The role

The SOC Officer is where responsibility and authority have to meet

A Security Operations Centre can be a team, a shared service, or a contract with a provider. In every one of those shapes there is a single person the organisation turns to when it needs to know what happened, what was done, and what it can prove. This page defines that person's job.

Reports to: CISO / management body
Owns: Detection, response, evidence
Does not own: Remediation of the estate
Reviewed: At least annually

Definition

Accountable for the function, not for every fix

The SOC Officer runs the security operations function: they decide what is monitored, how alerts are handled, when something becomes an incident, who is told, and what the organisation records about it. They are accountable for the function performing — for coverage being real, for response being timely, and for the trail being complete.

They are not accountable for patching every vulnerable server or rebuilding every compromised host. That work belongs to the system owners. What the SOC Officer owns is the detection of the problem, the quality of the escalation, the coordination of the response, and the record that shows both the recommendation and the decision the business made about it.

This distinction is not pedantry. A SOC Officer held accountable for outcomes they cannot control will either burn out or start hiding findings. A SOC Officer accountable for detection, escalation and evidence can be measured fairly — and can escalate an unaccepted risk without it being a personal failure.

Question at review	Who answers
Why was this not detected?	SOC Officer
Why was the alert not acted on for six hours?	SOC Officer
Why was the authority not notified within 24 hours?	SOC Officer
Why was this server still unpatched?	System owner
Why was the remediation budget refused?	Management body
Why was this risk accepted?	Risk owner / management body

The boundary is drawn at the point of control. Everything the SOC Officer answers for is something they can actually change.

The trap

Where the boundary is undefined, it defaults to whoever noticed. A SOC that reports a vulnerability and is then asked to fix it has quietly become an operations team, and its detection quality will fall to pay for it. Write the boundary into the mandate before it is tested by an incident.

Functional areas

Five areas, and the evidence each one owes

A function you cannot evidence is a function you cannot defend. For each area, know what you do — and know what artefact proves you did it.

F01

Detection & analysis

Continuous monitoring and correlation of security events, primary triage, and proactive hunting for what the rules did not catch.

Duties

Monitor and correlate security events across the estate
Primary alert triage (L1–L2) and false-positive filtering
Proactive threat hunting against hypotheses, not alerts
Maintain and extend detection coverage against a threat model

Evidence it produces

Log-source inventory reconciled against the asset inventory
Detection coverage map with owners per use case
Triage decision records — including for events closed as unfounded

F02

Incident response

Registering, classifying and prioritising incidents; deep investigation and forensics; containment, eradication and coordinated recovery.

Duties

Register, classify and prioritise every incident
Deep investigation and digital forensics (L2–L3)
Contain and eradicate the threat, then coordinate restoration
Preserve evidence to a standard that survives scrutiny

Evidence it produces

Incident records with awareness, containment and closure timestamps
Chain-of-custody records for collected artefacts
Post-incident reviews with owned, dated actions

F03

Compliance & accountability

Statutory incident notification, periodic reporting to the management body, and standing ready for internal and external audit.

Duties

Notify the national authority within the statutory deadlines
Produce periodic reports on security posture, incidents and KPIs
Participate in internal and external security audits
Keep the evidence trail that demonstrates the measures work

Evidence it produces

Submitted notifications with their timestamps and receipts
Board-level report pack, issued on a fixed date each period
Audit findings register with remediation status

F04

Security improvement

Turning every incident and every false positive into a change: tuned detections, closed gaps, and security requirements on new systems.

Duties

Create and continuously tune detection rules and scenarios
Issue remediation recommendations to system owners
Contribute security requirements to new IT solutions
Run efficacy testing — exercises, atomic tests, purple teaming

Evidence it produces

Tuning backlog with rule-level false-positive rates
Recommendation register with owner, due date and status
Exercise reports and the actions they generated

F05

Knowledge management

Threat intelligence that changes what you look for, and documentation good enough that the SOC survives the departure of any one analyst.

Duties

Collect, analyse and apply threat intelligence
Document procedures (SOPs) and response playbooks
Maintain the shift handover and on-call knowledge base
Share findings with the wider organisation and with peers

Evidence it produces

SOP and playbook register with review dates
Intelligence requirements traced to detections they produced
Handover records showing continuity across shifts

Separation of duties

One unit, three hats

Even in a team of four, the three modes of SOC work pull in different directions. Naming them stops the loudest one from eating the other two.

Hat	Optimises for	Fails when merged
SOC Operations	Throughput and timeliness — the queue is worked, nothing ages past target	Absorbs all capacity; engineering and response starve during busy weeks
Detection Engineering	Signal quality — fewer, better alerts, coverage mapped to a threat model	Never happens; the backlog is always less urgent than today's queue
Incident Response	Depth and defensibility — full scope, evidence that holds up	Investigations are cut short to get back to the alert queue

If one person wears all three hats, protect the time explicitly: engineering and exercise work needs a slot in the week that operations cannot borrow from.

Decision rights beat tooling

The single highest-leverage thing a SOC Officer can secure is pre-authorised containment: the written right to isolate a host, disable an account or block a destination without convening a meeting. Without it, mean time to respond is bounded by someone else’s calendar.

The reciprocal obligation

Pre-authorised containment is granted on conditions: defined triggers, an immediate notification duty, a named approver informed after the fact, and a documented rollback. Bring those conditions with you when you ask — it is what turns the request from a power grab into a control.

Operating rhythm

What the job looks like on a calendar

If you want to know whether a SOC is a function or a queue, look at what happens in a week when nothing is on fire.

Per shift

L1 / shift lead

Handover: open incidents, watch items, environment changes in flight
Confirm detection and log-source health dashboards are green
Work the alert queue to the agreed triage time target
Escalate against written triggers, not against workload
Record the handover before leaving — no verbal-only transfers

Daily

SOC Officer

Review incidents opened, escalated and closed in the last 24 hours
Check ageing: anything past its severity-linked response target
Confirm no log source has silently stopped reporting
Clear the escalation decisions that need your authority

Weekly

SOC Officer

Tuning review: top noisy rules, and what will be done about each
Detection backlog grooming against current threat intelligence
Open recommendations to system owners — chase what has slipped
Rota and coverage check for the coming two weeks

Monthly

SOC Officer

Issue the management report: posture, incidents, KPIs, risks
Review MTTD and MTTR trends and explain any movement
Close out post-incident review actions that are now due
Review coverage changes: new systems onboarded, sources retired

Quarterly

SOC Officer + CISO

Exercise: table-top or technical, with a written result
Efficacy test — does the detection stack still catch what it claims?
Review the SOC's own risks: key-person, capacity, tooling contract
Refresh the threat model and re-prioritise the detection roadmap

Annually

Management body

Re-approve the SOC mandate, scope and delegated authority
Reassess the effectiveness of the risk-management measures
Confirm management-body cybersecurity training is current
Review staffing, competency matrix and succession for each tier

Shift & handover kit First 90 days The operating model in full