Knitting SOCs

A Security Operations Center (SOC) is designed to centrally control information security operations, providing situational awareness and monitoring of all enterprise information assets. When building an SOC, many organizations struggle with defining or selecting employee roles within the SOC to adequately cover the detection, prevention, and response of security incidents. This paper describes factors to be considered in the design of SOC team roles, and suggests commonly used roles, job descriptions, and development activities based on a job task analysis of SOC team members and managers, as well as research into best practices in information security.