Chapter 9 — Security operations and blue team: leadership and assurance
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Leadership"]
N2["9.2 Assurance"]
N3["Lab — assurance indicators"]
N4["9.3 Reading the result"]
N5["9.4 Honest reporting"]
N6["9.5 Culture"]
N7["9.6 People development"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Leadership"]
N2["9.2 Assurance"]
N3["Lab — assurance indicators"]
N4["9.3 Reading the result"]
N5["9.4 Honest reporting"]
N6["9.5 Culture"]
N7["9.6 People development"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Leadership]
|
v
[9.2 Assurance]
|
v
[Lab — assurance indicators]
|
v
[9.3 Reading the result]
|
v
[9.4 Honest reporting]
|
v
[9.5 Culture]
|
v
[9.6 People development]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) lead a SOC team through change; (2) provide assurance to executives and auditors with evidence; (3) track performance and coverage over time; (4) build a culture of learning.
9.1 Leadership
Leading a SOC means setting direction, protecting analysts from overload, developing people and representing the SOC to the organisation. Knerler, Parker and Zimmerman (2022) stress hiring and growing staff as a core strategy. For Daniel, protecting analysts from overload meant pushing for the hybrid night model rather than adding night shifts to his daytime team. Developing people meant rotations into detection engineering, and representing the SOC meant the board paper and quarterly meetings with business leads. The March dip, when two analysts left, showed how much the service depends on people.
9.2 Assurance
Executives and auditors ask: is the SOC working? Assurance answers with evidence: service-level performance, tested detection coverage, exercise results and incident outcomes. Daniel's half-year report to the audit committee uses two of these indicators, P1 acknowledgement and tested coverage of priority techniques, with incident outcomes alongside. When an auditor asked how coverage is tested, he could show the test records, which made the indicator credible. Assurance without records to back it is only a claim the committee has to trust.
Lab — assurance indicators
"""Monthly assurance indicators for the SOC (synthetic)."""
months = ["Jan", "Feb", "Mar", "Apr", "May", "Jun"]
p1_met = [17, 18, 15, 19, 20, 21]; p1_total = [20, 20, 19, 21, 21, 22]
tested_cov = [52, 55, 55, 61, 64, 68] # % priority techniques with tested detections
for m, met, tot, cov in zip(months, p1_met, p1_total, tested_cov):
print(f"{m} P1 acknowledged within 15 min: {met}/{tot} = {met/tot:.0%} tested coverage: {cov}%")
Run with python3 lab_assurance.py. Verified output:
Jan P1 acknowledged within 15 min: 17/20 = 85% tested coverage: 52%
Feb P1 acknowledged within 15 min: 18/20 = 90% tested coverage: 55%
Mar P1 acknowledged within 15 min: 15/19 = 79% tested coverage: 55%
Apr P1 acknowledged within 15 min: 19/21 = 90% tested coverage: 61%
May P1 acknowledged within 15 min: 20/21 = 95% tested coverage: 64%
Jun P1 acknowledged within 15 min: 21/22 = 95% tested coverage: 68%
9.3 Reading the result
P1 acknowledgement within 15 minutes rose from 85% in January to 95% by June, with a dip to 79% in March. Tested coverage of priority techniques rose steadily from 52% to 68%. The March dip coincided with two analysts leaving; the hybrid night model began in April. The dip has a known cause and a known response, which is what an audit committee needs. Daniel does not claim the hybrid model caused the recovery, only that the two coincided; the six-month review is where that question will be examined.
9.4 Honest reporting
Daniel reports the dip and its cause rather than averaging it away. Assurance that hides problems loses credibility when problems appear. In the half-year report, the March figure of 79% appears in the chart and the text, with the departure of two analysts as its cause and the hybrid night model as the response. Averaging the six months would have hidden a month in which nearly one P1 in five was acknowledged late. The committee asked about the dip, and Daniel's answer came from records rather than reassurance.
9.5 Culture
Blameless reviews, time for learning and recognition of good escalations build a culture where analysts raise problems early. At Meridian, good escalations are recognised in the monthly team meeting, including ones that turned out benign, such as the night P1 the on-call engineer judged needed no action. Reviews of the contractor and partner cases focused on decisions and information, not blame. Analysts who expect blame for a wrong call tend to escalate late or not at all, which is the opposite of what the SOC needs.
9.6 People development
Each analyst has a development plan: training, rotation into detection engineering and mentoring. Daniel reviews each plan every six months with the analyst. Rotation into detection engineering lets analysts see how rules are written and tested, which improves their triage. His own plan includes mentoring a senior analyst toward team leadership, so the SOC does not depend on him alone. Plans are adjusted when someone leaves, as in March, so that remaining analysts are not simply given more of the same work.
Managing the provider
Assurance includes the managed night service. Daniel reviews a monthly sample of its escalations and closures with the provider, scoring clarity, correctness and timeliness, and shares the results with the CISO alongside internal indicators.
Worked example
Daniel's half-year assurance report to the audit committee shows both indicators, explains the March dip, lists three untested priority techniques with plans, and summarises one confirmed breach and its lessons. An auditor asks how coverage is tested; Daniel provides the test records.
Synthetic case. Indicators come from the lab script.
Errors and limits
Indicators measure what can be counted; some important qualities, such as judgement, need qualitative evidence.
Exercises
- EX041 — Assurance evidence. List four types of assurance evidence. Rubric: 3 = service levels, tested coverage, exercises, incident outcomes; 2 = three; 1 = one; 0 = none.
- EX042 — Lab trends. Describe both indicator trends. Rubric: 3 = P1 85%→95% with March dip 79%; coverage 52%→68%; 2 = partial; 1 = one; 0 = none.
- EX043 — March dip. What explained the March dip? Rubric: 3 = two analysts left; before hybrid model; 2 = partial; 1 = unknown; 0 = none.
- EX044 — Honest reporting. Why report the dip rather than average it away? Rubric: 3 = credibility; hidden problems undermine assurance; 2 = partial; 1 = looks better; 0 = none.
- EX045 — Auditor question. How did Daniel answer the auditor's coverage question? Rubric: 3 = provided test records; 2 = partial; 1 = verbal; 0 = none.
Synthesis
SOC leadership pairs developing people with evidence-based, honest assurance.
Continue studying — chapter 09 of 12
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →