SOC HR and training

This page deals with SOC HR and training topics.

ToC

Must read

MITRE, 11 strategies for a world-class SOC, Strategy 4, pages 101-123

HR roles and organization

As per what is explained on the management page, I would recommend to make sure the following roles are being assigned to people:

SOC analyst;
SOC analyst senior;
SOC detection engineer;
Threat intel analyst;
Threat intel lead (if several analysts)
SIEM expert and data scientist;
Pentester (offensive team);
Incident handler;
Incident manager;
SOC/CSIRT tools admin;
SecDevOps analyst;
SOC/CERT/CSIRT deputy manager.

They can be FTE or outsourced, it will depend on your needs and constraints. My recommendations are explained in the RACI template that I propose.

Recommended SOC trainings

Regular trainings

BlueTeamLabs challenges and investigations, here are a few free trainings that I recommend:
Cyberdefenders, here are a few free trainings that I recommend:
LetsDefend, here are a few free trainings that I recommend:
SOC Vel.
Cybrary, MITRE ATT&CK threat hunting, free!
ENISA trainings, free!
Splunk:
PaloAlto, Fundamentals of SOC](https://beacon.paloaltonetworks.com/student/path/521672-the-fundamentals-of-soc-security-operations-center), mainly modules 1 to 8 :) (free);
Microsoft, Become an Azure Sentinel Ninja (free);
Active Directory:
- train on AD specific attacks, Orange Cyberdefense GOAD (free).
- Populate AD with "real life" objects, in an automated way, Badblood

Certifications

BlueTeamLabs (level 1 & 2).
SANS SEC555: SIEM with tactical analytics.
SANS SEC450: Blue Team Fundamentals: Security Operations and Analysis.
SOC & SIEM Security program: L1, L2, L3.
Splunk Core User.
Microsoft Cybersecurity Architect.
Microsoft Sentinel Ninja.
AWS Security Fundamentals.
PAN, Fundamentals of network security.
PAN, Fundamentals of SOC.
CEH.
OSDA SOC-200.
SANS, SEC501: Advanced Security Essentials - Enterprise Defender.
SANS, SEC541: Cloud Security Attacker Techniques, Monitoring, and Threat Detection.
SANS, SEC699: Purple Team Tactics - Adversary Emulation for Breach Prevention & Detection.
SANS, SEC497: Practical Open-Source Intelligence (OSINT).

Recommended CERT/CSIRT trainings

Regular trainings

Certifications

SANS FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response.
SANS, SEC541: Cloud Security Attacker Techniques, Monitoring, and Threat Detection.
Splunk Core User.
GCIH.
SANS FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics.
SANS FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques.
SANS SEC555: SIEM with tactical analytics.
SANS FOR578: Cyber Threat Intelligence.

Recommended offensive security trainings

NB: this is for red/purpleteaming activities.

Regular trainings

Mariusz Banach, Evasion in Depth - Techniques Across the Kill-Chain
Cybrary, MITRE ATT&CK threat hunting.
HackTheBox.
CybersecurityUp, OSCE complete guide.
RTFM.

Certifications

Offensive Securiy OSCP.
SANS, SEC565: Red Team Operations and Adversary Emulation.
SANS, SEC760: Advanced Exploit Development for Penetration Testers.
SANS, SEC699: Purple Team Tactics - Adversary Emulation for Breach Prevention & Detection.
SANS, SEC541: Cloud Security Attacker Techniques, Monitoring, and Threat Detection.

Recommended management trainings

Certifications

SANS, MGT512: Security Leadership Essentials for Managers

To go further

The best BlackHat and DefCon talks of all time

End

Go to main page.