Security Operations Center

What is a SOC?

A Security Operations Center (SOC) is the team, the tools and the processes that watch an organisation's systems around the clock and respond to threats. Think of it as the control room of the security world: screens of alerts, analysts asking "is this real?", and a clear plan for what happens next.

Banks, telcos, fintechs, hospitals and governments run SOCs, either in-house or through a managed security service provider (MSSP). In Nigeria, larger banks and telecom operators run their own SOCs, while many mid-sized firms buy the service from local or international providers. Global companies often run "follow-the-sun" SOCs, with teams in different time zones covering 24 hours.

SOC Tiers and Roles

Tier 1 is where most careers begin. It is the best entry point for a newcomer, and the skills you build (log reading, networking, curiosity) carry through every other security role.

SIEM: The Brain of the SOC

A SIEM (Security Information and Event Management) system collects logs from firewalls, servers, endpoints, cloud services and applications, normalises them, correlates events and raises alerts.

Popular platforms include Splunk, Microsoft Sentinel, IBM QRadar, Elastic Security and the open-source Wazuh.

Correlation example:

Rule: 10 failed logins for one account within 5 minutes,
      followed by a SUCCESSFUL login from a new country
  -> Alert: "Possible account takeover", severity High

Neither event alone is alarming. Together they are. That is the value of correlation. Other tools around the SIEM: EDR (endpoint detection and response), SOAR (automation of repetitive response steps) and threat intelligence feeds.

Alert Triage: What Tier 1 Really Does

Most alerts are false positives. Triage is the disciplined process of deciding quickly and consistently:

1. Read the alert: what rule fired, on which asset, for which user?
2. Gather context: is the asset critical? Is the user on leave or travelling? Any similar alerts?
3. Enrich: check IP or file hashes against threat intelligence (VirusTotal, AbuseIPDB), look at nearby logs.
4. Decide: false positive (close and document), true positive (escalate) or need more data.
5. Document: write what you checked and why. Good notes save the next analyst hours.
6. Escalate with a clear summary: what, where, when, evidence, suggested action.

Questions to ask: Is this normal for this user or system? Does the timing make sense? Is the source known? What is the potential impact if I am wrong?

Priority = severity of the threat x importance of the asset. A medium alert on a domain controller can outrank a high alert on a test laptop.

SOC Metrics

• MTTD (mean time to detect): how long attackers are inside before you notice.
• MTTR (mean time to respond/resolve): how long from detection to containment.
• False-positive rate and alert volume per analyst: signs of alert fatigue.

Reducing these numbers is the SOC's constant goal.

Skills That Get You Hired

• Networking basics (Module 2) and Linux (Module 3).
• Reading logs and using a SIEM query language (Splunk SPL, KQL).
• Understanding common attacks (phishing, brute force, malware, lateral movement) and frameworks like MITRE ATT&CK.
• Clear writing and calm communication under pressure.
• Curiosity and persistence, because most of the job is careful investigation.

Try It: Triage the Queue

In the editor on the right, five alerts have arrived in your SIEM queue. For each one, choose the best action. There are no tricks, but context matters.