Rebuilding Northgate Meridian Group's security operations centre after an alert the managed provider closed as benign at 02:14 on 28 December became a regulated incident nobody in-house had seen: the operating model as six linked dimensions — demand, people, process, technology, sourcing and governance — around one core; a new triage standard that escalates the same alert by 02:24 with a second-person review at the 06:00 handover; nights growing from one analyst to three seats; and an investment case for a hybrid follow-the-sun model at £5.26 million a year against a £4.26 million renewal quote, put to the Executive Committee on 17 June 2027.

CY-PRO-017Pro Level · Security Operations

SOC Operating Model Command — Demand, People, Process, Technology, Sourcing and the Investment Case

A forty-hour Pro-level operations-command simulation run on a live SOC operations command board, where you lead a multinational's security operations through a missed incident the regulator is asking about, an MSSP contract expiring against a threefold renewal quote and 40% analyst attrition — from measuring the SOC honestly, through demand, people, process, technology, automation and sourcing, to a target operating model, a transition plan, an investment case and an executive defence built entirely on evidence.

40 hours12 chapters60 lessons433 activities12 labs

What you'll learn

Measure a SOC with reproducible measures — queue by state, MTTA/MTTD/MTTR percentiles with the unmeasured share, coverage as tested detections over the organisation's own priorities, and cost per confirmed incident — and sign a scorecard a regulator and a CFO can hold you to.
Design the demand, people and process dimensions from the organisation's own data: priorities and log sources against ingest cost, roles and seats from productive-hours arithmetic, attrition economics, triage standards with named escalation conditions, and closure quality assurance with a published dispute rate.
Judge technology by outcomes per licence, run detections as code, automate enrichment and auto-closure with QA samples, reject automations on pilot evidence, and source the work on ownership of detection, triage, response and evidence with outcome SLAs, evidence rights and exit terms.
Design a target operating model from the alert clock with tested surge and governance that decides, plan a transition with dual-running, a cutover gate and a slip path, and defend a costed, optioned investment case with residual risk in dates and money to an executive committee.

Price:৳15,000