UK

United Kingdom · Technology and data · Mid-Level (2-5 years)

SOC Analyst II

Here is the whole job, in plain words. What it is, what you decide, how you're judged, how people get here and where they go next. Then the part no course gives you: twelve AI tutors who learn your work.

See how AI is changing this job, and get the full read by email.

Start my free AI Fluency module

As an SOC Analyst II, a good place to start on Prompt Engineering for Security Analysis is Using and Checking AI Tools in Daily Work, a free Future Fluency module at Level 3. You'd practise using everyday AI tools on real tasks from your own week, and checking what they produce before you use it.

Free to start, no card.

Keep this job description

Where should we send it?

One email: what AI is changing in this job, the new skills it asks for, where it leads, and where to start free. With a link back here. Nothing else follows unless you confirm your address.

Your employer, or 'self-employed'

Leading a team? Try this with up to five of them for 14 days, free.

  • Experience bandMid-Level (2-5 years)
  • Direct reportsNo direct reports
  • Reports toSenior SOC Analyst or SOC Team Lead
  • UK framework levelUsually a coordinator, or early in a professional job

Also advertised as Mid-Level Security Operations Analyst · Cyber Defence Analyst · Incident Response Analyst (Tier 2)

Built on 43,079 real UK job descriptions we analysed · grounded in what real qualifications cover

Two short quizzes about you

1From this job to a course

The qualifications matched to this job

Qualifi Level 3 Diploma in Cyber Security Management and Operations Qualifi Ltd · Level 3 · covers 6 of 10 standards
Qualifi Level 4 Diploma in Cyber Security Qualifi Ltd · Level 4 · covers 4 of 10 standards
Qualifi Level 3 Extended Diploma in IT and Cyber Security Qualifi Ltd · Level 3 · covers 3 of 10 standards
Cambridge OCR Level 3 Cambridge Technical Introductory Diploma in IT Cambridge OCR · Level 3 · covers 1 of 10 standards
Cambridge OCR Level 3 Cambridge Technical Subsidiary Diploma in IT Cambridge OCR · Level 3 · covers 1 of 10 standards
Cambridge OCR Level 3 Cambridge Technical Extended Diploma in IT Cambridge OCR · Level 3 · covers 1 of 10 standards

Matched from the standards this job is measured against: a suggestion, not an official ruling.

The units you would start with

Investigations and Incident Response Qualifi Level 3 Diploma in Cyber Security Management and Operations
Incident Response, Investigations and Forensics Qualifi Level 4 Diploma in Cyber Security
Networked systems security Cambridge OCR Level 3 Cambridge Technical Introductory Diploma in IT

The future skills this job leans on

AI Fluency working with AI as a thinking partner
Data Fluency turning numbers into a decision
Sustainability Fluency building care for people and planet into the work
Systems Fluency seeing the whole picture
Trust Fluency keeping the digital world safe
Your Plan Illustration

Built for SOC Analyst II

3 units that map to this job, from the qualifications that cover it.

  1. Investigations and Incident Response Qualifi Ltd · covers 6 of 10 standards Level 3
  2. Incident Response, Investigations and Forensics Qualifi Ltd · covers 4 of 10 standards Level 4
  3. Networked systems security Cambridge OCR · covers 1 of 10 standards Level 3
These are the real units behind this job, in the order they rank for it. Nothing here is marked done, because this plan has not been started by anyone yet. Yours would fill in as you go.

2AI and this work

Will AI change your work as an SOC Analyst II?

Nobody can say exactly how. Here is what this job is being asked for next, and where to start.

The new skills this role is being asked for

  • Prompt Engineering for Security Analysis
  • Cloud-Native Security Monitoring
Why each one is rising

The future skills this job leans on

We'll only ever tell you what we can actually back up. No hype, no scare tactics.

What happens when you start

Next, a free account. We build your SOC Analyst II plan as you set up, starting with the free AI Fluency module. No card.

Your first Future Fluency module is free. After that, your AI tutor is £70 a month.

Ready to pay? Subscribe for £70 a month

Keep this read. One email with what AI is changing in this job, the new skills it asks for and where to start free. Nothing else follows unless you confirm your address.

3What this role really is

A SOC Analyst II investigates security alerts, works out what's happening, and helps contain and learn from incidents.

4What you'd actually use

The tools this job runs on, and how well you'd need to know each one.

Microsoft Sentinel (SIEM/SOAR) Intermediate

Running pre-built queries, triaging alerts, executing basic playbook actions, and building simple custom queries to investigate incidents. You'll be living in Sentinel.

CrowdStrike Falcon (EDR/XDR) Intermediate

Investigating EDR alerts, performing host isolation, using live response for data collection, and running basic queries to hunt for threats on endpoints.

Recorded Future (Threat Intelligence) Basic

Consuming intelligence reports to understand current threats, searching for Indicators of Compromise (IOCs), and enriching incident data with threat context.

Tenable.io (Vulnerability Management) Basic

Reviewing vulnerability scan reports, identifying and categorising critical vulnerabilities, and using the data to inform incident investigations (e.g., if a compromised host had known critical flaws).

Jira & Confluence (Collaboration/Documentation) Intermediate

Managing incident tickets in Jira, documenting investigation findings and 'Lessons Learned' in Confluence, and using these platforms for team collaboration.

Kusto Query Language (KQL) Intermediate

Writing and modifying queries to search and analyse log data within Microsoft Sentinel, which is essential for deep investigations.

5What you get to decide, and how that grows

Power in a job isn't your title. It's what you're allowed to decide. Here's how it grows as you move up.

The choiceComing in Where you are nowThe step above
Incident Containment Actions (e.g., host isolation, IP blocking) Requires explicit approval from a senior analyst or lead for every action. Follows pre-approved steps only. Can independently execute containment actions for routine incidents following established playbooks. Escalates for novel situations or high-impact systems. Independently authorises and executes containment for complex incidents, even in ambiguous situations. Consults with Director on business-critical systems.
Alert Prioritisation & Escalation Follows strict prioritisation matrix; escalates anything outside Tier 1 for review. Independently prioritises Tier 2 alerts and decides on escalation path based on incident severity and impact. Escalates exceptions. Defines and refines prioritisation matrices for the team. Makes independent judgements on critical incident escalation, including out-of-band communications.
Tool Configuration & Tuning No authority. Reports noisy alerts or potential gaps to senior analysts. Suggests tuning adjustments for existing detection rules or proposes new basic queries to lead. Does not implement changes directly. Designs and implements new SIEM correlation rules and SOAR playbook modifications. Tunes EDR policies with Security Engineering.
Communication during Incidents Communicates only with immediate team lead. No direct external or cross-functional communication. Communicates with IT Operations, DevOps, and other technical teams during incident resolution. Keeps lead informed. Leads incident bridges, communicates with business stakeholders on technical details, and drafts internal incident summaries.

6How you'll be judged

The scoreboard, and what is not on it. The hard targets, how often each is actually looked at, and the quiet signals that never reach a dashboard.

Alerts Triaged per Shift
The number of security alerts you investigate and categorise during your shift. This includes closing false positives and escalating genuine threats.
Target · Typically >100 alerts per 8-hour shift, depending on alert volume and complexity.

On a busy Monday, you might triage 120 alerts, closing 100 as false positives and escalating 20 for deeper investigation.

Ticket Escalation Accuracy
The percentage of incidents you escalate that turn out to be genuine threats, and the percentage of false positives you correctly close without escalation.
Target · >98% accuracy in correctly identifying and escalating real issues, and closing false positives.

Out of 50 escalations, 49 were valid incidents. Out of 500 closed alerts, none were later found to be missed threats. That's good going.

Mean Time to Escalate (MTTE) for Critical Alerts
The average time it takes you to identify a critical security alert and escalate it to the appropriate team or lead for further action.
Target · <15 minutes for critical (P1) alerts; <30 minutes for high (P2) alerts.

A P1 alert comes in at 10:05 AM, you confirm it's a genuine threat by 10:17 AM and escalate it. That's 12 minutes, well within target.

Incident Resolution Rate
The percentage of assigned Tier 2 incidents you successfully investigate, contain, and resolve without needing significant intervention from a senior analyst.
Target · >85% of assigned Tier 2 incidents resolved independently.

You're assigned 20 Tier 2 incidents in a month and successfully close 18 of them, only needing help on two particularly tricky ones.

Investigation Quality & Documentation
How thoroughly you investigate incidents, the clarity and completeness of your findings, and how well you document your steps and conclusions in our ticketing system (Jira/Confluence).
  • Your incident reports are clear, concise, and contain all necessary technical details. Other analysts can easily pick up your cases if needed. You include 'Lessons Learned' where appropriate, even if it's just for yourself. Your lead rarely has to ask for more detail or clarification on your cases.
Proactive Problem Solving
Your ability to not just react to alerts, but to identify underlying issues, suggest improvements to detection rules, or propose new ways to reduce 'Alert Fatigue'.
  • You'll suggest tuning a noisy alert rule, or propose a new SIEM query that catches something we've missed. You might spot a recurring issue and suggest a permanent fix, rather than just patching it over each time. You're not afraid to say, 'This alert is rubbish, here's why, and here's how we fix it.'
Collaboration & Knowledge Sharing
How well you work with your team and other departments, and your willingness to share your knowledge, especially with newer analysts.
  • You're helpful in team chat, offering advice or sharing useful queries. You might run through a complex case with a junior analyst, showing them the ropes. Other teams (like IT or DevOps) find you easy to work with and appreciate your clear communication during incidents. You contribute to our internal knowledge base (Confluence) with useful articles or playbooks.
Adaptability & Learning
Your openness to new tools, techniques, and threats, and your continuous effort to improve your skills.
  • You're quick to pick up new EDR features or SIEM query languages. You actively seek out training or read up on new attack methods. When a new threat emerges, you're keen to understand it and how it might affect us, rather than just waiting to be told what to do. You don't shy away from complex or unfamiliar incidents
  • you see them as a chance to learn.

7Would you like it

Both sides. What people enjoy, and what grinds them down.

What people enjoy
Solving Complex Puzzles

You'll spend hours sifting through logs, correlating events, and trying to figure out the 'who, what, when, and how' of a security incident. It's like being a detective every day, with a new mystery to solve.

You're given an alert about unusual network activity. Instead of just blocking the IP, you'll trace it back, find the compromised host, identify the malware, and figure out how it got in, building a full timeline.

Protecting the Organisation

You get a real sense of satisfaction from knowing that your quick actions prevented a potential breach or stopped an attacker in their tracks. You're on the front lines, directly contributing to the company's security posture.

Your rapid response to a phishing attempt stops a user from clicking a malicious link, preventing a potential credential compromise and saving the company from a much larger headache.

Continuous Learning & Growth

The threat landscape changes constantly, so you're always learning about new attack techniques, tools, and defensive strategies. This role offers endless opportunities to deepen your technical knowledge and grow your career.

You encounter a new type of malware, research its behaviour using public threat intelligence, and then apply that knowledge to create a new detection rule for our SIEM, sharing it with the team.

What frustrates people
  • Dealing with a high volume of false positive alerts that mask genuine threats.
  • The constant need to justify security recommendations to other teams who don't always understand the risk.
  • Working with incomplete or messy data when trying to investigate an incident.
  • The occasional 3 AM wake-up call for a critical incident, even if it's rare.
  • Seeing the same basic security hygiene issues (like unpatched systems) cause repeated alerts.
What this role does not give you
  • A predictable 9-to-5 routine every single day (incidents don't care about your schedule).
  • A role where you're solely building new things; a lot of it is reactive problem-solving.
  • Complete control over other teams' security practices (you'll advise and influence, not command).
  • An environment where you never have to deal with ambiguity or incomplete information.

8Who you work with

Your work directly influences our 'Dwell Time'—how long an attacker is in our systems before we find them. Shorter dwell times mean less damage, less cost, and less reputational hit. You're crucial for keeping our digital doors locked and our data safe, which, frankly, keeps the business running smoothly. You'll also contribute to our overall security posture by identifying gaps and suggesting improvements based on your investigations.

Inside the business
  • Your SOC Team Lead (for daily direction and support)
  • Other SOC Analysts (for collaboration and knowledge sharing)
  • IT Operations and Infrastructure Teams (when you need to isolate systems or apply patches)
  • DevOps Teams (when you find vulnerabilities in applications or cloud environments)
  • Legal and HR (for sensitive incidents, though this is rare at your level)
  • Security Engineering (when you need new detections or tool tuning)
Outside the business
  • Threat Intelligence Vendors (you'll use their data, but won't directly manage them)
  • Managed Security Service Providers (if we use them for certain functions, you might coordinate with their analysts)

9What you need before you start

Not a wish list. The things you would be expected to already have.

  • At least 2-3 years of hands-on experience in a Security Operations Centre (SOC) or a similar incident response role.
  • Demonstrable experience with at least one major SIEM platform (e.g., Splunk, Microsoft Sentinel, Elastic SIEM) for alert triage and investigation.
  • Proven ability to analyse security alerts from various sources (EDR, network, cloud) and determine their validity.
  • Experience with common operating systems (Windows, Linux) and networking concepts from a security perspective.
  • A solid understanding of common cyber attack techniques and how to detect them.
  • Ability to write clear, concise technical documentation and incident reports.

10What to practise next

Where the job is going, and what to do about it starting this week.

Advanced SIEM Querying & Rule Optimisation

As alert volumes grow, the ability to write highly efficient and accurate SIEM queries (especially KQL for Sentinel) becomes paramount. You'll need to move beyond basic searches to complex aggregations and optimisations.

Performance tuning for large datasets · Advanced KQL operators (e.g., 'join', 'union', 'summarize') · False positive reduction techniques · Threat modelling for detection rules

  • This month: Dedicate an hour each week to practising advanced KQL queries in a test environment or against historical data.
  • Next quarter: Take ownership of reviewing and suggesting improvements for 2-3 of our 'noisy' SIEM rules.
  • Within 6 months: Develop a new, high-fidelity detection rule for a specific TTP that we currently have weak coverage for.
  • Within 9 months: Share your advanced query techniques with the rest of the team during a knowledge-sharing session.

Quick win: Challenge yourself to rewrite one of your frequently used basic queries using more advanced KQL operators to make it more efficient or comprehensive.

Proactive Threat Hunting Techniques

Reactive defence isn't enough anymore. We need to actively seek out threats that have bypassed our automated detections. This means developing and executing more sophisticated hunting hypotheses.

Hypothesis generation based on threat intelligence · Data source identification and collection for hunting · Statistical analysis for anomaly detection in hunting · Developing hunting playbooks and procedures

  • This month: Read up on different threat hunting methodologies and examples of successful hunts.
  • Next quarter: Work with a senior analyst to participate in at least one structured threat hunt, taking a more active role in query development.
  • Within 6 months: Propose and execute a small, self-contained threat hunt based on a recent piece of threat intelligence.
  • Within 9 months: Document your hunting process and findings, contributing to our internal hunting knowledge base.

Quick win: Subscribe to a few good threat hunting blogs or newsletters and spend 15 minutes a week reading about new hunting techniques.

11Staying current once you are in

What people here do to keep up
  • Actively participate in security communities (e.g., local OWASP chapters, B-Sides conferences, online forums).
  • Regularly read security blogs, threat intelligence reports, and industry news to stay current with the latest threats and vulnerabilities.
  • Set up a home lab to experiment with new tools, practice incident response scenarios, or reverse-engineer malware in a safe environment.
  • Contribute to open-source security projects or share your knowledge through blog posts or presentations.
  • Seek out mentorship from senior analysts or leads to accelerate your learning and career growth.

12The rising capability

The rising capability

Zavmo analysis

What's rising in its place

This is where the work is heading, and the higher pay with it. Get fluent here and the shift stops being a threat and starts being your edge.

Prompt Engineering for Security Analysis

Generative AI is changing how we analyse data and summarise information. Analysts who can effectively 'talk' to Large Language Models (LLMs) will be able to accelerate their investigations and reporting significantly.

  • Context windows and token limits
  • Temperature settings for different tasks
  • Output validation and hallucination detection
  • Prompt chaining for complex analysis

Cloud-Native Security Monitoring

More and more of our infrastructure is moving to the cloud, especially Azure and AWS. Understanding how to monitor these environments is becoming absolutely critical, as traditional on-prem tools don't always translate directly.

  • Cloud logging services (Azure Monitor, AWS CloudTrail, VPC Flow Logs)
  • Cloud Identity and Access Management (IAM) security
  • Serverless function security (Azure Functions, AWS Lambda)
  • Container security monitoring (Docker, Kubernetes)

13What you’ll use

What you’ll use

Skills this role draws on

Technical

  • Incident Response Frameworks (NIST 800-61, SANS PICERL)
  • MITRE ATT&CK Framework
  • Threat Hunting Methodologies
  • Cyber Kill Chain Analysis
  • Security Metrics & Reporting (Basic)

14The pathway

The pathway

How you actually get there, here

How you become one varies far more by country than what one does. This is the UK route. Most people take one of these ways in; the right one depends on where you're starting from.

  1. 1

    SOC Analyst I (Entry-Level)

    1-2 years

    Skills to master

    • Mastering Tier 1 alert triage, understanding basic security concepts, proficiency with SIEM/EDR tools, clear documentation.

    You're ready to move on when

    • Consistently and accurately triaging a high volume of alerts.
    • Demonstrating a solid grasp of our core security tools and processes.
    • Proactively seeking out opportunities to learn and take on more complex tasks.
    • Receiving positive feedback on documentation quality and teamwork.
  2. 2

    IT Support / Network Administrator with Security Focus

    2-3 years in IT, then 1-2 years in a junior security role

    Skills to master

    • Deepening understanding of security principles, incident response methodologies, log analysis, and specific security tool proficiency.

    You're ready to move on when

    • Successfully managing and troubleshooting complex IT/network issues with a security mindset.
    • Having taken on security-related projects or responsibilities in previous roles.
    • Demonstrating strong analytical and problem-solving skills applicable to security incidents.
    • Holding relevant security certifications (e.g., Security+, CySA+).
  3. 3

    Junior Incident Responder / Threat Hunter

    1-2 years

    Skills to master

    • Hands-on experience with incident containment, eradication, and recovery. Proficiency in forensic analysis tools and threat intelligence integration.

    You're ready to move on when

    • Proven ability to conduct end-to-end incident investigations.
    • Experience with advanced detection techniques beyond basic alert triage.
    • Strong understanding of adversary tactics and techniques.
    • Ability to work independently on complex security challenges.

15Where this role leads

The long view: This work can lead to managing a SOC, directing security operations more broadly, or becoming a principal security engineer working on advanced threats.

The ten Future Fluencies

Zavmo analysis

The credential is what you can do today. These are what keep you valuable.

A qualification proves you can do the job as it's defined today. These ten are what decide whether you're still the obvious person for it in five years. They're the capabilities employers are now writing into senior roles faster than people are learning them. Zavmo weaves them through whatever you study, so you come out with both: the credential and the fluency.

The highlighted ones are the Fluencies your role leans on hardest, from how SOC Analyst II is actually changing.

Where it leads

Roles this leads to

How you would learn this

One to one, on the work you already do

A tutor sets the task against your own job and marks the reasoning, at your pace. There is no cohort to fall behind.

A lesson from Investigations and Incident Response, worked against SOC Analyst II.

Investigations and Incident Response Level 3

Applied to your work in SOC Analyst II

The objective of this unit is to provide learners with a comprehensive understanding of incident response, including its core phases, tools, and processes. Learners will explore the creation of a Computer Emergency Response Team (CERT) and the role of Disaster Recovery (DR) and Business Continuity Management (BCM) in supporting cyber incident response.

How the thinking builds
  1. 1 Remember
  2. 2 Understand
  3. 3 Apply
  4. 4 Analyse
  5. 5 Evaluate
  6. 6 Create
An illustration of a Zavmo lesson, built from this role’s own route. The unit, its objective and every criterion above are the awarding body’s own words, not an example.

It is £70 a month, billed monthly. Your free first module is Future Fluency, and you can cancel any time.

See Your Progress Grow Illustration
SOC Analyst II
  • Incident Response Frameworks (NIST 800-61, SANS PICERL)
  • MITRE ATT&CK Framework
  • Threat Hunting Methodologies
  • Cyber Kill Chain Analysis
  • Security Metrics & Reporting (Basic)
This is your Mind Palace on learn.zavmo.ai. Every skill above comes from this role's own record, not an example borrowed from another job. A node lights up when you evidence it, and what you build stays yours between jobs. That is the part a course cannot do.

16The detail, folded away

Everything else the record holds

The career branches in full, how AI is already showing up in the day-to-day, and the questions people ask about this job. Here when you want them, out of the way while you decide.

Where it leads next, rung by rung

Where it leads

The career path, and where it branches

SOC Analyst II is a start, not a ceiling. Each step below asks for new skills and hands back more autonomy.

  1. Senior SOC Analyst / Incident Responder (Level 3)

    3-5 years in this SOC Analyst II role

    This is the natural next step, where you'll take on the most complex incidents, mentor junior analysts, and start contributing to the design of new detection rules and playbooks.

    • Expertise in developing new SIEM correlation rules and SOAR playbooks from scratch.
    • Advanced threat hunting methodologies, including hypothesis generation and data source identification.
    • Deep understanding of malware analysis techniques and reverse engineering basics.
    • Proficiency in scripting (e.g., Python, PowerShell) for automation and custom tool development.
    • Leading tabletop exercises and purple team engagements.
Working with AI on the job

Working with AI

Where AI is starting to help

Let's be real, security operations can be a bit of a grind. You're sifting through mountains of alerts, writing the same queries, and trying to keep up with the latest threats. But what if you could cut out a huge chunk of that repetitive work and focus on the really interesting stuff? That's where AI comes in.

We're not talking about robots taking over your job; we're talking about smart tools that make you faster, more accurate, and frankly, less stressed. For a SOC Analyst II, AI isn't just a buzzword; it's a practical co-pilot that helps you get through your workload quicker, spot things you might miss, and give you more time for deep investigations and learning. Think of it as having an extra pair of hands that never gets tired.

Alert Triage Automation

Imagine your SOAR platform automatically investigating and closing those low-level, high-volume alerts—the port scans, the benign credential failures. AI can enrich data, check threat intel, and close the ticket if there's no real threat, all before you even see it. This frees you up to focus on the truly suspicious stuff, not the noise.

Anomaly Detection Acceleration

Our User and Entity Behaviour Analytics (UEBA) models use AI to surface weird activity that rule-based systems just can't catch. Think of an admin logging in from a new country at 3 AM and then accessing unusual files. AI spots these deviations from the norm, reducing the time it takes to discover a threat from weeks (if you were hunting manually) to near real-time. It's like having a sixth sense for trouble.

Threat Intel Synthesis

Instead of spending an hour reading through dozens of daily threat intelligence reports, CVE announcements, and security blogs, an AI assistant can do it for you. It'll extract the key Tactics, Techniques, and Procedures (TTPs), Indicators of Compromise (IOCs), and affected technologies, giving you a concise brief for your morning stand-up. You get the gist in minutes, not hours.

Incident Report Drafting

After you've contained an incident, you can feed the technical timeline and findings from Jira or Confluence into a generative AI model. It'll then create a first draft of a non-technical summary for your lead or even for other teams, focusing on the business impact, root cause, and remediation steps. This saves you valuable time on documentation, letting you get back to the next investigation faster.

Common questions

Common questions

How do you become an SOC Analyst II?

Common routes in include SOC Analyst I (Entry-Level) (1-2 years), IT Support / Network Administrator with Security Focus (2-3 years in IT, then 1-2 years in a junior security role) and Junior Incident Responder / Threat Hunter (1-2 years). Times vary with prior experience.

Where can an SOC Analyst II progress to?

This role can lead on to Senior SOC Analyst / Incident Responder (3-5 years in this SOC Analyst II role), depending on the skills you build.

What new skills matter most for an SOC Analyst II?

Increasingly, Prompt Engineering for Security Analysis and Cloud-Native Security Monitoring. These are the skills our record of this role lists as growing.

Free tools

Want a read on where you stand?

Three free tools, no account needed. Each one ends with a role, a level and a way in.

Read the Zavmo manifesto to understand how you will be taught Meet your tutors

Or try another one

17Where to go from here

Other roles at Level 3

Same depth of qualification, different job. Useful if the work appeals but this particular role does not.

 More jobs in technology and data

Stay in the field you know and move sideways rather than up.
If you leave this industry

The skills built as a SOC Analyst II apply across most industries, since every organisation needs security operations. This can lead to consulting work, roles with security vendors building products, or specialising in a sector such as automotive or healthcare security.

This role profile is © 2026 Growth Engineering Technologies Ltd. Built from UK occupational standards and regulated qualification data, and written for Zavmo.

You're not behind. You're right on time. The shift is only just beginning. Your role won't look the same in two years. Be the one who leads the change, not the one it happens to. Start my free AI Fluency module What happens next: a free account, then we build your plan as you set up. No card. Build your plan, see your roadmap and meet the twelve tutors matched to you. All free. When you're ready to start learning, it's £70 a month, billed monthly. Cancel any time and billing stops.