SOC101 · Security Operations: Roles and Workflow

Categories: Cybersecurity
Wishlist Share

About Course

Understand what a security operations center does, who does what, and how alerts move from detection to resolution. You map a realistic SOC workflow for a small business.

Explore · 4 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

Anyone starting in security operations, including IT generalists and small-business owners who handle their own security.

Prerequisites

No prior security experience is needed; basic computer literacy is enough.

What you will be able to do

  • Describe the core functions of a SOC and how they protect an organization
  • Distinguish the responsibilities of Tier 1, Tier 2 and Tier 3 analysts and supporting roles
  • Trace an alert through the triage, investigation, escalation and closure workflow
  • Define basic SOC metrics such as MTTD, MTTR and false-positive rate for a small team

Lessons

  • Lesson 1 · What a SOC does and why it exists
  • Lesson 2 · Roles, tiers and responsibilities
  • Lesson 3 · The alert lifecycle and SOC metrics
  • Lesson 4 · Lab and assignment

Lab: Map an alert workflow for a small business

You draw the end-to-end alert workflow for a 25-person accounting firm, from the moment a suspicious login alert fires until the ticket is closed. You then build a simple alert triage log in a spreadsheet and work through five sample alerts, recording verdict, severity and next action for each.

Free tools: draw.io (diagrams.net, free in the browser) and a spreadsheet in Google Sheets or LibreOffice Calc

Assessed assignment

Write a two-page SOC operating model for a small business with no dedicated security staff. Define which functions are handled in-house, which are outsourced to a managed provider, and who owns each step of the alert workflow. Include your workflow diagram, a severity matrix and three metrics you would track monthly. Explain how the model would scale if the company doubled in size.

Criterion Weight What excellent work looks like
Role and function coverage 30% Every core SOC function is assigned to a named role or provider with no gaps or overlaps.
Workflow clarity 30% The diagram shows triage, investigation, escalation and closure with clear decision points and handoffs.
Severity and metrics 20% Severity levels have concrete criteria and response times; metrics are defined, measurable and realistic.
Scalability reasoning 20% The growth section explains specific changes to roles, tooling and coverage hours.

Portfolio piece

A SOC operating model with workflow diagram and severity matrix for a small business.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.

Next step

Continue with SOC102 · Networking and Linux Foundations for Defenders · 4 hours · $28.00

Continue to the next course

Prefer the whole program? Program in Security Operations & Threat Defense · $378.00 (10% less than buying the courses separately)

Show More

What Will You Learn?

  • Describe the core functions of a SOC and how they protect an organization
  • Distinguish the responsibilities of Tier 1, Tier 2 and Tier 3 analysts and supporting roles
  • Trace an alert through the triage, investigation, escalation and closure workflow
  • Define basic SOC metrics such as MTTD, MTTR and false-positive rate for a small team

Course Content

SOC101 · Security Operations: Roles and Workflow (4 h)
Understand what a security operations center does, who does what, and how alerts move from detection to resolution. You map a realistic SOC workflow for a small business.

  • Lesson 1 · What a SOC does and why it exists
  • Lesson 2 · Roles, tiers and responsibilities
  • Lesson 3 · The alert lifecycle and SOC metrics
  • Lesson 4 · Lab and assignment
  • SOC101 Assessment · Security Operations: Roles and Workflow
Scroll to Top