Originally published on LinkedIn.
Career guidance for those entering Security Operations Center work — from analysts to senior leaders. Technical skills alone are not sufficient. Here is where to actually start.
Core Principles
- Prioritize correctly. Take care of yourself, your spouse, your family, your career, your employer — then your job. In that order. A burned-out analyst is a liability in a SOC.
- Understand what you are protecting. Know your organization’s most critical assets before you know the tools you use to protect them. This is what I call the “grandma story” — can you explain to a non-technical person what you protect and why it matters?
- Invest in continuous learning. Budget 100–150 hours per year in training, supplementing whatever your employer provides. This is not optional — it is professional responsibility.
- Understand the words. “Security.” “Operations.” “Center.” Each of those words carries extensive scope. If you do not deeply understand what each means — in your specific context — your SOC model has a problem.
- Know the OSI Model. If your SOC has any network-connected component — which is essentially all of them — the OSI Model is required knowledge. Not optional.
- Develop humility and teach others. Excel in your specialty. Then mentor someone coming up behind you. The best SOC professionals are always giving away knowledge.
- Know your SOC type. A physical security SOC, a cyber SOC, a converged SOC, and a crisis management SOC are different environments with different skill requirements. Expertise in one does not automatically transfer to another.
The Key Insight
SOC expertise is not universally transferable. A perimeter security specialist may struggle in insider threat operations, and vice versa. Different SOC types demand distinct technical and business skill sets. Know which SOC you are entering and build accordingly — do not assume your current expertise covers it all.