Escaping Tiered SOC Operations: A Role-Based Model for Modern SOCs
In this presentation, I would like to outline our active operational model in the SOC, which breaks away from the traditional tiered structure typically found in SOCs.
The traditional tiered model can lead to high staff turnover, inefficient employees, limited opportunities for professional development, and rigid processes. To address these challenges, we developed a role-based operating model that rotates analysts across different responsibilities,
In a nutshell: Identify existing responsibilities within your SOC, categorize them in different roles and assign these in a fixed schedule to the Analysts.
This model has proven effective, and this is exactly what I would like to share with the community.
We have been able to significantly mitigate the challenges associated with traditional tiered operations while ensuring 24/7 operations.
In this talk I'll share how the model works and the advantages and disadvantages we have identified, based on real-world use cases from our experience, in order to contribute to the community.
Tiered SOC models have clear responsibilities but they often tend to come with challenges such as repetitive work which results in limited career development, knowledge silos, and staff turnover.
In this talk, I present our role-based SOC operating model, which has been successfully implemented in our 24/7 Security Operations Center across two locations (Canada and Switzerland). Instead of assigning analysts to fixed tiers, responsibilities are grouped into different roles that analysts rotate through on a defined schedule.
The presentation will cover the following:
- Explanation why we decided to avoid the traditional tiered model
- The thoughts for the design behind our role-based operating model
- How responsibilities are categorized into different roles (e.g. Detection Analysis, Incident Response, Cyber Threat Intelligence)
- Management of the rotation schedule
- Operational considerations for maintaining a 24/7 SOC across two international locations
- Advantages we have experienced, including staff development, ownership, flexibility, and knowledge sharing
- Challenges, trade-offs, and key takeaways after using this model for years
- Practical recommendations for other organizations who would consider a similar approach
Audience Takeaways
Attendees will get practical insights into designing and operating a role-based SOC. They will understand where this approach works well but also its limitations. The audience will leave with ideas that can be used within their own operational environments.
Maiwand Hamidi is 29 years old and lives in Switzerland. He earned his master’s degree in IT security from Munich University of Applied Sciences.
In Switzerland, he works as a Senior Security Analyst at an IT service provider focused on the financial sector in a 24/7 SOC. There, he regularly encounters interesting cases that he would like to share with the community. Working in various roles (Incident Response, Detection Analyst, Threat Intelligence Analyst) in his current position has given him a broad range of experience.
Over the past few years, he has gained experience in cyber defense at a wide range of companies (PwC, Siemens, IBM, NTT DATA). His focus has been particularly on advising SOCs regarding incident response, threat intelligence, and organizational structure. Beside that he’s serving as a Vice Chair of the FIRST SOC SIG since July 26.