Maiwand Hamidi
Maiwand Hamidi is 29 years old and lives in Switzerland. He earned his master’s degree in IT security from Munich University of Applied Sciences.
In Switzerland, he works as a Senior Security Analyst at an IT service provider focused on the financial sector in a 24/7 SOC. There, he regularly encounters interesting cases that he would like to share with the community. Working in various roles (Incident Response, Detection Analyst, Threat Intelligence Analyst) in his current position has given him a broad range of experience.
Over the past few years, he has gained experience in cyber defense at a wide range of companies (PwC, Siemens, IBM, NTT DATA). His focus has been particularly on advising SOCs regarding incident response, threat intelligence, and organizational structure. Beside that he’s serving as a Vice Chair of the FIRST SOC SIG since July 26.
Session
In this presentation, I would like to outline our active operational model in the SOC, which breaks away from the traditional tiered structure typically found in SOCs.
The traditional tiered model can lead to high staff turnover, inefficient employees, limited opportunities for professional development, and rigid processes. To address these challenges, we developed a role-based operating model that rotates analysts across different responsibilities,
In a nutshell: Identify existing responsibilities within your SOC, categorize them in different roles and assign these in a fixed schedule to the Analysts.
This model has proven effective, and this is exactly what I would like to share with the community.
We have been able to significantly mitigate the challenges associated with traditional tiered operations while ensuring 24/7 operations.
In this talk I'll share how the model works and the advantages and disadvantages we have identified, based on real-world use cases from our experience, in order to contribute to the community.