Resecurity® Certified SOC Operations Manager (RCSOM)

About this course

Learn to design, run and improve a security operations centre. Over four days of management workshops you will shape an operating model, plan staffing and shifts, build triage and escalation workflows and set a detection strategy grounded in real threats.

You will evaluate SIEM, SOAR and threat intelligence architecture, coordinate with response, intelligence and fraud teams, and choose metrics that show real performance. Case studies and a capstone prepare you for the RCSOM credential and for reporting to senior leaders.

What you'll learn

• Design a SOC operating model that fits the organisation's risk and resources.
• Define roles, staffing levels and shift patterns, and plan for analyst retention.
• Build triage, escalation and case management workflows.
• Shape a threat-informed detection strategy.
• Evaluate SIEM, SOAR, threat intelligence and wider tooling architecture.
• Coordinate the SOC with DFIR, CTI, fraud and IT teams.
• Set KPIs, SLAs, risk indicators and maturity measures, and judge analyst workload.
• Report SOC performance to senior management and plan an improvement roadmap.

Curriculum

Who it's for

SOC managers, team leaders, senior analysts and security operations leads stepping into management.

Before you start

• Experience working in or alongside security operations.
• Awareness of SIEM, SOAR, CTI and incident management processes.

Prepares for