Team & competency kit — SOC Officer

The separation that is not negotiable

Lithuanian law prohibits the cybersecurity manager and the system security officer from performing network or information system administration, or any role involving the maintenance and management of hardware or software. The SOC itself must be independent of those responsible for the proper operation of the systems it monitors.

In a small organisation this is uncomfortable — the person who knows the estate best is usually the person who runs it. Solve it with roles and review, not by quietly merging them.

Tiers and minimum capability

Tier	Must be able to	Fails when
L1 — triage	Apply a playbook accurately, recognise when one does not fit, and write a decision record someone else can follow	Judged on volume closed rather than on decision quality
L2 — investigator	Establish scope and impact, collect artefacts soundly, choose a containment strategy and justify it	Pulled back into the alert queue mid-investigation
L3 — specialist	Forensic analysis, malicious code analysis, and translating technical findings into a business recommendation	Treated as an escalation dumping ground rather than a scarce resource with entry criteria
Detection engineering	Build, test and retire detections against a threat model, and measure their quality	Given no protected time; the queue always wins
SOC Officer	Hold the mandate, own the evidence trail, run the cadence, and speak to a board without translating badly	Absorbed into being the most senior analyst

Find the single points of failure

Run this deliberately. Key-person risk is invisible until the person is unavailable, and then it is the only thing that matters.

Quarterly

0/8

01For each critical capability, name at least two people who can perform it.
02Where only one name exists, that is a documented risk — record it, do not just note it.
03Test the second name by having them actually do it, not by asking whether they could.
04Identify knowledge that exists only in someone's head and schedule its documentation.
05Confirm that access — platform, systems, submission portals — is not held by only one person.
06Check that the on-call rota does not always resolve to the same person in practice.
07Review what happens if the SOC Officer is unavailable during a notifiable incident.
08Verify the deputy knows they are the deputy, and has been told what that involves.

Training plan that survives budget review

Tie every training item to a capability gap or a statutory obligation. Training justified by interest gets cut first.

Annual

0/7

01Map required capabilities per tier, and assess each person against them honestly.
02Prioritise the gaps that are also single points of failure.
03Confirm the management body's own training obligation is scheduled and evidenced.
04Include exercise participation as training — it is the most transferable kind.
05Budget for the certification only where it is genuinely required, not as a proxy for competence.
06Record training completion with topic, participants and date — it is a reportable artefact.
07Review after each major incident: what did the team not know that it needed to?

Tiers and minimum capability

SOC build kit