Chapter 14: Operating Model, Staffing, and SLAs¶

Overview¶

Even the best technology stack fails without the right people, structured correctly, with realistic expectations and sustainable workloads. This chapter covers SOC operating models, staffing frameworks, SLA design, and the organizational factors that determine long-term program success.

Learning Objectives

1. Compare SOC operating models and select appropriate for context
2. Design a staffing model for different organization sizes
3. Define SLAs that balance analyst capacity with security requirements
4. Build a training and certification program for SOC staff
5. Address analyst burnout as an operational risk

Prerequisites: Chapters 1–13.

Curiosity Hook¶

SOC Operating Models¶

In-House Dedicated SOC¶

Organization maintains its own full-time SOC team.

Best for: Large enterprises (>5,000 employees) with mature security programs.

Hybrid (Internal + MSSP)¶

Internal team for detection engineering and complex response; MSSP for 24×7 monitoring.

Best for: Mid-size organizations (500–5,000 employees).

Fully Managed (MSSP or MDR)¶

External provider handles all or most SOC functions.

Best for: Small organizations; organizations without security staff to hire.

Staffing Model Design¶

Coverage Models¶

Staffing Ratios¶

As rough starting points (adjust for your alert volume and tool automation):

Career Paths¶

graph LR
    A[Tier 1 Analyst\n0-2 years] --> B[Tier 2 Analyst\n2-4 years]
    B --> C[Tier 3 / IR Lead\n4-6 years]
    B --> D[Detection Engineer\n3-5 years]
    B --> E[Threat Intel Analyst\n3-5 years]
    D --> F[Senior Detection Eng\n5+ years]
    C --> G[SOC Manager\n6+ years]
    E --> H[CTI Lead\n5+ years]
    G --> I[CISO / VP Security\n10+ years]

SLA Framework Design¶

SLAs define the performance commitments the SOC makes to the organization.

SLA design principles: 1. SLAs must be achievable with current staffing and tooling 2. SLAs must reflect actual security risk, not aspirational targets 3. SLAs must be measured automatically, not self-reported 4. SLA breaches must trigger root cause analysis 5. SLAs must be reviewed at least annually

Reference SLA framework:

Training Program¶

Per Nexus SecOps-205, all SOC staff MUST complete required training within 30 days of hire.

Training curriculum by role:

Training sources: - Platform-specific training (SIEM, EDR, SOAR vendor training) - Industry certifications (CompTIA Security+, CySA+; GIAC GSEC, GCIA, GCIH; CISSP for seniors) - In-house tabletop exercises - Purple team participation - Conference attendance (DEF CON, RSA, SANS)

Analyst Burnout: Operational Risk¶

Burnout indicators to monitor: - Alert queue consistently behind SLA (team overwhelmed) - High FP rate (team not carefully reviewing) - Unusual sick day patterns - Exit interview themes - Formal complaints or accommodation requests

Structural interventions: - Right-size staffing to alert volume (not the reverse) - Aggressive automation to remove rote tasks - Rotation between high-pressure and low-pressure duties - Protected time for learning and development - Clear career progression paths - Management recognition of quality, not just speed

Common Failure Modes¶

MicroSim¶

Lab¶

See Lab 3: IR Simulation — includes role-based exercise.

Exam Prep & Certifications¶

Benchmark Tie-In¶

SOC RACI Matrix¶

Who is Responsible, Accountable, Consulted, and Informed for core SOC functions:

R = Responsible | A = Accountable | C = Consulted | I = Informed

SOC Tier Escalation Model¶

graph TD
    ALT[Alert] --> T1[Tier 1: Triage + Classification]
    T1 -->|False positive / routine| CLOSE[Close / Tune Rule]
    T1 -->|Escalate| T2[Tier 2: Deep Investigation + Containment]
    T2 -->|Major incident| T3[Tier 3: Forensics + Threat Hunting]
    T3 -->|Crisis| EXEC[CISO + Executive Bridge]
    T2 & T3 -->|Resolved| PIR[Post-Incident Review]

SLA Calculation Framework¶

Mean Time to Detect (MTTD)

MTTD = Σ(detection_time − first_indicator_time) / incident_count

Targets: P1 < 5 min | P2 < 30 min | P3 < 2 hours

Mean Time to Respond (MTTR)

MTTR = Σ(containment_time − detection_time) / incident_count

Targets: P1 < 1 hour | P2 < 4 hours | P3 < 24 hours

False Positive Rate: (FP alerts / total alerts) × 100% — target < 10%; review rules > 30% FPR

Alert Closure Rate: (closed within SLA / total alerts) × 100% — target ≥ 90%

Key-Person Risk Register¶

Quiz¶

Test your knowledge: Chapter 14 Quiz