Building & Operating a Modern SOC: From Charter to Capability Roadmap
2–3 November 2026 • Hyatt Place, Westlands • USD 1,250 per participantThis 2-day intensive workshop provides a comprehensive, practitioner-focused guide to planning, building, and operating a modern Security Operations Center (SOC). Participants will gain a solid understanding of SOC governance, detection engineering, triage and investigation workflows, incident response integration, and performance measurement. Designed for security leaders, SOC managers, analysts, and IT professionals, the workshop emphasizes practical frameworks, structured templates, and hands-on exercises that participants can immediately apply within their organizations.
Overview
The workshop begins with the strategic foundations of the SOC: its mission, governance structure, operating model, and telemetry collection strategy. Participants then move into the operational core of SOC work: threat-driven detection engineering, detection quality management, structured triage and investigation, and incident response integration. The program concludes with SOC resilience design, AI-augmented operations, performance metrics, and the development of a phased capability roadmap.
The program follows a lifecycle-driven model: Planning → Collection → Detection → Triage → Investigation → Response → Continuous Improvement — and is framework-driven, vendor-neutral, and tool-informed, exposing participants to widely adopted industry reference tools and structured templates.
By the end of the workshop, participants will have drafted a SOC charter, designed an escalation model, built a telemetry onboarding roadmap, mapped attack scenarios to detection logic, developed an incident response playbook, defined a SOC KPI framework, and consolidated these outputs into a phased 90-day and 12-month capability roadmap. Each day combines strategic guidance with practical application, ensuring participants leave with actionable artifacts they can immediately use in their organizations.
Introduction
This workshop will cover the core principles, methodologies, and practices required to establish or mature a Security Operations Center. You will learn how SOCs are governed, structured, and operated, while gaining practical knowledge in detection engineering lifecycle management, detections-as-code concepts, alert triage, hypothesis-driven investigation, incident response playbook design, and SOC performance measurement.
Throughout the workshop, you will work through guided exercises using structured templates; including SOC charter templates, RACI matrices, log source prioritization matrices, detection design worksheets, ATT&CK Navigator coverage mapping, playbook templates, and KPI dashboards. You will gain exposure to industry-relevant frameworks and reference tools used by mature security operations teams worldwide, and you will receive resources and guidance to continue developing your SOC capability beyond the training.
These interactive sessions are designed to strengthen your ability to align SOC operations with institutional priorities and regulatory requirements, improve detection quality and measurability, and design a SOC that is resilient against modern challenges, including encrypted traffic limitations, cloud and identity-centric attacks, AI-enabled threats, and attacks targeting SOC tooling itself. The workshop encourages collaboration, discussion, and knowledge sharing, enabling participants to learn from both the instructor and fellow professionals from diverse backgrounds.
By the end of this workshop, you will understand how to define a SOC mandate and governance model, prioritize telemetry collection, engineer and continuously improve detections, run structured investigations, integrate incident response, measure SOC performance, and plan a phased maturity roadmap. This workshop is ideal for CISOs, SOC managers, security analysts, detection engineers, incident responders, and IT leaders responsible for building or improving security operations capabilities.
Pre-requisities
A basic understanding of information security concepts, IT infrastructure, and networking fundamentals is recommended. Familiarity with security monitoring tools (such as SIEM platforms) or incident handling can be beneficial but is not required. No prior experience in building or managing a SOC is necessary.
Who Is This Workshop For?
This workshop is designed for professionals and decision-makers responsible for establishing, managing, or improving security operations capabilities. It is particularly useful for:
- CISOs and security leaders planning to establish or restructure a SOC
- SOC managers and team leads seeking to mature existing operations
- Security analysts (Tier 1–3) looking to strengthen triage and investigation practices
- Detection engineers and threat hunters developing structured detection programs
- Incident responders integrating response processes into SOC workflows
- IT managers and infrastructure leaders supporting security monitoring initiatives
- Risk, compliance, and governance professionals responsible for security monitoring obligations
- MSSP professionals and consultants delivering SOC services to clients
What Will You Learn?
By completing this workshop, you will gain a practical understanding of how to plan, build, and operate a measurable and resilient Security Operations Center aligned to organizational priorities.
You will learn:
- How to define a SOC mission, charter, governance structure, and tiered operating model
- How to design escalation workflows, severity classification, and role responsibilities
- How to build a detection-driven telemetry strategy with phased log onboarding priorities
- The detection engineering lifecycle — design, validation, deployment, tuning, and continuous improvement — including detections-as-code concepts
- How to classify, enrich, and tune alerts to systematically reduce false positives
- Structured triage and hypothesis-driven investigation methodologies with proper case documentation
- How to design incident response playbooks and integrate response into SOC workflows
- How to secure the SOC itself against modern threats, including attacks on monitoring infrastructure
- How to responsibly adopt AI-augmented and agentic workflows in SOC operations
- How to define SOC metrics (MTTD, MTTR, detection quality KPIs) and build a phased 90-day and 12-month capability roadmap
Business/Organization Benefits
Organizations that invest in structured SOC capabilities gain measurable improvements in threat detection, response speed, and operational resilience.
This workshop will help your organization:
- Establish or mature a SOC using proven, framework-driven approaches rather than costly trial and error
- Align security monitoring with regulatory obligations, risk priorities, and institutional mandates
- Improve detection quality and reduce alert fatigue through structured tuning and quality management
- Accelerate incident response with well-designed playbooks and clear escalation paths
- Demonstrate SOC value to executives through meaningful metrics and reporting frameworks
- Reduce dependency on external consultants by developing internal SOC design expertise
- Prepare for emerging challenges including cloud attacks, identity-centric threats, and AI-enabled adversaries
- Leave with reusable artifacts — charters, matrices, roadmaps, and playbooks tailored to your organization
Requirements
A basic understanding of information security and IT concepts is recommended. No prior SOC management experience is required.
For the best learning experience, participants are encouraged to bring their own laptop to work on the guided templates and exercises throughout the workshop. Individuals without suitable hardware can follow along using provided worksheets and the instructor's guided walkthroughs.
General Information
- Certificate of attendance is included in the price of the training course fees
- All workshop templates and frameworks are provided to participants for continued use after the training
Trainer Profile
Marvin Ngoma is a cybersecurity leader, author, and security evangelist. He specialises in security operations, detection engineering, threat detection and response, and the strategic design of Security Operations Center capabilities.
He holds a Master of Computer Science & Engineering from Chalmers University of Technology, a Masters of Science in Information Security from Luleå University of Technology, both in Sweden. He also holds a bachelor of Computer Science from the University of Zambia. His professional certifications include Certified Information Systems Security Professional (CISSP), GIAC Security Operations Manager Certification (GSOM), Elastic Certified SIEM Analyst, among others.
A seasoned consultant with experience spanning both the private and public sector in Europe, Middle East and Africa (EMEA), Marvin has led numerous engagements architecting and building security operations and intelligence capabilities for organizations, unifying tools, processes, and people into measurable, sustainable programmes. He works with organizations throughout EMEA on how best to create security value, bridging strategic governance requirements, including regulatory drivers such as PCI DSS, NIS2, etc, with hands-on operational detection and response practice.
Marvin is a regular speaker and educator in the international cybersecurity community. He has presented at conferences including the ACDF Forum, Nordic Cyber Summit, BSides events across Africa and Europe, among others. He is a published author, writing on threat intelligence integration, context-driven security, practical realities of generative AI in threat detection and response, analyst alert fatigue reduction, and large-scale cyber defense exercises such as NATO's Locked Shields, and has appeared on industry podcasts discussing AI in security operations.
At ACDF 2026, Marvin will lead the Building & Operating a Modern SOC: From Charter to Capability Roadmap workshop, combining strategic governance guidance with hands-on operational methodologies to help participants build sustainable, measurable, and resilient security operations capabilities.
Workshop Itinerary
Day 1 [MORNING]:
SOC Foundations — Mission, Governance, Operating Model & Telemetry Strategy
We begin with the strategic foundations of the SOC: its institutional mandate, governance structure, and daily operating model, followed by a detection-driven approach to telemetry collection.
- Welcome and workshop overview
- SOC mandate, institutional role, and constituency mapping
- Governance structure, steering committee, and regulatory monitoring alignment
- Tiered SOC structure, roles, responsibilities, and escalation workflows
- Detection-driven telemetry strategy and identity-first monitoring
- Log onboarding prioritization, data quality, and normalization
- Hands-on: Draft SOC mission and charter; design escalation matrix; build phased telemetry onboarding roadmap
DAY 1 [AFTERNOON]:
Threat-Driven Detection Engineering & Detection Quality
The afternoon focuses on the full detection lifecycle — from threat-informed design through validation, deployment, tuning, and continuous improvement.
- Threat-informed detection strategy and coverage modeling with ATT&CK Navigator
- Detection engineering lifecycle: design, validation, deployment, tuning, improvement
- Detections-as-code concepts: versioning, testing, auditability
- Threat intelligence as input to detection development and enrichment
- Alert classification (True Positive / False Positive / Benign Positive / Undetermined) and outcome tagging
- Detection tuning methodology and the continuous improvement loop
- Hands-on: Map an attack scenario to detection logic and telemetry requirements; alert classification and tuning simulation
DAY 2 [MORNING]:
Triage, Investigation & Incident Response Integration
Day two moves into the operational heart of the SOC: structured triage, hypothesis-driven investigation, and integrated incident response.
- Alert prioritization models and investigation methodology
- Hypothesis-driven analysis, structured decision-making, and case documentation standards
- Coordination with digital forensics and specialized investigation functions
- Incident response lifecycle: containment, eradication, recovery
- Playbook design principles and post-incident improvement cycle
- Hands-on: Investigation decision-tree walkthrough with case documentation; build a phishing or credential-compromise response playbook
Day 2 [Afternoon]:
Resilient & Future-Ready SOC — Metrics, AI Augmentation & Capability Roadmap
The final session addresses modern SOC challenges, AI-augmented operations, performance measurement, and consolidates all workshop outputs into a phased capability roadmap.
- Encrypted traffic visibility limitations; cloud and identity-centric attacks
- AI-enabled threats, attacks targeting SOC tooling, and monitoring the monitoring systems
- AI-assisted investigation, automation vs augmentation, and phased AI adoption
- SOC metrics: MTTD, MTTR, detection performance, analyst workload, executive KPIs
- Advanced capability expansion: threat hunting, threat intelligence, purple teaming, digital forensics
- Hands-on: Identify controls to secure SOC infrastructure; identify 3 safe AI augmentation opportunities; build SOC KPI framework and phased 90-day / 12-month capability roadmap
- Wrap-up: consolidating workshop artifacts and next steps
