Requirements document · Instructor-led
A 5-day program. Design, delivery and assessment of a management training path for Security Operations Center team leaders.
SOC teams today have solid technical training for their analysts. Tools, detection methodologies and reference frameworks are taught and mastered. Yet many organizations find that operational performance does not follow: poorly escalated incidents, faulty coordination between analysis levels, team exhaustion.
The problem is not technical: it is organizational and managerial.
Training for SOC managers remains a persistent blind spot. An L1 analyst may know how to detect an alert, but not necessarily the clear steps and content the organization expects, for lack of clear processes defined by their manager. This opacity between L1, L2 and L3 levels creates daily friction: duplicated investigations, lost alerts, unclear responsibilities.
On top of these structural dysfunctions come recurring steering flaws: poorly defined missions, no shared team vision, planning unsuited to on-call and rotation constraints. These gaps, tolerable in normal times, become critical during a crisis.
These organizational flaws do not go without human consequences. Permanent cognitive load, lack of meaning and failing processes expose SOC teams to high psychosocial risks, made worse by the budget constraints common in this sector.
This training is for SOC managers who want to move from a reactive posture to a structuring one. It helps them identify the most frequent pitfalls, progressively adopt market standards, and put in place the lasting conditions for a high-performing, resilient and engaged team, including in a crisis.
This training does not cover the technical and operational aspects of the SOC. The following are explicitly out of scope:
This training is for professionals already in post. It assumes prior operational experience in a SOC or security environment, at senior analyst, team lead or newly appointed manager level.
Mastery of detection and incident response fundamentals: attack lifecycle, SIEM and EDR tools in an operational context, reading and interpreting security logs. First exposure to MITRE ATT&CK expected.
No formal certification required. Some experience in team supervision or coordination, even partial, is needed to get the most from the crisis exercises and management labs.
Junior analysts with no coordination experience. Managers from IT functions with no exposure to operational cybersecurity. Participants looking to prepare for a technical certification.
The sponsor commits to checking that profiles are suitable before enrollment. Tehtris reserves the right to refuse or redirect a participant whose profile does not match, in order to preserve the quality of the group.
This training is built around the real difficulties of SOC teams, not around a theoretical framework. Each section starts from a concrete problem: high turnover, burnout masked as a performance issue, overestimated detection coverage, metrics used as a pressure tool rather than for steering.
No section stops at theory: each produces a working deliverable, used directly in the lab that follows.
Labs are the core of the method: mapping critical assets, evaluating detection rules, building incident response playbooks, a dashboard reduced to useful indicators. Crisis exercises reproduce real scenarios: coordination under pressure, containment decisions with incomplete information, communication to management during a crisis.
SOC maturity is handled without complacency. SOC-CMM is not a marketing goal: it is a diagnostic tool.
A SOC without a clear mission is a team that reacts instead of defending. This day starts from the field: the real state of the industry, the traps of unworkable charters, mapping the functions that really matter. We build the operational foundations of the SOC, not its theoretical org chart. By the end, each participant leaves with a charter in operational language, a map of critical assets and intelligence requirements they can use immediately.
Detecting without the right data means operating blind. This day treats collection as a strategic discipline: which sources to cover, in what order, with what real resources. ATT&CK is not a framework to tick off: it is a prioritization tool. We work on sustainable analyst capacity, not on ideal coverage.
An unmaintained detection rule is debt. A threat hunt without method is noise. This day treats detection engineering as a management discipline in its own right: design, document, measure, improve. Threat hunting is approached as a structured process with entry and exit criteria.
In a crisis, the manager who becomes an analyst loses command. This day trains a decision-making posture under pressure: incident confirmation, cross-team coordination, executive communication, containment with incomplete information. From the first signal to business resumption, each step is worked in real conditions.
Measure to steer, not to justify. Most SOCs measure a lot and improve little. We work on the indicators that actually reduce operational pain, on maturity diagnosis without complacency, and on integrating automation without disengaging analysts. Retention and burnout prevention are treated as performance variables.
Guarantor of teaching and technical quality. Aligns programs with local and legal requirements. Holds a veto on structuring teaching decisions.
Responsible for content meeting teaching and technical requirements. Guarantor of knowledge transfer. Produces a report after each training and submits any change for validation.
Identified at the security management level (domain, team or technical training lead). Guarantor of consistency between the training objectives and the operational strategy.
A steering committee is set up for the duration of the program. It brings together the sponsor, the functional head of education services and the trainer. It meets at least three times: before kick-off, mid-way, and at the end of the training.
At the end of each path, participants will fill in, under the sponsor's responsibility, a document assessing quality and, if needed, areas for progress.
Offer validity: this offer is valid until 01/01/2027.
