Cybersecurity
SOC engineering
A SOC is a process that depends on tools and people, not a room with screens. We help you design the operating model, build the playbooks and choose the tooling that fits the team you can staff.
The problem this service solves
Many SOCs inherit alerts from tools and build process around them. Analysts triage in different ways, escalation depends on who is on shift, and nobody can say how long an investigation should take.
We begin with what you must protect and the incidents you must handle, then design triage, escalation and handoffs that match. We are clear about what it will take to staff it, and about when an outsourced service is the more sensible choice.
What is in scope
-
Operating model
Coverage hours, tiers or a flatter model, roles, handoffs and on-call arrangements.
-
Triage and escalation
Severity definitions, decision trees and communication rules for different alert types.
-
Playbooks
Step-by-step procedures for common cases such as phishing, account compromise, malware and cloud alerts.
-
Tooling stack
How SIEM, EDR, identity, case management and automation fit together.
-
Metrics
Measures that show detection quality and response, not only alert counts.
-
Staffing and skills
Role descriptions, skills matrices and training paths.
-
In-house vs outsourced
An honest comparison of options against your needs and budget.
How the work runs
Understand
Start from risk.
-
1
Threat and asset review
What matters, what threatens it and what you must see.
-
2
Current-state review
Interview analysts, review recent cases and observe the process.
Design
Draft the model.
-
3
Operating model
Define roles, shifts, handoffs and escalation.
-
4
Playbook development
Write and review procedures with the analysts who will use them.
Stand up
Get it running.
-
5
Pilot and tabletop
Test the playbooks with realistic cases.
-
6
Metrics baseline
Start measuring, then adjust.
What you receive
- SOC operating model document
- Severity matrix and escalation paths
- Playbook set for agreed use cases
- Tooling architecture
- Metrics definitions and baseline
- Staffing and skills plan
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Executive sponsor and a SOC lead
- Access to current tools and recent cases
- Budget and headcount constraints
What this service is not
- Operating your SOC for you
- Managed detection and response
What changes afterwards
- Analysts handle similar alerts in similar ways
- Escalation is clear
- You know what the SOC costs and what it covers
Questions people ask
Do you run a SOC?
No. We design and engineer security operations and can provide experienced analysts and engineers on a staffing basis. We do not offer managed detection and response.
How many analysts do we need?
It depends on coverage hours, alert volume, scope and automation. We build a staffing model from those inputs rather than quote a ratio.
Related
-
SIEM consulting
Architecture, data onboarding, cost control and migration for Microsoft Sentinel, Splunk, Elastic and Google Security Operations.
-
Security automation and SOAR
Automate repetitive investigation and response steps with approvals and logging, using your existing SIEM, EDR and ticketing tools.
-
IT and technology
Software developers, data engineers, SAP and Oracle consultants, cloud and DevOps, QA and security roles on contract or direct hire.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response