If you are an associate-level cybersecurity analyst who is working in security operation centers, this course will help you acquire the fundamental skills required in a security operations center. You will learn the primary functions of a security operations center (SOC) and the critical role it plays in protecting organizational assets from cyber-attacks. By the end of the course, you will be able to:
• Gain an understanding of SOC team member’s daily activities and responsibilities.
• Identify who these bad actors are, their motives, why they attack, and what they attack.
• Review the goals of implementing a SOC and covers the business benefits that an organization achieves by employing a SOC.
• Introduce technical and procedural challenges in a SOC.
To be successful in this course, you should have the following background:
1. Skills and knowledge equivalent to those learned in Implementing and Administering Cisco Solutions (CCNA) v1.0 course
2. Familiarity with Ethernet and TCP/IP networking
3. Working knowledge of the Windows and Linux operating systems
4. Familiarity with basics of networking security concepts.
Overview
Syllabus
- Introduction to Security Operations Center
- In this module, you will explore what a Security Operations Center, or SOC, does and how SOC team members support day-to-day security monitoring and response. You will identify common threat actors, their motivations, and the assets and systems they target. You will also examine why organizations implement SOCs, the business value they provide, and the technical and procedural challenges SOCs commonly face.
- Security Operations Center Processes and Services
- In this module, you will examine the core responsibilities of a Security Operations Center (SOC) and how it works with other teams across the organization. You will place the SOC within the incident response lifecycle, from detection through recovery. You will also outline the key services a SOC provides across each incident response phase.
- SOC Deployment Models and Types
- In this module, you will distinguish common SOC types (for example, internal, outsourced, and hybrid) and the staffing considerations that shape each, such as roles, coverage models, and escalation paths. You will also compare SOC deployment models (on‑premises, cloud, and managed services) and connect each to typical consumer profiles based on needs like cost, control, scalability, and response expectations.
- Staffing an Effective SOC Team
- In this module, you will examine the core roles on an effective SOC team and how each role supports incident response. You will outline the key skills expected for common SOC positions and the primary tools each role relies on. You will also identify how SOC team members coordinate with one another and communicate with external groups during an incident.
- Security Events Data and SOC Analyst Tools
- In this module, you will identify the types of data a Security Operations Center (SOC) relies on and how security event data fits into SOC monitoring and analysis. You will distinguish SOC-relevant data sources and the kinds of events they produce. You will also review common SOC tools and the key features that support collecting, correlating, and analyzing security data.
- Developing Key Relationships with Internal and External Stakeholders
- In this module, you will identify the external intelligence resources, regulatory bodies, and government and industry organizations a SOC communicates with. You will outline how these relationships support security operations and coordination across stakeholders. You will also describe the key policies, procedures, and governance rules that guide SOC engagement with users, HR, and legal when violations are detected.
- Understanding SOC Metrics
- In this module, you will focus on how SOC metrics are used to measure and communicate SOC effectiveness. You will examine core ideas behind security data aggregation and how it supports consistent reporting. You will explore Time to Detection (TTD) in a network security context and what it indicates about detection performance. You will consider how to describe the detection effectiveness of security controls using SOC-focused metrics.
- Understanding SOC Workflow and Automation
- In this module, you will describe core SOC workflow management system (WMS) concepts and their role in security operations. You will outline how a typical workflow management system is integrated within a SOC. You will describe what SOC WMS integration involves across tools and processes. You will provide an example of how SOC workflow automation is applied in practice.
Taught by
Cisco Learning & Certifications
Related Courses
Related Articles
-
6 Best CompTIA Security+ Courses and Certification Prep in 2026
-
6 Best Courses on CISSP in 2026
-
9 Best Bug Bounty Courses for 2026: Ethical Hacking, Safer Web
-
[2026] Massive List of Thousands of Free Certificates and Badges
-
12 Best Data Analysis Courses for 2026: From Data to Insights
-
6 Best Cyber Threat Intelligence (CTI) Courses in 2026
Reviews
5.0 rating, based on 2 Class Central reviews
4.8 rating at Coursera based on 362 ratings
-
The "Security Operations Center (SOC)" course offered by Cisco via Coursera is an excellent resource for associate-level cybersecurity analysts aiming to enhance their understanding of SOC workflows and automation. The course is structured into modu…
-
This is the best certification for me and I have learned the most basic and crucial information concerning Security Operation Center
