One SOC, The Whole SOC, and Nothing But The SOC, So Help Me

Learn how to properly organize and structure a Security Operations Center (SOC) from a 20-year security operations veteran who identifies the critical mistake that causes most SOCs to struggle. Discover what functions and responsibilities should be included in your SOC, what elements should remain outside its scope, and gain insights into what an effectively organized SOC looks like when implemented correctly. Understand the fundamental organizational principles that separate successful SOCs from those that fail to meet their security objectives. This conference talk from BSidesSF 2025 provides practical guidance for security professionals responsible for designing, managing, or improving SOC operations within their organizations.