Gain Top-Notch Cyber Security Skills at SANS Miami 2019. Save $200 thru 12/19!


To attend this webcast, login to your SANS Account or create your Account.

Designing and Building a SOC: Management Fundamentals

  • Friday, August 5th, 2016 at 1:00 PM EDT (17:00:00 UTC)
  • Chris Crowley
This webcast has been archived. You can view the webcast presentation and download the slides by logging into your SANS Portal Account or creating an Account. Click the Register Now button after you have logged in to view the Webcast.

You can now attend the webcast using your mobile device!


Designing and building an effective security operation center requires security managers and leaders to fit capabilities to both an organizations culture and business requirements.

Learn the distinct functional areas that every SOC should have. These areas allow organizations to create an architecture for the high-level components of security operations: command center; network security monitoring functionality; threat intelligence; incident response; forensic analysis; and ongoing self-assessment of the attack surface of the organization.

With these functional areas in place and aligned with the business, you will be better positioned to thwart modern, motivated threats to your information assets.

Content is based on the new SANS MGT517 course entitled "Managing Security Operations: Detection, Response, and Intelligence." The course covers the design, build, and operation of security operations centers with a deep dive into managing incident response.

Speaker Bio

Christopher Crowley

Mr. Crowley has 15 years of industry experience managing and securing networks. He currently works as an independent consultant in the Washington, DC area focusing on effective computer network defense. His work experience includes penetration testing, security operations, incident response, and forensic analysis.

Mr. Crowley is the course author for for SANS Management 517 - Managing Security Operations and SANS Management 535 - Incident Response Team Management. He holds the GSEC, GCIA, GCIH (gold), GCFA, GPEN, GMOB, GASF, GREM, GXPN and CISSP certifications. His teaching experience includes FOR585, MGT517, MGT535, SEC401, SEC503, SEC504, SEC560, SEC575, and SEC580; Apache web server administration and configuration; and shell programming.

He was awarded the SANS 2009 Local Mentor of the year award. "The Mentor of the Year Award is given to SANS Mentors who excel in leading SANS Mentor Training classes in their local communities."

Need Help? Visit our FAQ page or email

Not able to attend a SANS webcast? All Webcasts are archived so you may view and listen at a time convenient to your schedule. View our webcast archive and access webcast recordings/PDF slides.