Chapter 28 — Field practice
Lesson map
Lesson 28 published. Map, example, EX082.
flowchart TD
N0["Learning outcomes"]
N1["28.1 The placement"]
N2["28.2 Conduct"]
N3["28.3 Daily work"]
N4["28.4 Client contact"]
N5["28.5 Mistakes"]
N6["28.6 Journal"]
N7["28.7 Evaluation"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX082"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["28.1 The placement"]
N2["28.2 Conduct"]
N3["28.3 Daily work"]
N4["28.4 Client contact"]
N5["28.5 Mistakes"]
N6["28.6 Journal"]
N7["28.7 Evaluation"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX082"]
[Learning outcomes]
|
v
[28.1 The placement]
|
v
[28.2 Conduct]
|
v
[28.3 Daily work]
|
v
[28.4 Client contact]
|
v
[28.5 Mistakes]
|
v
[28.6 Journal]
|
v
[28.7 Evaluation]
|
v
[Worked example] --> [Exercise EX082]
Learning outcomes
You will (1) work in a live managed SOC under supervision; (2) apply professional conduct with clients; (3) contribute to daily operations; (4) reflect on practice in a journal.
28.1 The placement
Mei's final field practice is eight weeks full-time at Copperleaf, rotating between day and evening shifts under Raj's supervision.
Rotating shifts lets Mei see how the work differs across the day: daytime brings client calls and onboarding, evenings bring alerts after clinics close. Supervision by Raj continues the arrangement from chapter 10, where her decisions are checked before they reach a client, but over eight weeks the checks become lighter as she shows reliable judgement. Evening shifts also give her experience of the hours when clinics are closed and suspicious activity stands out most clearly.
28.2 Conduct
She signs confidentiality terms, never discusses clients outside work and uses client data only in Copperleaf's systems.
These terms matter more at a provider that sees forty clients' data. A remark about one dental client's incident in the wrong place could identify the business and its patients. Keeping client data inside Copperleaf's systems also means her placement journal describes cases without copying logs or names out of those systems. She also signs the same access terms as permanent staff, including MFA on her SIEM and case-system accounts.
28.3 Daily work
Triage of medium alerts, drafting client advice for review, onboarding checks and the weekly noise review.
Medium alerts are the right level for a trainee: they need real triage but rarely need containment at night. Drafting advice for review builds on her work since chapter 10, and onboarding checks and the noise review use the verification and evaluation skills from chapters 12 and 23 in daily practice rather than as exercises. Each kind of task is reviewed by Raj at first, and the review becomes lighter as her drafts and decisions need fewer corrections.
28.4 Client contact
By week four, Mei makes routine client calls herself, with Raj listening in for the first few.
Raj listening in lets him correct tone and content while the call is still a learning exercise. Routine calls include confirming a new device or asking about an account change. Mei's worked example from week six shows why practice matters: the office manager's defensive reaction needed calm wording that is easier to learn on routine calls. After each early call Raj gives brief feedback, usually on wording, which Mei then records in her journal for the week.
28.5 Mistakes
In week three, Mei closes an alert as benign without checking the client's business hours; Raj spots it in review. The alert was benign, but the check was required. She adds it to her personal checklist.
Raj's lesson in this case was about the method, not about the outcome. Business hours are the context that decides whether an action at a given time is suspicious, as the BrightSmile enrichment line "clinic closed" showed. Closing without checking them was right by luck, and the personal checklist makes the check a habit rather than a memory.
28.6 Journal
A weekly journal records cases, decisions, mistakes and lessons; her polytechnic tutor reviews it.
The journal gives the tutor evidence of learning that Raj's evaluation alone would not show, such as how Mei reasoned about a decision. Recording mistakes alongside successes, as with the week-three business-hours slip, lets both the tutor and Mei see whether a lesson was actually applied later. Entries are short and dated, so the tutor can follow her progress week by week without reading long reports. Mei describes each case by type and decision, keeping client names and logs out of the journal as her confidentiality terms require.
28.7 Evaluation
Raj's evaluation covers technical skill, judgement, communication and reliability.
Each criterion links to things Raj saw during the placement. Technical skill shows in triage and onboarding checks, judgement in decisions such as when to call a client, communication in her calls and drafts, and reliability in handover notes and promised calls kept. The evaluation and the journal together go to her polytechnic. Raj bases each judgement on specific cases from the placement, so Mei and her tutor can see the evidence behind every comment.
Shift handover
At every shift change Mei writes a handover note: open cases, client calls promised, alerts being watched and anything unusual. The incoming analyst reads it and asks questions before Mei leaves. Raj points out that the most common failure in managed SOCs is a promise to call a client back that gets lost at handover, so Mei puts promised calls at the top of every note, with the time and the client contact's name. In week five, an evening analyst thanks her because a client called asking for an update and the note told him exactly what had been promised. Good handovers make the service continuous even though people change every eight hours.
Worked example
Mei's journal, week six: "Called a dental client at 19:40 about a new admin account. The office manager was defensive, thinking we suspected her. I explained it was a routine check of any new admin. She confirmed she had created it for a locum dentist. Lesson: say 'routine check' first."
Synthetic case. The placement is invented.
Errors and limits
Placements vary by host; tutors ensure learning goals are met.
Exercises
- EX082 — Daily work. List three daily tasks Mei performed. Rubric: 3 = triage, drafting advice, onboarding checks, noise review (three); 2 = two; 1 = one; 0 = none.
- EX083 — Week-three mistake. What was Mei's mistake and her response? Rubric: 3 = closed without checking business hours; added to checklist; 2 = partial; 1 = vague; 0 = none.
- EX084 — Call lesson. What did the defensive client teach Mei? Rubric: 3 = frame as routine check first; 2 = partial; 1 = vague; 0 = none.
Synthesis
Supervised field practice builds judgement, client skills and reflective habits.
Continue studying — chapter 28 of 30
← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →