Security Operations Management

Course Description

Security Operations Management covers the core network security concepts and techniques needed in a Security Operations Center (SOC) environment — monitoring, detecting, analyzing, and responding to threats on a network using a variety of security tools.

Within the SCNS taxonomy, CIS is the Computer Information Systems prefix. Daytona State publishes this at 3 credits, prerequisites CET1600 and CIS2350, offered fall, giving approximately 45 contact hours.

The SOC analyst role is the most common entry point into professional cybersecurity, and this course is aimed squarely at it. The work is fundamentally about distinguishing signal from noise — a monitored network generates enormous volumes of events, almost all benign, and the analyst's job is to find the small number that matter and act on them quickly enough to matter.

Learning Outcomes

Required Outcomes

• Describe the SOC's function, structure, and tiered analyst roles.
• Describe the security monitoring architecture and the data sources it depends on.
• Describe log sources, log formats, and the value of each for detection.
• Operate a security information and event management (SIEM) platform.
• Write and tune queries and correlation rules to detect suspicious activity.
• Analyze network traffic and interpret packet captures.
• Analyze endpoint telemetry and describe endpoint detection and response.
• Apply the attack lifecycle and adversary behaviour frameworks to observed activity.
• Map observed techniques to a recognized adversary technique framework.
• Triage alerts and prioritize by severity, confidence, and asset criticality.
• Distinguish true positives, false positives, and benign anomalies.
• Investigate an alert systematically and document the reasoning.
• Apply threat intelligence and indicators of compromise appropriately.
• Describe the incident response lifecycle and the analyst's role in each phase.
• Escalate incidents correctly and communicate technical findings clearly.
• Describe containment, eradication, and recovery actions.
• Apply evidence handling and preservation principles.
• Describe common attack types and their detectable signatures.
• Describe malware behaviour and basic analysis at an introductory level.
• Describe vulnerability management and its relationship to monitoring.
• Write clear incident documentation and reports.
• Describe legal, regulatory, and privacy obligations affecting monitoring.

Optional Outcomes

• Describe threat hunting as a proactive discipline.
• Describe security orchestration and automation.
• Describe cloud security monitoring.
• Describe detection engineering and rule development.
• Describe purple teaming and detection validation.
• Prepare for a SOC analyst certification.

Major Topics

Required Topics

• SOC function, structure, and roles
• Monitoring architecture and data sources
• Logs: sources, formats, and detection value
• SIEM operation
• Queries, correlation, and rule tuning
• Network traffic and packet analysis
• Endpoint telemetry and EDR
• The attack lifecycle and adversary frameworks
• Technique mapping
• Alert triage and prioritization
• True positives, false positives, and anomalies
• Systematic investigation and documentation
• Threat intelligence and indicators
• The incident response lifecycle
• Escalation and communication
• Containment, eradication, and recovery
• Evidence handling and preservation
• Common attacks and their signatures
• Malware behaviour
• Vulnerability management
• Incident reporting
• Legal, regulatory, and privacy obligations

Optional Topics

• Threat hunting
• Orchestration and automation
• Cloud security monitoring
• Detection engineering
• Purple teaming
• Certification preparation

Resources & Tools

• Blue Team Handbook: SOC, SIEM, and Threat Hunting (Don Murdoch) — practical and written for this exact role.
• Applied Network Security Monitoring (Sanders & Smith) and Practical Packet Analysis (Sanders) — the standard references for the traffic analysis half.
• MITRE ATT&CK (attack.mitre.org) — free, and the framework the industry uses to describe adversary behaviour. Learn to navigate it; it appears in job interviews.
• Wireshark — free, the standard packet analyser, and the single most valuable tool to become fluent in.
• Security Onion — free and open-source; a complete monitoring stack you can run in a virtual machine and practise on.
• Elastic Stack, Splunk Free, and Wazuh — free tiers sufficient to learn SIEM query and rule writing.
• Malware-Traffic-Analysis.net — free real packet captures of actual infections with exercises. Outstanding practice material.
• CISA (cisa.gov) — free advisories, the Known Exploited Vulnerabilities catalog, and incident response guidance.
• NIST SP 800-61 — free; the incident handling guide the field's procedures derive from.
• LetsDefend and Blue Team Labs Online — SOC-specific practice platforms with free tiers; Cisco CyberOps Associate and CompTIA CySA+ are the aligned certifications.

Career Pathways

• SOC analyst (Tier 1) — the direct destination and the most common entry point into professional security.
• Security analyst — in-house security teams at any organization of size.
• Incident response analyst — the escalation path from SOC work.
• Threat intelligence analyst.
• Detection engineer — writing and tuning the rules rather than working the queue; a well-paid progression.
• Threat hunter — proactive investigation, typically after SOC experience.
• Digital forensics analyst — with additional training.
• Managed security service provider — MSSPs hire in volume and are a realistic first employer.
• Government and defence — Florida has substantial federal, defence, and space-sector security work, much of it requiring clearance eligibility.
• SOC codes 15-1212 Information Security Analysts. Demand is genuinely strong; see the honest note below about what the entry role actually involves.

Special Information

⚠ The honest picture: SOC work is shift work, and alert fatigue is the occupational hazard

Career reality a course should state plainly, because the gap between how cybersecurity is marketed and how the entry role feels is wide.

• SOCs run continuously. Attacks do not observe business hours, so Tier 1 analyst positions commonly involve shifts, nights, weekends, and rotating schedules. This is the single most common surprise for new analysts.
• Most alerts are not incidents. The overwhelming majority of what you investigate will be benign, and the work is repetitive by design — the rare genuine detection is what the repetition exists to find.
• Alert fatigue is real and documented. High volumes of low-value alerts produce desensitization, and desensitization is how a genuine detection gets closed as noise. It is an industry-wide problem and it is the reason tuning matters as much as detection.
• Burnout is a recognized issue in the field, driven by volume, shift work, and the asymmetry of the job — nobody notices the attacks you stopped, and everybody notices the one you missed.
• It is nonetheless a good entry point. A year or two in a SOC builds pattern recognition that cannot be acquired any other way, and it is the standard springboard into incident response, detection engineering, threat hunting, and forensics — all of which pay better and have better hours.
• Document as you go and build a personal knowledge base of investigations. It makes you faster, and it is what demonstrates capability when you apply for the next role.
• Certifications matter for hiring in this field more than in most of computing. Security+, CySA+, and Cisco CyberOps Associate are the realistic entry credentials.

⚠ Tuning is the job as much as detecting is

The operational insight that separates an analyst who improves a SOC from one who merely staffs it.

• A detection rule that fires constantly is worse than no rule, because it trains everyone to ignore that alert — and the ignoring generalizes.
• Every false positive should produce an action: tune the rule, add an exclusion, enrich the alert with context, or document why it is expected. Closing it without changing anything guarantees you will see it again tomorrow.
• Understand the environment before tuning. An exclusion added without understanding why the activity is benign can create a blind spot an attacker can hide in — attackers deliberately mimic normal administrative behaviour for this reason.
• Baseline first. Detection depends on knowing what normal looks like for this network, and normal differs between organizations.
• Enrichment beats volume. An alert carrying asset criticality, user context, and prior history is triaged in a minute; a bare alert takes twenty.
• Measure the queue. Alert volume, time to triage, and false positive rate are the metrics that show whether the SOC is improving or drowning.
• Escalate uncertainty rather than closing it. The correct response to "I am not sure" is escalation, and a SOC culture that punishes escalation produces missed incidents.

⚠ Investigate systematically — and write it down as you go

• Start from the alert and establish the facts — what fired, on what asset, for which user, at what time, and what the surrounding activity looks like. Resist forming a conclusion before gathering context.
• Build a timeline. Nearly every investigation resolves into a sequence of events, and constructing it in order is what makes the picture legible.
• Pivot on indicators — an IP, a hash, a domain, a user, a process — and look for related activity elsewhere. A single alert is rarely the whole story.
• Map to technique. Describing what happened in MITRE ATT&CK terms makes it comparable, communicable, and searchable against threat intelligence.
• Preserve evidence before you change anything. Volatile data is lost on reboot, and remediating an endpoint destroys the record of what happened. Capture first where the situation permits.
• Document contemporaneously. Investigation notes written afterwards are less accurate and, if the incident becomes a legal matter, less defensible.
• Write for the reader. An incident report goes to people who were not there and frequently are not technical — state what happened, what the impact was, what was done, and what should change.
• Know when it stops being a technical matter. Confirmed breaches trigger legal, regulatory, and notification obligations — under Florida's Information Protection Act, § 501.171, F.S., among others — and the analyst's job at that point is to escalate, not to decide.

⚠ Monitoring is surveillance — the privacy and legal boundaries are real

Content that security courses frequently omit and that a professional needs.

• Security monitoring means reading other people's activity. That capability requires authorization, a defined purpose, and restraint — and it is a genuine ethical position rather than a formality.
• Access what the investigation requires and no more. Curiosity-driven access to a colleague's mail or files is a firing offence and, in regulated environments, a reportable breach.
• Employers must have a policy and notice. Monitoring generally requires that users have been informed, and banners and acceptable use policies exist for that reason.
• Wiretap and interception law applies to content. Federal law and Florida's Chapter 934 restrict interception of communications; provider and consent exceptions are what make network monitoring lawful, and they have limits.
• Regulated data carries extra duties — health information under HIPAA, student records under FERPA, and payment data under PCI DSS each constrain what may be collected, retained, and shared.
• Log retention is a policy decision with both investigative and privacy consequences, and it is frequently set by regulation.
• You will see things. Analysts encounter evidence of misconduct unrelated to security. Follow the escalation path rather than acting independently, and do not discuss it.

⚠ Only about three Florida institutions carry this number — hedge accordingly

This course appears at roughly three institutions statewide. Content, credit value, and emphasis vary more than they would for a widely taught course. Read your own institution's catalog description and syllabus rather than assuming this guide describes your section exactly, and have any transfer evaluated in writing.

How Florida course levels affect transfer

The first digit of an SCNS number denotes the year of offering, not transferability. Courses at the 1000 and 2000 levels transfer transparently between Florida public institutions, and 3000 to 4000 is unproblematic since both are upper division. The boundary that actually matters is 2000 to 3000, where lower-division credit generally cannot satisfy an upper-division requirement.

CIS2121 is 3 credits and approximately 45 contact hours, offered fall. Expect hands-on laboratory work — SIEM queries, packet analysis, alert triage exercises, and a written incident investigation — which is the correct assessment for a role defined by practice. Build a home lab: Security Onion and free SIEM tiers run in a virtual machine, and the practice compounds.

The course transfers on the ordinary lower-division basis. Computing A.S. degrees are applied and do not carry the A.A.'s guaranteed junior-status transfer, though Florida institutions publish B.S. in Information Technology pathways. For this field specifically, certifications and demonstrable hands-on ability weigh heavily alongside the transcript.