Training
Featured Course View All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
NEW - AI Security Training
Can't find what you are looking for?

Let us help.

Contact us
Free Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

Customer Case Studies

Discover how organizations and individual cyber practitioners use SANS training and GIAC certifications

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Group Purchasing
Group Purchasing
AI SKILLSMAJOR UPDATES

LDR551: AI-Enabled SOC Leadership

LDR551Cybersecurity Leadership, Artificial Intelligence
  • 5 Days (Instructor-Led)
  • 30 Hours (Self-Paced)
Course authored by:
John HubbardMark Orlando
John Hubbard & Mark Orlando
Register NowCourse Preview
LDR551: Building and Leading Security Operations Centers
Course authored by:
John HubbardMark Orlando
John Hubbard & Mark Orlando
Register NowCourse Preview
  • GIAC Security Operations Manager (GSOM)

    Learn about certification

  • 30 CPEs

    Apply your credits to renew your certifications

  • In-Person, Virtual or Self-Paced

    Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

  • Advanced Skill Level

    Course material is geared for cyber security professionals with hands-on experience

  • 19 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

Jump to:

Build a SOC you can trust when the pressure is on. Work through the decisions that turn organizational priorities, people, and technology into effective security operations.

Featured Quote

There are so many [organizations] that seem to be trying to reinvent the wheel. All they need to do is invest in this course for real world, actionable information that can put them on a solid path toward building, staffing, and leading their own SOC.
Brandi Loveday-Chelsey

Course Overview

Build a SOC you can trust when the pressure is on. LDR551 takes you through the decisions that turn organizational priorities, people, and technology into effective security operations. Follow six connected stages of SOC design and operation — Align, Design, Engineer, Lead, Operate, and Improve — to build a new SOC or strengthen the one you lead today. Use AI to explore options, develop plans, and support SOC work, while learning how to verify its results, control its actions, and recognize when human judgment must lead. Prepare to make clearer decisions, develop your team, and put improvements into practice.

When a serious threat emerges, your SOC needs to find the evidence, decide what matters, and coordinate action before the attacker has a chance to get a foothold. Your ability to do that depends on choices made long before the first alert: what to monitor, who to hire, how to move work, and who may act.

As the SOC leader, you own those choices. You also face competing demands: expand coverage, reduce backlogs, develop your people, justify spending, and put AI to useful work. Every new service, tool, or automated action brings requirements for staff time, evidence, ownership, and support. You need a way to make those choices fit together and check whether they are working.

LDR551 gives you a practical path from defining the SOC's purpose to leading its operations and proving its improvements. Whether you are building a SOC from the ground up or improving an existing SOC, you will practice the decisions, conversations, and evidence reviews that move plans into daily work.

To achieve these goals, LDR551 follows six connected stages:

  • Align the SOC: Use organizational priorities, critical services, threats, and obligations to define the SOC's purpose, scope, authority, and priorities.
  • Design the Services: Define what the SOC provides, who it serves, how work moves, and what coverage, handoffs, and guidance each service requires.
  • Engineer the Technology: Direct decisions about data collection, detections, platforms, automation, AI, providers, reliability, and cost.
  • Lead the Team: Assign responsibilities, plan staffing, hire and develop people, coach performance, and manage workload.
  • Operate the SOC: Prioritize queues, oversee investigations and hunts, lead incidents, coordinate response, and maintain critical services under pressure.
  • Improve the SOC: Measure results, test quality, investigate failures, verify corrections, and decide what to change or fund next.

Each stage supplies information and requirements for later work, with choices made in earlier stages affecting downstream stages. A service commitment creates staffing and technology requirements. A technology choice creates maintenance, training, and review work. A response plan needs both evidence and someone with authority to approve it. You will learn to trace problems back upstream to the choices that created them and correct them at their source.

Use AI Throughout the SOC Leadership Cycle

AI can help you explore alternatives, organize evidence, draft work products, and examine problems from several angles. It can also change how your SOC investigates alerts, develops detections, shares knowledge, and carries out response work. LDR551 addresses both your own use of AI as a leader and your responsibility for AI used by the team.

You will learn enough about models, complete AI systems, and agents to ask the important questions about their data, instructions, memory, tools, permissions, and governance.

Throughout the course, you will decide:

  • When AI is useful: Select a clearly defined task, supply the relevant context, and compare the result with the current process or a simpler form of automation.
  • How to use it: State the task and limits, identify suitable sources, require support for important claims, and give a named person responsibility for checking the result.
  • When to keep work with people: Recognize missing evidence, sensitive data that cannot be shared, untested recommendations, unavailable reviewers, or actions beyond the system's approved authority.
  • What must happen before AI can act: Define permitted tools and targets, approval requirements, records, stop conditions, and recovery steps. Enforce action limits through access controls and workflow design as well as written instructions.
  • How to judge the result: Count review time, corrections, missed threats, harmful actions, maintenance, and cost alongside any improvement in speed.

Hands-On SOC Manager Training

In LDR551 you will practice the work a SOC leader performs, including reviewing evidence, comparing choices, explaining tradeoffs, assigning responsibility, and producing guidance and usable results. Exercises use the fictional organization, Ops Outpost, which has competing service demands, limited staff time, and changing security needs.

You will work with material such as service requests, technical proposals, case records, staffing information, simulated staff conversations, incident updates, and quality findings. Activities include creating a SOC charter, evaluating AI-enabled workflows, coaching employees, directing operational priorities, and defending improvement proposals.

AI-assisted activities give you opportunities to refine a draft, challenge an unsupported conclusion, or rehearse a difficult conversation. You remain responsible for the choices you make and the evidence supporting them. Debriefs explain how to adapt the methods and work products to your own SOC.

Syllabus Summary

  • Align and Design the SOC
  • Engineer SOC Technology
  • Lead the SOC Team
  • Operate the SOC
  • Improve the SOC

Author Statement

"Running a successful SOC requires making choices that reinforce each other. The coverage and services you commit to must align with your team's realistic capacity, tooling, and authority. When those choices fall out of sync, the team suffers from backlogs, duplicate effort, and stalled investigations. In LDR551, we guide you through architecting a SOC that overcomes these challenges, demonstrates measurable value, and uses AI safely and effectively to amplify your team's impact.

My co-author and I have worked alongside some of the world's most capable SOCs, and we want you to leave this class seeing the entire operational landscape clearly. You'll understand how tools, detections, workflows, and people connect to form a proactive, threat-informed defense against modern adversaries.

We've built teams from the ground up, seen what fails, and discovered what it takes to succeed. Our mission in LDR551 is to save you years of trial and error so you can confidently build and lead a world-class cybersecurity operations team."

- John Hubbard

"As someone who has been the victim of less-than-ideal processes, tools, and team structure, my goal with this course is to help ensure every organization's blue team runs at peak efficiency and capability regardless of size and resources, and that no one must suffer through repeating mistakes so commonly made within the industry. This course is the culmination of 20 years of supporting, building, and leading security operations and I am incredibly excited to bring it to the SANS community."

- Mark Orlando

What You’ll Learn

  • Set a clear direction for your SOC: Turn organizational priorities and threats into a practical mission, defined services, and realistic coverage commitments.
  • Make better technology and spending decisions: Evaluate data, detection, platform, and provider proposals against security needs, staff workload, reliability, and total cost.
  • Put AI to useful work safely: Choose suitable tasks, evaluate results, and define what AI may access or do—and when a person must review or approve its work.
  • Build and support an effective team: Plan staffing and skills, coach difficult performance issues, and address workloads that exceed available staff time.
  • Keep daily operations focused: Set queue priorities, oversee investigations, and direct threat hunts with clear objectives, time limits, and escalation rules.
  • Lead confidently during major incidents: Set response priorities, weigh containment choices, and coordinate action while communicating uncertainty and respecting approval requirements.
  • Show what is working and secure support for improvements: Measure performance, verify corrections, and present proposals with clear costs, expected results, and remaining risks.

Business Takeaways

  • Focus SOC effort where it matters most: Set security priorities around critical services, relevant threats, and the consequences of disruption.
  • Make service commitments the team can meet: Match coverage and response expectations to available staff time, skills, and technology.
  • Make better technology and AI investments: Compare proposals using evidence about security benefits, review workload, integration effort, and ongoing cost.
  • Build a stronger, more sustainable team: Connect hiring, training, and coaching to actual SOC work, and address workload problems that contribute to burnout and turnover.
  • Coordinate incident response with clear authority: Establish who recommends, approves, and performs response actions so urgent decisions reach the right people.
  • Verify improvements before expanding them: Use metrics, quality reviews, and exercises to confirm that changes fix identified weaknesses and justify further investment.

How LDR551 Prepares You for GSOM

LDR551 is built around the exam objectives that make up the GIAC Security Operations Manager (GSOM) certification:

  • Section 1, SOC Design and Operational Planning builds skills tested under SOC Design and Planning, and Cyber Defense Theory, Threat Intel, and Defensible Architecture.
  • Section 2, SOC Telemetry and Analysis aligns with SOC Tools and Technology, and Data Source Assessment and Collection.
  • Section 3, Attack Detection, Hunting, and Triage builds skills tested under Managing Alert Creation and Processing, and Proactive Detection and Analysis.
  • Section 4, Incident Response aligns with Preparing for Incident Response, and Managing Incident Response Execution.
  • Section 5, Metrics, Automation, and Continuous Improvement builds skills tested under SOC Analytics and Metrics, and Continuous Improvement.

Across all five sections, 19 hands-on labs and the Cyber42 leadership simulation, which culminates in a purple team assessment exercise, give you the chance to apply each skill before you sit the exam.

Read the full GSOM certification overview.

Meet Your Authors

  • Slide 1 of 2
    John Hubbard
    John Hubbard

    John Hubbard

    Senior Instructor

    John is a Senior SANS Instructor and SOC consultant, author of SEC450 and LDR551. With deep SOC leadership experience, GIAC certifications, and hands-on labs, he equips cyber defenders with the skills to hunt, detect, and lead resilient operations.

    Read more about John Hubbard
  • Slide 2 of 2
    Mark Orlando
    Mark Orlando

    Mark Orlando

    Certified Instructor

    Mark Orlando brings extensive cybersecurity leadership experience from the Pentagon, White House, and Fortune 500 sectors. As Field CTO at Push Security, he's a respected security operations expert with military and academic credentials.

    Read more about Mark Orlando
Slide 1 of 0

Course Syllabus

Explore the course syllabus below to view the full range of topics covered in LDR551: Building and Leading Security Operations Centers.

Section 1Align and Design the SOC

Decide what the SOC must deliver, why the work matters, and what authority and resources it needs.

Topics covered

  • Organizational priorities, critical services, dependencies, threats, and obligations
  • SOC mission, charter, scope, and initial success criteria
  • Threat model creation and understanding organizational risk
  • Cyber threat intelligence requirements and source quality
  • Service design and operation

Labs

  • Introduction to Ops Outpost and Analyzing a Recent Incident
  • Creating a SOC Mission and Charter
  • Cyber Threat Intelligence Analysis
  • Cyber42 Leadership Simulation Exercise

Overview

Start with the organization the SOC serves. Identify critical services and the systems, identities, data, and suppliers they depend on. Use relevant threats, obligations, and organizational direction to set priorities and define a credible SOC mission and scope.

Turn that scope into services with named customers, inputs, outputs, owners, and commitments. Design how alerts, cases, incidents, and requests move between the SOC and other teams. Clarify who may authorize action, who accepts a handoff, and when the SOC must escalate a decision.

Consider AI while designing the work: where it could help, what evidence a person must check, and which permissions the organization is prepared to grant. Set initial coverage and resource limits so later technology and staffing decisions have a clear starting point.

Full Lab Details

  • Introduction to Ops Outpost and Analyzing a Recent Incident
  • Creating a SOC Mission and Charter
  • Cyber Threat Intelligence Analysis
  • Cyber42 Leadership Simulation Exercise

Full Topic Details

  • Organizational priorities, critical services, dependencies, threats, and obligations
  • SOC mission, charter, scope, and initial success criteria
  • Threat model creation and understanding organizational risk
  • Cyber threat intelligence requirements and source quality
  • Service design and operation
  • Mapping SOC work to defined processes
  • Selecting staffing models and external team interfaces
  • Introducing AI to the SOC - factors and considerations

Section 2Engineer the SOC

Direct the technical choices that allow the SOC to deliver its services reliably and at a sustainable cost.

Topics covered

  • SOC tools and technology selection
  • Agentic AI foundations and uses in the SOC
  • Data collection, visibility gaps, retention, access, and cost
  • Detection frameworks, languages, and coverage planning and evaluation
  • Detection and analytic design / detection engineering as a process

Labs

  • AI Workflow Risk Assessment
  • ATT&CK Navigator for Attack Technique Prioritization
  • Detection Rule Management, Measurement, and Visualization
  • Cyber42 Leadership Simulation Exercise

Overview

Translate the services defined in Section 1 into requirements for data, detections, tools, automation, and AI. Build a working understanding of AI systems and agents so you can examine their information sources, tool access, configuration, ownership, and failure conditions.

Use threat intelligence and investigation needs to prioritize data collection. Review detection proposals for test evidence, maintenance requirements, and remaining gaps. Evaluate platforms and integrations against the work the SOC needs to perform.

Full Lab Details

  • AI Workflow Risk Assessment
  • ATT&CK Navigator for Attack Technique Prioritization
  • Detection Rule Management, Measurement, and Visualization
  • Cyber42 Leadership Simulation Exercise

Full Topic Details

  • SOC tools and technology selection
  • Agentic AI foundations and uses in the SOC
  • Data collection, visibility gaps, retention, access, and cost
  • Detection frameworks, languages, and coverage planning and evaluation
  • Detection and analytic design / detection engineering as a process
  • Systems thinking for detection problems
  • Protecting SOC data and capabilities

Section 3Lead the SOC Team

Build and support a team that can perform the services and technical work the SOC has committed to deliver.

Topics covered

  • Team purpose, values, roles, and goals
  • Building and designing your SOC workspace
  • Skills, hiring assessments, and onboarding
  • Training plan creation, career development, specialist and management paths, and succession
  • The evolving role of the analyst in AI-enabled SOCs

Labs

  • Allocating the Training Budget
  • SOC Capacity Planning
  • Coaching and Communication
  • Cyber42 Leadership Simulation Exercise

Overview

Use the service and technology requirements from the first two sections to define roles, staffing, skills, and management responsibilities. Account for coverage, absences, engineering, review, training, and incident demand when comparing internal, outsourced, and combined staffing choices.

Connect team purpose, expected conduct, recurring coordination, and goals to observable work. Develop hiring and qualification methods that reveal how people use evidence, exercise judgment, and ask for help. Practice coaching and follow-up using work samples, workload information, and the employee's explanation.

Full Lab Details

  • Allocating the Training Budget
  • SOC Capacity Planning
  • Coaching and Communication
  • Cyber42 Leadership Simulation Exercise

Full Topic Details

  • Team purpose, values, roles, and goals
  • Building and designing your SOC workspace
  • Skills, hiring assessments, and onboarding
  • Training plan creation, career development, specialist and management paths, and succession
  • The evolving role of the analyst in AI-enabled SOCs
  • SOC staffing coverage and capacity planning
  • How to minimize SOC analyst burnout and retention issues
  • Coaching, performance evidence, conduct, and follow-up
  • Creating a positive SOC culture

Section 4Operate the SOC

Direct everyday work and major incidents as evidence, priorities, staffing, and available systems change.

Topics covered

  • Hunt selection, hypotheses, scope, staffing, time limits, and follow-up
  • Intake, priority criteria, assignments, queue aging, backlog, and deferral
  • Investigation oversight, alternative explanations, escalation, and closure
  • Uses for AI during investigation
  • Investigation quality review

Labs

  • Threat Hunting
  • Investigation Quality Review
  • Incident Containment
  • Cyber42 Leadership Simulation Exercise

Overview

Set priorities for incoming work, assign limited analyst time, and decide what to investigate, defer, transfer, or escalate. Review investigations for evidence, reasoning, uncertainty, and next actions. Give threat hunts a purpose, scope, time limit, and plan for acting on the results.

During major incidents, establish objectives, assign actions, maintain a decision record, and communicate what is known and unknown. Evaluate containment choices against security benefit, business disruption, authority, and recovery needs. Coordinate with technical teams, executives, legal counsel, and other relevant owners.

Full Lab Details

  • Threat Hunting
  • Investigation Quality Review
  • Incident Containment
  • Cyber42 Leadership Simulation Exercise

Full Topic Details

  • Hunt selection, hypotheses, scope, staffing, time limits, and follow-up
  • Intake, priority criteria, assignments, queue aging, backlog, and deferral
  • Investigation oversight, alternative explanations, escalation, and closure
  • Uses for AI during investigation
  • Investigation quality review
  • Shift coordination, case ownership, handoffs, and failed transfers
  • Incident declaration, authority, objectives, action tracking, and decision records
  • Containment and response choices, cross-team coordination, and recovery

Section 5 Improve the SOC

Use clear metrics and measurements from SOC work to assess performance, and decide what needs correction, what deserves further investment, and which upstream choices need adjustment.

Topics covered

  • Defining clear security metrics
  • Aligning SOC metrics with leadership
  • Improving measurement and prioritization
  • Balancing daily execution with SOC improvement initiatives
  • SOC automation types and AI-powered automation

Labs

  • Creating, Classifying, and Communicating Your Metrics
  • Purple Team Assessment Planning, Execution, and Tracking
  • Threat-Informed Defense Assessment
  • Cyber42 Leadership Simulation Exercise

Overview

Return to the results the SOC was expected to deliver. Build measures that help leaders decide about service quality, workload, cost, staffing, and risk. Examine what those measures omit and whether they reward behavior such as premature case closure.

Review investigation and detection samples, then design controlled exercises for questions ordinary work cannot answer. Examine failures using the information available at the time, assign corrections to the right owners, and require evidence that completed work fixed the problem.

Evaluate AI as part of the complete workflow, including analyst review, overrides, errors, cost, and changes over time. Use the combined findings to prioritize improvements and present the funding, service, or risk decision leadership must make. Feed the results into the next review of SOC priorities, services, technology, and staffing.

Full Lab Details

  • Creating, Classifying, and Communicating Your Metrics
  • Purple Team Assessment Planning, Execution, and Tracking
  • Threat-Informed Defense Assessment
  • Cyber42 Leadership Simulation Exercise

Full Topic Details

  • Defining clear security metrics
  • Aligning SOC metrics with leadership
  • Improving measurement and prioritization
  • Balancing daily execution with SOC improvement initiatives
  • SOC automation types and AI-powered automation
  • Assessing automation effectiveness
  • SOC assessment, exercises, and validation
  • SOC capability assessment and benchmarking

Things You Need To Know

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory System Hardware Requirements

  • CRITICAL NOTE: Apple Silicon devices with M-series chips cannot perform the required virtualization for this course and therefore cannot be used.
  • CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. An x64-bit, 2.0+ GHz or newer processor is mandatory for this class.
  • BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
  • 4GB of RAM or more is required.
  • 50GB of free storage space or more is required.
  • At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
  • Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

Mandatory Host Configuration And Software Requirements

  • Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
  • Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
  • Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
  • Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
  • You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
  • Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable them.
  • Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMware Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
  • On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
  • Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. A second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact customer service.

LDR551 is for people responsible for creating, running, or improving a SOC, including:

  • SOC managers and team leads
  • Security directors and security program managers
  • Senior analysts preparing to lead people, services, or technical programs
  • Technical CISOs and other leaders responsible for SOC performance and investment
  • Leaders accountable for services delivered jointly by internal teams and external providers

The GIAC Security Operations Manager (GSOM) certification validates a practitioner's ability to effectively manage a technical team and strategically operate a Security Operations Center (SOC) to align with an organization's business goals and security requirements.

  • Designing, planning, and managing an effective SOC program
  • Prioritization and collection of logs, development of alert use cases, and response playbook generation
  • Selecting metrics, analytics, and long-term strategies to assess and continuously improve SOC operations

More Certification Details

  • Custom distribution of the Linux Virtual Machine containing free open-source SOC tools
  • MP3 audio files of the complete course lecture
  • Printed and Electronic Courseware
  • A digital download package that includes the above and more
  • Access to the Cyber42 leadership simulation exercise

This course does not have any specific prerequisites, but it is suggested that students have some experience in an operational security role. SANS courses such as "SEC450: AI-Enabled Security Operations - Hands-On Investigation, Detection, and Automation" or "LDR512: Security Leadership Essentials for Managers" will give students a solid foundational understanding of the concepts that will be discussed.

Students should have practical familiarity with security operations, including alerts, investigations, common security data, and incident response. You do not need to have built a SOC, managed a budget, or deployed an AI system before attending.

LDR551 belongs in the Cybersecurity Leadership focus area for practitioners taking responsibility for SOC teams, technical programs, and operational results. 

The course is also part of the Operational Cybersecurity Executive Triad. This triad is anchored by SEC566, LDR516 , LDR521. It is designed to enable students to strength three foundational skills that must work together: a control baseline that holds across the enterprise, exposure management that reflects threat and impact, and incident leadership that functions under stress. Developing this operational capability is what enables leaders to translate strategy into consistent security outcomes that ensure their organization remains protected.

SOC management connects the organization's security needs to the work people and systems perform each day. The manager defines service commitments, assigns responsibility, provides suitable staffing and technology, directs urgent work, and checks whether the results meet those commitments. 

Weakness in one part affects the others. Collecting more data creates cost and processing work. Adding detections can increase the investigation queue. Faster AI-generated analysis can increase the need for review. A SOC leader must understand those connections and adjust priorities, services, staffing, or technology when the current plan cannot hold. 

LDR551: AI-Enabled Security Operations equips you with essential skills to excel as a SOC leader. This course provides practical knowledge in managing SOC teams, optimizing processes, and leveraging tools to enhance organizational cybersecurity.

By completing LDR551 training, you will:

  • Develop Leadership Skills: Learn to build and manage effective SOC teams, improving your ability to lead in high-pressure environments.
  • Enhance Career Growth: Position yourself as a key decision-maker and strategic leader within your organization.
  • Gain Practical Expertise: Master techniques for SOC operations, including threat detection, incident response, and continuous improvement.
  • Boost Your Credentials: Attain recognition as a SOC management expert, enhancing your professional reputation and opening opportunities for advancement.

Whether you're aiming for a management role or looking to enhance your leadership capabilities, LDR551 training provides the tools to elevate your career in cybersecurity.

Relevant Job Roles

Operational Cybersecurity Executive

Cybersecurity Leadership

Lead operational teams from the point of view of an adversary in order to protect your most sensitive assets.

Explore learning path

Technology Research and Development (OPM 661)

NICE: Design and Development

Responsible for conducting software and systems engineering and software systems research to develop new capabilities with fully integrated cybersecurity. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems.

Explore learning path

Security Manager Training, Salary, and Career Path

Cybersecurity Leadership

Daily focus is on the leadership of technical teams. Includes titles such as Manager, Information Security Specialist, and Program/Project Leader.

Explore learning path

Blue Teamer - All Around Defender

Cyber Defense

This job, which may have varying titles depending on the organization, is often characterized by the breadth of tasks and knowledge required. The all-around defender and Blue Teamer is the person who may be a primary security contact for a small organization, and must deal with engineering and architecture, incident triage and response, security tool administration and more.

Explore learning path

SOC Manager

Cybersecurity Leadership

Security Operations Center (SOC) managers bridge the gap between business processes and the highly technical work that goes on in the SOC. They direct SOC operations and are responsible for hiring and training, creating and executing cybersecurity strategy, and leading the company’s response to major security threats.

Explore learning path

Enterprise Architecture (OPM 651)

NICE: Design and Development

Responsible for developing and maintaining business, systems, and information processes to support enterprise mission needs. Develops technology rules and requirements that describe baseline and target architectures.

Explore learning path

Secure Systems Development (OPM 631)

NICE: Design and Development

Responsible for the secure design, development, and testing of systems and the evaluation of system security throughout the systems development life cycle.

Explore learning path

Leadership

SCyWF: Leadership And Workforce Development

This role conducts supervises, manages and leads cybersecurity teams and work. Find the SANS courses that map to the Leadership SCyWF Work Role.

Explore learning path

Course Schedule and Pricing

Have Questions?Contact Us

GIAC Certification Attempt

Add a GIAC certification attempt and receive two free practice tests. View pricing in the info icons below.

OnDemand Course Access

When purchasing a live instructor-led class, add an additional 4 months of online access after your course. View pricing in the info icons below.

Group and Private Pricing

Enroll your team as a group or arrange a private session for your organization. We’ll help you choose the format that fits your goals.

Contact Sales
  • Location & instructor

    Virtual (OnDemand)

    Instructed by
    Mark Orlando
    Date & Time
    OnDemand (Anytime)Self-Paced, 4 months access
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
    Self-Paced
  • Location & instructor

    SANS Amsterdam December 2026

    Amsterdam, NL & Virtual (live)

    Instructed by
    Michael Lamb
    Date & Time
    Fetching schedule..
    Course price
    €7,715 EUR*Prices exclude applicable local taxes
    Registration Options
    In-PersonVirtual
  • Location & instructor

    SANS Cyber Defense Initiative 2026

    Washington, DC, US & Virtual (live)

    Instructed by
    John Hubbard
    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
    In-PersonVirtual
  • Location & instructor

    SANS Nashville 2027

    Nashville, TN, US & Virtual (live)

    Instructed by
    Mark Orlando
    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
    In-PersonVirtual
  • Location & instructor

    SANS London March 2027

    London, GB & Virtual (live)

    Instructed by
    Michael Lamb
    Date & Time
    Fetching schedule..
    Course price
    £6,715 GBP*Prices exclude applicable taxes | EUR price available during checkout
    Registration Options
    In-PersonVirtual
  • Location & instructor

    LDR551 Live Online March

    Virtual (live)

    Instructed by
    John Hubbard
    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
    Virtual
  • Location & instructor

    SANS 2027

    Orlando, FL, US & Virtual (live)

    Instructed by
    Mark Orlando
    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
    In-PersonVirtual
  • Location & instructor

    SANS Austin 2027

    Austin, TX, US & Virtual (live)

    Instructed by
    John Hubbard
    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
    In-PersonVirtual
  • Location & instructor

    SANS Rocky Mountain 2027

    Denver, CO, US & Virtual (live)

    Date & Time
    Fetching schedule..
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Registration Options
    In-PersonVirtual
  • Location & instructor

    SANS Amsterdam August 2027

    Amsterdam, NL & Virtual (live)

    Date & Time
    Fetching schedule..
    Course price
    €7,715 EUR*Prices exclude applicable local taxes
    Registration Options
    In-PersonVirtual
Showing 10 of 10

Learn Alongside Leading Cybersecurity Professionals From Around The World

  • Slide 1 of 4
    This course immediately expands your toolkit to problem solve in NOSC operations management.
    Ron L.U.S. Government
  • Slide 2 of 4
    Great content. Covers a lot of ground and exposed me to a lot of new concepts and ideas, and ties content to current real-world examples.
    Prasanth ChattiCampbells Soup Company
  • Slide 3 of 4
    It has covered a lot of great information that can be applied anywhere when implementing or improving a SOC.
    Dakota Kelly BWXT
  • Slide 4 of 4
    I would recommend this course to anyone running a security operations team. I’d further recommend it to more experienced analysts so they can begin to see the bigger picture.
    Robert WilsonUniversity of South Carolina
Slide 1 of 0

Benefits of Learning with SANS

Bryan Simon: Teacher Standing Next to Smartboard and Explaining Concept

Get feedback from the world’s best cybersecurity experts and instructors

OnDemand Mobile App

Choose how you want to learn - online, on demand, or at our live in-person training events

Close Up of Woman Holding a Pen and Documents

Get access to our range of industry-leading courses and resources