Networked systems security Cambridge OCR Level 3 Cambridge Technical Introductory Diploma in IT
Cyber security threats, vulnerabilities and risks NCFE Level 3 Technical Occupational Entry in Cyber Security (Diploma)

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
AI Governance Fluency using AI responsibly
Automation Fluency building AI into how work runs
Trust Fluency keeping the digital world safe
Start my Associate SOC Analyst plan, free
Your Plan Illustration

Built for Associate SOC Analyst

2 units that map to this job, from the qualifications that cover it.

  1. Networked systems security Cambridge OCR · covers 1 of 11 standards Level 3
  2. Cyber security threats, vulnerabilities and risks NCFE · covers 5 of 11 standards Level 3
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as an Associate SOC Analyst?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

How the AI economy is changing work like this

A broad read on this kind of work, not an analysis of this job on its own. Roles that share a pattern get the same answer here.

Fading: AI does more of this

AI is starting to handle the repetitive tasks like summarising threat intelligence and drafting basic reports.

→
Rising: worth more because of AI

Your ability to interpret complex security data and make informed decisions becomes even more valuable.

The new skills this role is being asked for

  • Prompt Engineering & AI Tool Interaction
  • Basic Scripting for Automation (Python)
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your Associate SOC Analyst plan as you set up, starting with a Future Fluency module on using AI in your job. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Start my Associate SOC Analyst plan, free Ready to pay? Subscribe for £70 a month

3What this role really is

We see you

You sometimes wonder if AI will replace the hands-on learning you crave. Yet, you feel a quiet curiosity about how it might actually enhance your skills.

An Associate SOC Analyst monitors systems for threats and helps spot and stop security incidents as they happen.

4A day in the life

Not a job advert. A real day, built from what this role actually holds.

08:45
You start your day by checking the Splunk Enterprise Security dashboards, scanning for any unusual activity that needs escalation.
11:00
You dive into a ServiceNow SecOps ticket, ensuring every update is clear and aligns with the workflow before closing it.
14:30
Under supervision, you perform an initial investigation on a low-complexity alert in CrowdStrike Falcon, learning something new about host interrogation.
16:00
During the daily team stand-up, you share your progress and ask a senior analyst for advice on a tricky security incident.

5What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Splunk Enterprise Security Intermediate

Monitoring pre-built dashboards for security alerts, running saved searches to gather more context, and triaging notable events as they come in. You'll be living in Splunk.

ServiceNow SecOps Intermediate

Working through incident and request tickets from your queue, updating them with your findings, and making sure they're closed according to our established workflows and SLAs.

CrowdStrike Falcon Intermediate

Investigating and closing low-complexity alerts related to endpoint activity, and using its Real-time Response feature for basic host interrogation (e.g., checking running processes) under supervision.

Tenable.sc (Nessus) Basic

Running pre-configured vulnerability scans and generating standard reports. You'll be looking at the output, but not yet interpreting the deeper implications or prioritising remediation.

Confluence Intermediate

Following documented runbooks and procedures for incident handling, and updating incident timelines or adding small pieces of information to existing knowledge base pages.

MISP (Malware Information Sharing Platform) Basic

Consuming Indicators of Compromise (IOCs) from MISP to search for them in other tools like Splunk or CrowdStrike, helping you identify known malicious activity.

6What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Incident Escalation Escalate all non-routine or critical alerts immediately to a senior analyst or SOC Team Lead. You'll provide all gathered information. Independently decide when to escalate routine incidents based on predefined criteria; escalate complex or high-impact incidents to a lead. Decide on escalation paths for complex incidents, including engaging external parties; consult on major incident declaration.
Security Tool Configuration Changes No authority to make any configuration changes. You'll report potential issues or suggest improvements to your lead. Propose minor configuration changes (e.g., false positive tuning) to a lead for review and approval. Design and implement significant configuration changes and new detection rules within your area of expertise, with peer review.
Communication with External Parties No direct communication with external parties (e.g., clients, vendors, law enforcement) without explicit instruction and supervision. Communicate with internal clients or vendors on routine security matters (e.g., ticket updates, information requests). Represent the SOC in technical discussions with external security partners or during vendor engagements.
Process & Runbook Updates Suggest improvements or identify outdated information in existing runbooks to your lead. Propose and draft updates to existing runbooks for review by senior team members. Lead the creation of new runbooks and significantly revise existing processes based on incident learnings.

7How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Mean Time to Acknowledge (MTTA)
How quickly you pick up and start working on a new security alert or incident ticket.
Target · < 15 minutes for critical alerts; < 30 minutes for high priority.

If a critical alert comes in at 10:00, you should have it assigned to yourself and be reviewing it by 10:14 at the latest. We track this automatically in ServiceNow.

Ticket Closure Rate within SLA
The percentage of assigned security incidents and requests you manage to close within their agreed Service Level Agreement (SLA) timelines.
Target · > 95% for routine tasks; > 85% for more complex, supervised tasks.

You're given 20 tickets this month. If you close 19 of them on time, that's 95%. This shows you're managing your workload effectively, or escalating when you need to.

False Positive Identification & Documentation
Your ability to correctly identify alerts that aren't actual threats and document why they're false positives, helping us tune our systems.
Target · Correctly identifies and documents > 10 false positives per week (after initial training).

You investigate an alert for 'unusual login activity' and determine it was a legitimate login from a new VPN location. You'd then document this clearly, explaining your findings, which helps us refine the alert.

Adherence to Runbooks & Procedures
How consistently you follow our established, step-by-step guides (runbooks) for handling specific types of security incidents.
Target · 100% adherence for all critical incident types; > 90% for standard procedures.

When a phishing email is reported, you follow every step in the 'Phishing Triage' runbook, from checking headers to submitting for sandbox analysis, without missing a beat. This ensures consistency and reduces risk.

Quality of Initial Incident Notes
How clear, concise, and accurate your initial notes are when triaging an alert or starting an incident investigation. This helps the next person pick it up quickly.
  • Senior analysts can quickly understand the situation from your notes
  • no need for follow-up questions to grasp the basics
  • all relevant timestamps and initial findings are recorded.
Proactive Learning & Skill Development
Your initiative in picking up new skills, asking questions, and seeking out knowledge to improve your cybersecurity understanding.
  • Regularly asking thoughtful questions during team meetings
  • completing assigned training modules ahead of schedule
  • sharing interesting articles or new attack techniques you've read about
  • seeking feedback on your investigations.
Team Collaboration & Communication
How well you work with the rest of the SOC team, knowing when to ask for help, sharing information, and communicating clearly.
  • Actively participating in daily stand-ups
  • clearly articulating when you're stuck on a problem
  • offering to help teammates when your workload allows
  • providing constructive feedback during peer reviews (once you're ready).
Attention to Detail in Task Execution
Your ability to be precise in your work, ensuring that critical details like IP addresses, hostnames, or timestamps are correct.
  • Zero instances of incorrect IP blocks or host isolations due to typos
  • incident reports are free of factual errors
  • your analysis consistently points to the correct logs or events.

8Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Continuous Learning & Skill Development

You'll genuinely enjoy diving into new security concepts, asking 'why' something works the way it does, and spending time understanding the latest threats. Every alert is a learning opportunity, and you'll be keen to soak up knowledge from your senior colleagues.

After triaging a suspicious email, you'll spend an extra 15 minutes researching the specific malware family mentioned in a threat intel report, just to deepen your understanding, even if it's not strictly required for that ticket.

Solving Puzzles & Investigating

You get a real kick out of piecing together clues from different logs and alerts to figure out what happened. Each incident is a mini-mystery to solve, and you're driven by the satisfaction of uncovering the truth and understanding the attacker's path.

You're given an alert about an unusual network connection. Instead of just closing it, you'll dig into firewall logs, endpoint data, and user activity, trying to build a full timeline of events, even for a low-priority issue.

Contributing to a Greater Good

You're motivated by the idea that your work genuinely helps protect our organisation and its customers. You understand the importance of what you do and feel a sense of purpose in defending against cyber threats, even in the smaller, everyday tasks.

Successfully blocking a phishing campaign, even a small one, gives you a sense of accomplishment because you know you've prevented potential harm to a colleague or the company.

What frustrates people
  • Alert Fatigue: Drowning in a sea of low-fidelity alerts from poorly configured tools, making it easy to miss the one that actually matters.
  • The 'Repeat Offender': Dealing with the same user clicking on phishing emails every single month, despite targeted training and multiple warnings.
  • The 3 AM Page for Nothing: Being woken up by an automated alert for a server reboot that the operations team 'forgot' to announce in the change management system.
  • Outdated Runbooks: Kicking off an incident response only to find the documented procedure is for a tool that was decommissioned six months ago (though we try to keep them current!).
  • Repetitive Tasks: Some days, it feels like you're just doing the same basic triage over and over again.
What this role does not give you
  • Immediate, high-level strategic influence – that comes with experience.
  • A quiet, predictable 9-to-5 where nothing unexpected happens.
  • The chance to build complex, greenfield security solutions from scratch (not yet, anyway).
  • A role where you're always working on brand-new, exciting projects; some of it is just keeping the lights on.

9Who you work with

Your primary impact will be in ensuring that initial security alerts are handled quickly and correctly. Getting it right means potential threats are identified and contained early, reducing the risk of data breaches, service disruptions, and reputational damage. Essentially, you're helping to keep our digital environment safe and sound, which is pretty crucial for everyone.

Inside the business
  • SOC Team Lead
  • Senior Cybersecurity Support Analysts
  • IT Operations Team (for incident coordination)
  • Service Desk (for user-reported issues)
Outside the business
  • None directly, though you might occasionally assist in gathering information for external security partners under supervision.

10What you need before you start

Not a wish list. The things you would be expected to already have.

  • A foundational understanding of how computers and networks work (e.g., from personal interest, a college course, or an IT helpdesk role).
  • A genuine curiosity about cybersecurity and a drive to learn.
  • The ability to follow instructions meticulously and pay close attention to detail.
  • Strong written and verbal communication skills – you'll be documenting a lot and talking to your team constantly.
  • Comfort with using multiple software applications and navigating complex interfaces (like our SIEM tools).

11What to practise next

Where the job is going, and what to do about it starting this week.

Cloud Security Fundamentals

More and more of our infrastructure is moving to the cloud (AWS, Azure, GCP). Understanding how security works in these environments – different controls, different logging, different attack surfaces – is becoming absolutely essential for any security analyst.

Shared Responsibility Model · Identity and Access Management (IAM) · Cloud Logging & Monitoring · Cloud Security Best Practices

  • This month: Start with a free 'Cloud Concepts' course from AWS, Azure, or Google Cloud. Get familiar with the terminology.
  • Next month: Focus on the security sections of those courses. Understand IAM and logging in one specific cloud provider.
  • Month 3: Look for free labs or sandbox environments to get hands-on with cloud security configurations.
  • Month 4: Discuss with senior analysts how our current security tools integrate with our cloud environments.

Quick win: Read up on the 'Top 10 Cloud Security Risks' (e.g., from OWASP) and understand what each one means in practice.

12Staying current once you are in

What people here do to keep up
  • Participate in online security challenges or 'Capture The Flag' (CTF) events to hone your practical skills.
  • Follow reputable cybersecurity blogs and news sources (e.g., KrebsOnSecurity, SANS Internet Storm Centre) to stay current on threats.
  • Join local cybersecurity meetups or communities – it's a great way to learn and network.
  • Take advantage of internal training programmes and mentorship opportunities we offer.
  • Set up a small home lab to experiment with security tools and practice your skills in a safe environment.

13The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

Prompt Engineering & AI Tool Interaction

AI is already starting to automate parts of our work, from summarising threat intel to drafting incident reports. Analysts who can effectively 'talk' to these tools – giving them the right instructions (prompts) – will be significantly more productive. It's not about being an AI developer, but a skilled AI user.

  • Clear Prompt Construction
  • Context Provision
  • Output Validation
  • Ethical AI Use

Basic Scripting for Automation (Python)

As you get more experienced, you'll spot repetitive tasks that could be automated. Knowing a bit of Python means you can start writing small scripts to pull data, parse logs, or automate simple checks, making your life (and the team's) easier. It's about moving beyond manual clicks.

  • Variables & Data Types
  • Conditional Logic (if/else)
  • Loops (for/while)
  • Working with APIs

14What you’ll use

What you’ll use

Skills this role draws on

Technical

  • Incident Response Lifecycle (NIST/SANS)
  • Log Analysis & Correlation Fundamentals
  • Phishing Triage & Analysis
  • Vulnerability Management Fundamentals
  • MITRE ATT&CK Framework Application (Basic)
  • Network Traffic Analysis (Basic)

15The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    IT Helpdesk / Service Desk Analyst

    1-2 years in a helpdesk role.

    Skills to master

    • Troubleshooting basic IT issues, understanding user behaviour, customer service, ticket management, basic networking concepts. This gives you a great foundation in how IT systems actually work.

    You're ready to move on when

    • You're the person on the helpdesk who always asks 'why' a problem occurred, not just how to fix it.
    • You've shown interest in security incidents that come through the helpdesk, perhaps even trying to learn more about them in your own time.
    • You're comfortable with basic system administration tasks (e.g., checking logs, managing user accounts).
  2. 2

    Cybersecurity Apprenticeship Programme

    18-24 months for a Level 3/4 apprenticeship.

    Skills to master

    • Structured learning of cybersecurity fundamentals, hands-on experience with security tools, professional workplace behaviour, project work. This is a direct route into the field.

    You're ready to move on when

    • Successfully completed all apprenticeship modules and practical assessments.
    • Received positive feedback from mentors and supervisors on your technical aptitude and work ethic.
    • Demonstrated a clear understanding of core security principles during your apprenticeship.
  3. 3

    Self-Taught / Academic Route (with practical experience)

    0-2 years of focused self-study or a relevant degree.

    Skills to master

    • Strong theoretical knowledge of cybersecurity, practical experience from home labs, CTFs, or personal projects, relevant certifications (e.g., Security+).

    You're ready to move on when

    • Can articulate complex security concepts clearly, even without formal work experience.
    • Can demonstrate practical skills through personal projects, GitHub repositories, or CTF achievements.
    • Holds relevant foundational cybersecurity certifications that show a commitment to the field.

16How people get here · where they go next

Came from
IT Helpdesk / Service Desk Analyst
1-2 years
You mastered the art of troubleshooting basic IT issues and developed a keen interest in understanding security incidents.
You are here
Associate SOC Analyst
Entry Level (0-2 years)
An Associate SOC Analyst monitors systems for threats and helps spot and stop security incidents as they happen.
Goes to
Cybersecurity Support Analyst (Level 2)
18-36 months
This role involves taking ownership of incidents end-to-end and operating more independently on routine alerts.

The long view: This work can lead to a senior analyst role, then on to lead analyst or staff security engineer positions handling major incidents.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how Associate SOC Analyst is actually changing.

Where it leads

Roles this leads to

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Networked systems security, worked against Associate SOC Analyst.

Networked systems security Level 3

Applied to your work in Associate SOC Analyst

The objective of this unit is to enable learners to identify network attacks and their sources, and to understand the function of security-related hardware and software. Learners will also explore organisational aspects of network security, including policies and procedures, and apply appropriate security measures to protect a network.

The Navigator Last time, we talked about how your role supports our overall security posture. How did your investigation into that recent alert contribute to the team's strategy?

You I realised it was part of a larger trend we've been monitoring.

The Navigator Great insight! Let's explore how you can use that understanding to propose a minor adjustment in our detection rules.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

Start my Associate SOC Analyst plan, free
A year from now

A year from now, you confidently navigate complex security challenges, leveraging AI tools to enhance your analysis and decision-making skills.

See Your Progress Grow Illustration
Associate SOC Analyst
  • Incident Response Lifecycle (NIST/SANS)
  • Log Analysis & Correlation Fundamentals
  • Phishing Triage & Analysis
  • Vulnerability Management Fundamentals
  • MITRE ATT&CK Framework Application (Basic)
  • Network Traffic Analysis (Basic)
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

17The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

Associate SOC Analyst is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Cybersecurity Support Analyst (Level 2)

    18-36 months in the Associate role.

    This is your natural next step, moving from supervised task execution to owning individual incidents end-to-end and operating more independently on routine alerts.

    • In-depth Log Analysis More advanced correlation of logs from multiple sources to build a complete picture.
    • Basic Threat Hunting Proactively searching for signs of compromise, not just reacting to alerts.
    • Detection Rule Tuning Proposing and helping to implement minor adjustments to detection rules to reduce false positives.
    • Expanded Tool Proficiency Deeper understanding and more independent use of all core SOC tools.
Working with AI on the job

Working with AI

Where AI is starting to help

Let's be real, a lot of security work can be repetitive. Imagine having a smart assistant that handles the grunt work, freeing you up to focus on the interesting stuff. That's exactly what AI-powered tools are starting to do for our cybersecurity team.

Even as an Associate SOC Analyst, you'll get to use some pretty clever AI and automation tools that make your life a lot easier. These aren't just buzzwords; they're practical aids that help you learn faster and contribute more effectively from day one. You won't be building the AI, but you'll certainly be using it.

Alert Triage Automation

Imagine incoming alerts being automatically enriched with threat intelligence, user context, and asset criticality before they even hit your queue. Our AI-powered SOAR platform can automatically close obvious false positives or give high-confidence alerts a head start, so you only see what truly matters. This means less sifting through noise and more focus on real threats.

Incident Analysis Acceleration

When a complex incident crops up, you'll often have thousands of log entries to wade through. Instead of doing it all manually, you can feed these logs into a large language model and ask it to 'summarise the timeline of suspicious activity for user 'jdoe'' or 'identify all outbound connections to known malicious IPs'. It's like having a super-fast research assistant that helps you pinpoint key events much quicker.

Threat Intelligence Summarisation

Forget reading a 30-page threat intelligence report on a new ransomware group. You'll use AI tools that can summarise the key Tactics, Techniques, and Procedures (TTPs), Indicators of Compromise (IOCs), and recommended mitigations into a scannable, one-page brief. This helps you consume critical intelligence faster and understand new threats more efficiently, without getting bogged down in detail.

Report & Communication Drafting

After an incident, even a small one, you'll need to document what happened. With AI, you can provide a bulleted list of facts and actions taken, and then ask the model to generate a draft of a formal post-incident report or a clear, non-technical communication for affected users. This saves you valuable time on documentation, letting you move on to the next investigation faster and focus on the technical work.

Common questions

Common questions

How do you become an Associate SOC Analyst?

Common routes in include IT Helpdesk / Service Desk Analyst (1-2 years in a helpdesk role.), Cybersecurity Apprenticeship Programme (18-24 months for a Level 3/4 apprenticeship.) and Self-Taught / Academic Route (with practical experience) (0-2 years of focused self-study or a relevant degree.). Times vary with prior experience.

Where can an Associate SOC Analyst progress to?

This role can lead on to Cybersecurity Support Analyst (18-36 months in the Associate role.), depending on the skills you build.

What new skills matter most for an Associate SOC Analyst?

Increasingly, Prompt Engineering & AI Tool Interaction and Basic Scripting for Automation (Python). These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

18Where to go from here

Other roles at Level 2

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in technology and data

Stay in the field you know and move sideways rather than up.
If you leave this industry

The skills built in this role apply across almost any industry, since every organisation needs cyber security. Work can move into finance, healthcare, tech or government, applying the same skills to different problems.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my Associate SOC Analyst plan, free What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.