Chapter 16 — Shifts, handover and wellbeing
Lesson map
Lesson 16 published. Map, example, EX061.
flowchart TD
N0["Learning outcomes"]
N1["16.1 Shifts"]
N2["16.2 Handover"]
N3["16.3 On-call"]
N4["16.4 Fatigue"]
N5["16.5 Support"]
N6["16.6 Mistakes"]
N7["Night cover"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX061"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["16.1 Shifts"]
N2["16.2 Handover"]
N3["16.3 On-call"]
N4["16.4 Fatigue"]
N5["16.5 Support"]
N6["16.6 Mistakes"]
N7["Night cover"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX061"]
[Learning outcomes]
|
v
[16.1 Shifts]
|
v
[16.2 Handover]
|
v
[16.3 On-call]
|
v
[16.4 Fatigue]
|
v
[16.5 Support]
|
v
[16.6 Mistakes]
|
v
[Night cover]
|
v
[Worked example] --> [Exercise EX061]
Learning outcomes
You will (1) organise SOC shifts; (2) write effective handovers; (3) recognise alert fatigue and burnout; (4) support healthy working.
16.1 Shifts
Northgate monitors 07:00–19:00 on weekdays with on-call cover at night and weekends. Twelve hours of daytime cover suit a council whose staff mostly work office hours. At night and weekends, alerts go to the on-call analyst, which is why the night checklist and the P1-only rule matter. The parks01 case at 09:04 on a Monday fell well inside staffed hours. The on-call duty rotates weekly among the four analysts, so each covers roughly one week in four. Each analyst knows in advance which weeks they cover, which lets them plan rest around it.
16.2 Handover
Each shift ends with a written note: open cases, promised calls, alerts being watched. After the parks01 morning, a handover note would list INC-0417 as open, the promise to call the parks supervisor once named accounts were ready, and the 203.0.113.80 address being watched. The next shift can continue without asking Carlos, who may be off duty. The note is written in the case tool, not on paper, so it is searchable. The incoming analyst reads it before taking new alerts from the queue.
16.3 On-call
The on-call analyst carries a phone for P1 alerts only, so sleep is not broken for minor things. Limiting calls to P1 means the on-call analyst can rest and still respond when it matters. A P1 such as a new admin on the payroll server would wake them; a blocked malware alert would wait. The triage scores from the asset list make the line between them clear. The on-call phone receives only P1 alerts from the SIEM. Lower alerts wait in the queue for the morning shift.
16.4 Fatigue
Repetitive alerts cause fatigue; analysts start skipping checks. Alahmadi et al. (2022) interviewed and surveyed SOC practitioners and found that floods of false alarms frustrate analysts and erode trust in their tools; fatigue and turnover follow when this goes unaddressed. The I4 outlier and Carlos's skimming of phishing reports late in the shift both fit this pattern. Fatigue is not a personal weakness but a predictable result of repetitive alerts. Tuning noisy rules, such as the admin-tool rule, is therefore also a wellbeing measure.
16.5 Support
Rotating tasks, time for projects and learning, and managers who listen. At Northgate this means Carlos rotates to detection work in the afternoons, has four hours a week for learning and can raise problems with Aisha. Each of these measures reduces the repetitive load that leads analysts to skim. A small team cannot do everything, but it can share the dull tasks fairly. Aisha reviews workload with each analyst monthly, during the same meetings she uses for mentoring. Changes such as Carlos's afternoon rotation are agreed with the analyst rather than imposed.
16.6 Mistakes
A just culture treats honest mistakes as learning chances. When the case tool showed acknowledge times entered by hand an hour late, the fix was to capture them automatically, not to blame the analysts. Treating mistakes as process problems keeps people reporting them openly to Aisha. Hiding errors would make metrics and incident records less trustworthy. Mistakes are discussed in the monthly meeting, not in front of others during a shift. The discussion focuses on what to change in tools or process, not on who slipped.
Night cover
On-call analysts have a short checklist for night alerts: confirm the alert, check the asset criticality, take any pre-approved action, and decide whether to wake the incident lead. Everything else waits for the morning shift, with a note. The checklist means a tired person at 03:00 follows the same steps a rested person would, and the morning team picks up the case without confusion.
Learning time
Each analyst gets four hours a week for learning: a course, a lab exercise or reading. Carlos uses his to practise log searches on synthetic data. Aisha argues that learning time is not a luxury, because the threats and tools change constantly and analysts who stop learning soon struggle with new alerts. Protected learning time also makes the job more attractive, helping a small SOC keep its staff.
Speaking up
Analysts are encouraged to say when they are tired or overloaded, early.
Worked example
Carlos notices he skims phishing reports late in the shift. He tells Aisha, who rotates him to detection work in the afternoons.
Synthetic case. Shifts are invented.
Errors and limits
Small teams have less room to rotate.
Exercises
- EX061 — On-call scope. Why page on-call for P1 only? Rubric: 3 = protect sleep; 2 = partial; 1 = vague; 0 = none.
- EX062 — Handover contents. What goes in a handover? Rubric: 3 = open cases, promised calls, watched alerts; 2 = two; 1 = one; 0 = none.
- EX063 — Burnout factors. What did Alahmadi et al. (2022) find about false alarms and analysts? Rubric: 3 = frustration and eroded trust in tools; 2 = one of these; 1 = vague; 0 = none.
- EX064 — Carlos's change. What change helped Carlos? Rubric: 3 = afternoon detection work rotation; 2 = partial; 1 = vague; 0 = none.
Synthesis
Clear shifts and handovers protect the service; wellbeing protects the people.
Continue studying — chapter 16 of 18
← Chapter 15 (draft) · Course chapter index · Chapter 17 (draft) →