Global Learning for Operational Leaders
Classroom
15 sessions
Scroll for more
Online / Live
15 sessions
Scroll for more
Introduction
Course overview
A security operations centre monitors, detects and responds to cyber threats around the clock. Building and running an effective SOC requires the right people, processes, technology and metrics.
This Aractech course covers SOC models, people and skills, processes and playbooks, SIEM and security tooling, threat detection use cases, triage and escalation, incident handling, metrics and continuous improvement, and outsourcing decisions. Participants design SOC processes and performance measures.
The course suits security managers and analysts building or improving SOC capabilities.
What you will achieve
Learning objectives
- Explain SOC functions and operating models
- Define SOC roles, skills and staffing
- Design SOC processes and playbooks
- Use SIEM and security tools effectively
- Manage alert triage and escalation
- Measure and improve SOC performance
Who should attend
Target audience
- SOC managers and team leads
- Security analysts
- Information security managers
- IT operations managers
- Managed security service staff
- CISOs
Methodology
Learning approach
- Process design workshops
- Tool demonstrations
- Case studies
- Playbook exercises
- Metrics discussions
Complete course outline
Five focused days of learning and application
The timings provided are estimates and may vary depending on the number of participants and the discussions taking place during the sessions. They are indicative only and do not constitute a binding commitment.
Day 1
SOC Fundamentals
- Purpose of a SOC
- Operating models
- In-house versus managed
- Maturity levels
- Coffee break
- Maturity levels (continued)
- Business case
- Exercise: SOC maturity review
Day 2
People and Processes
- Roles and tiers
- Skills and training
- Shift models
- Processes
- Coffee break
- Processes (continued)
- Playbooks
- Workshop: Playbook design
Day 3
Technology
- SIEM
- EDR and XDR
- SOAR and automation
- Threat intelligence feeds
- Coffee break
- Threat intelligence feeds (continued)
- Log sources
- Demonstration: SIEM workflow
Day 4
Detection and Response
- Use-case development
- Alert triage
- Escalation
- Incident handling
- Coffee break
- Incident handling (continued)
- Threat hunting links
- Simulation: Alert triage
Day 5
Performance and Improvement
- SOC metrics
- Reporting
- Reducing alert fatigue
- Coffee break
- Reducing alert fatigue (continued)
- Continuous improvement
- Outsourcing management
- Capstone: SOC improvement plan
FAQ
Frequently asked questions
What does Security Operations Centre (SOC) Management (IMCS-012) cover?
This course covers IT Management and Cyber Security through a structured five-day outline focused on practical application, discussion, and implementation planning.
When is the next available session?
The next scheduled session starts on 16 - 20 November 2026. See the course schedules section for the available dates and delivery formats.
Who should attend this course?
SOC managers and team leads, Security analysts, Information security managers
Is bilingual course delivery available?
Yes. All course materials and presentations are provided in English, while bilingual explanation and discussion support may be available depending on the selected location and trainer availability. For example, when attending a course in Istanbul, you may request a Turkish-speaking trainer to explain the English course content in Turkish. Arabic explanation support may also be requested at this location. Other languages are available in selected cities. You can choose your preferred language support as an optional preference during registration.
How can I register for a session?
Use any Register button next to the available course dates to open the participant registration page and submit your booking request for the selected session.
Is this course available online as well as classroom-based?
Check the course schedules section for currently published classroom and Online / Live sessions.
Where are classroom sessions delivered?
Current classroom venues include Amsterdam, Paris, Barcelona, London, Munich, Istanbul.
How long is the training programme?
The programme runs for five days from 09:00 to 14:00, which gives 25 contact hours, including a daily 30-minute break (22.5 hours of instruction).
Quick request
Send quick request
Send a fast enquiry about this course and the academy team will get back to you.
Get a quotation
Request a formal quotation
Choose an available date and venue, add your participants, and we will email a formal quotation for Security Operations Centre (SOC) Management to your business address.