For organisations whose SOC is busy and can't say whether it's effective
A director of security operations who measures containment, not alert counts
A security operations centre can be fully staffed, tooled to the ceiling, and closing thousands of tickets a month, and still miss the one intrusion that matters. I've seen that pattern enough times to have written it up: the SOC that's busy but not effective. Leading security operations well means asking a different question than "how many alerts did we handle," and building the operation so the answer to the real question, "would we see it, and could we stop it," is yes, with evidence.
What I'd run, and how
The SOC and its people: hiring for the ability to investigate rather than the ability to close tickets, and a career path so the good ones stay. Detection engineering: every detection with an owner, a documented reason to exist, an expected false-positive rate, and a test that proves it fires; detections that don't earn their place get retired. Response: playbooks that name who can do what without a meeting, rehearsed, including the part where the business disagrees. Telemetry: knowing what we can see and, more important, what we can't, so the gaps are decisions rather than surprises. And the measures: time to detect, time to contain, coverage against the attacks that matter to us, and the honest rate at which real intrusions get through, reported upward even when it's ugly.
Working with a managed provider
Many organisations outsource some or all of the SOC. I've run both models and the mix. If you have an MSSP, my job becomes making sure the contract measures what matters, that our telemetry actually reaches them, that escalation works at 2 a.m. and not only in the service review, and that we can prove the provider's detections work in our environment rather than in their marketing.
The honest fit
This works where the organisation wants an operation that can prove itself and is willing to hear that some of what it bought isn't doing anything. It doesn't work where the SOC exists to produce a compliance artefact, or where the director has no authority over tooling and telemetry. I'd ask to see the last quarter's metrics before we talk; the ones you choose to show me will tell me most of what I need to know.
Where this comes from
About twenty years hands-on in incident response and security operations, and thirty leading security, including building operations from nothing and rebuilding ones that looked fine. Most of the detail is under NDA. What I can say here, I do.
What I've written on this.
Read these before we talk, if you like. They're the long version of the argument.
- Research How Do You Know Whether Your SOC Is Actually Effective?
- Research How Do You Know a Security Control Still Works After a Change?
- Research Which Cloud Logs Must You Preserve Before an Incident?
- Short When is it safe to say the incident is over?
- Short Ransomware is running. Do you pull the plug or pull the network cable?
Related work.
Other ways I'm engaged on the same problems.
- Hire a cybersecurity director who builds the operation, not the slide about itDirector-level leadership for security operations, engineering, or programmes, from someone who's done the work the team does.
- Hire a CISO who's run the response, not just reported on itA security leader who's led breaches, built operations, and briefed boards. Here's what I'd bring to the role and where I wouldn't fit.
- An adviser for the executive who has to decide, not the team that has to implementIndependent judgement for the person who signs: what to ask, what to believe, what to decide, and what to tell the board.
- For recruiters and search firms: what I'm a fit for, and what I'm notA straight answer for search firms: roles, fit, non-fit, and how to get a fast yes or no from me.
Discuss an executive role.
Tell me about the role, the organisation, and what the first year has to deliver. I'll say quickly whether it's a fit.
Much of what I've done can't be described in public, and I've had an intimate relationship with NDAs most of my adult life. What I can say here, I do; the rest we talk about in confidence.
- CISOs who need a director to own detection and response and report on it honestly.
- Organisations with an MSSP that can't tell whether the contract is working.
- Recruiters with a head-of-SOC or director-of-operations mandate.