- Career vs. Job
- Developing Job Roles
- SOC Job Roles
- NICE Cybersecurity Workforce Framework
- Role Tiers
- SOC Services and Associated Job Roles
- Soft Skills
- Security Clearance Requirements
- Pre-Interviewing
- Interviewing
- Onboarding Employees
- Managing People
- Job Retention
- Training
- Certifications
- Evaluating Training Providers
- Company Culture
- Summary
- References
This chapter is from the book
This chapter is from the book
This chapter is from the book
SOC Services and Associated Job Roles
The roles and job skill requirements for your SOC will depend on the different services the SOC is responsible to deliver to its customers. People are required for any SOC service regardless of the type of technology being used. Even the value from advanced security analytics such as artificial intelligence boils down to how the SOC uses the technology. Software does not provide the answers to what problems your SOC faces; it provides the tools and delivers the data needed to discover answers. Essentially, people are needed to run technology and to interpret the results of the tools used in the SOC.
The following sections review how people relate to the different services that can be offered by a SOC. Each service will be made up of one or more job roles previously described in the chapter.
Risk Management Service
The risk management service is responsible for managing all aspects of risk to the organization. This includes analyzing risk, calculating the potential impact of risk, and making decisions based on the organization’s risk appetite. Employees responsible for risk management must have great communication skills, enabling them not only to ensure that everybody in the organization understands any significant risk but also to explain the organization’s risk management strategy. Working for the risk management service also requires a solid understanding of business, because decisions of the service will impact various internal and external elements of the organization. Successful employees responsible for risk management are skilled at negotiation and diplomacy. They can work under pressure and are able to modify strategies as various factors change the current state of the organization’s risk status.
Possible job titles include chief information manager, chief information security officer, security officer, risk management analyst, and analyst.
Vulnerability Management Service
Successful employees responsible for vulnerability management have experience in and understanding of network and computer security. They can analyze hardware, software, networks, and communication to discover and address vulnerabilities. SOC members involved with vulnerability management have solid communication skills so they can explain identified vulnerabilities as well as work with various parties to validate findings, including third-party vendors and other external experts. Employees responsible for vulnerability management are detail-oriented, have strong problem-solving skills, and can adapt methods used to manage vulnerabilities based on the ever-changing threat landscape.
Possible job titles include penetration tester, vulnerability engineer, ethical hacker, red team tester, security analyst, and security engineer.
Incident Management Service
SOC employees responsible for incident management actively monitor systems and networks for intrusions. The incident management team develops a procedural set of responses to security problems and oversees their execution. This team is also responsible for restoring services back to a normal state following an incident as quickly as possible while minimizing the impact to business operations. Communication and diplomacy skills are required to produce incident reports and provide technical briefings to various parties about incidents in a diplomatic fashion. Employees are required to be able to work under pressure while coordinating all activities required to perform, monitor, and report on the incident management process.
Possible job titles include incident responder, security analyst, computer network defense, IT network defense, incident analyst, intrusion detection specialist, and network intrusion analyst.
Analysis Service
A security analyst is responsible for detecting and preventing cyberthreats to an organization. Members of the analysis team review security logs from various types of devices and work with the team responsible for incident management when a threat is confirmed. In addition to dealing with real-time threats, the analysis team analyzes and responds to undisclosed hardware and software vulnerabilities when a dedicated vulnerability management team isn’t present. The analysis team can also take on responsibilities as a security advisor and develop security strategy based on data captured and analyzed. Members of the analysis team must be analytical and detail-oriented with specific skills in understanding how devices generate logs and how to work with network and security tools that generate logs. Analysis engineers can also be responsible for analyzing and reverse engineering various types of artifacts, requiring a different set of analytical and technical skills than an analyst that works with security logs. Analysis engineers are technical, detail-oriented, and specialized in the types of data they are responsible for analyzing.
Possible job titles include security analyst, security engineer, security administrator, security specialist, security consultant, network engineer, operations analyst, business intelligence analyst, and data analyst.
Compliance Service
The most fundamental skill for employees responsible for compliance is the ability to deal with risk and conflict management. A compliance officer uses specific factors for scoring risk, which will be based on the requirements for the type of compliance being enforced. A compliance officer will encounter situations requiring explaining and defending their point of view to internal employees as well as external agencies such as regulators. Communication and analytical thinking are critical for this role as well as a willingness to learn, as the world of compliance is continuously changing. Other skills associated with successful members of the compliance team are being detailed-oriented, being capable of interpreting data, and having strong problem-solving skills.
Possible job titles include compliance officer, assessment officer, policy officer, and infosec officer.
Digital Forensics Service
Roles in digital forensics are technology-focused, requiring a desire to learn, deep analytical skills, and the ability to work with various technologies ranging from desktop computers to mobile devices. Digital forensics requires acute attention to details and a comprehension of cybersecurity fundamentals. Communication skills and an understanding of law and criminal investigation are important because the results from a forensic investigation might be used in court, in which case the investigator will be required to defend his or her work. Digital forensics requires working with different groups, from legal to technical, as well as tolerance for disturbing material that might be discovered during an investigation. Successful digital forensic engineers have experience in both legal and technical matters related to cybersecurity.
Possible job titles include forensic engineer, forensic scientist, forensic consultant, and digital forensic engineer.
Situational and Security Awareness Service
The key purpose of this service is to address the human element of security. The goal of the work performed by the situational and security awareness team is to change the behavior of employees so that they operate with security in mind, reducing their risk to the organization. Duties include everything regarding security awareness and developing an education program. Roles responsible for situational and security awareness require strong written and verbal communication skills. Members in this role must be able to interpret all industry regulations, standards, and compliance requirements as well as ensure that everybody understands the organization’s risk management strategy. Successful situational and security awareness officers can accomplish these goals using a positive and engaging approach, which includes creating a metrics framework that can effectively measure results of the program.
Possible job titles include security trainer, training instructor, information assurance analyst, training analyst, security service training manager, and development manager.
Research and Development Service
SOC members of the research and development service are responsible for researching, planning, and implementing new programs and protocols for the organization. Duties include market research, tracking costs related to the creation of new programs and protocols, and making decisions on which projects are worth investing in. This group also validates if current programs, procedures, and technology being used are up to date with current and advanced industry standards. Members in this role have project management experience, are able to manage a budget, and are detail-oriented and creative.
Possible job titles include researcher, threat researcher, threat analyst, analyst, security analyst, programmer, software developer, and DevOps engineer.