This course readies analysts to work effectively inside a federal Security Operations Center. It serves both people new to SOC work and analysts already doing the job who want to firm up the federal standards and terminology behind their daily practice. What separates it from generic SOC training is that every operational topic — log collection, continuous monitoring, detection engineering, incident response — is grounded in the statutes, policy memoranda, and technical standards that actually govern federal cyber defense.
Sessions are led live by an instructor, so participants can raise agency-specific questions against each requirement as it comes up.
Target Audience
- Federal SOC analysts at Tiers 1–3, CSIRC staff, detection engineers, agency ISSOs who oversee monitoring, IT security staff moving into a SOC role, and contractors supporting federal SOCs.
What You'll Learn at a Glance
- The way FISMA, OMB policy, NIST guidance, and CISA directives interlock to govern federal SOC operations
- SOC organizational models and what Tiers 1 through 3 each own, mapped to the NICE Workforce Framework
- Which log sources a federal SOC is obliged to collect, and what OMB M-26-14 currently requires
- Detection engineering and MITRE ATT&CK coverage mapping, put to work on alert triage and prioritization
- The incident response lifecycle as NIST SP 800-61 Rev. 3 sets it out, alongside the CISA federal response playbooks
- Federal incident reporting obligations, and the route from a SOC finding into RMF and the ATO lifecycle
- SOC performance metrics, the standard toolset, and career pathways keyed to DoD 8140.03
Course Syllabus
- Module 1
- Foundations of Federal Cybersecurity & the SOC Mission
- Module 2
- SOC Team Structure, Roles & Responsibilities
- Module 3
- Log Collection & Federal Logging Standards
- Module 4
- Continuous Monitoring & Detection Engineering
- Module 5
- Incident Response Workflow — NIST SP 800-61 Rev. 3
- Module 6
- Reporting, Coordination & Compliance
- Module 7
- SOC Metrics, Tools & Career Pathways
This course is available for "remote" learning and will be available to anyone with access to an internet device with a microphone (this includes most models of computers, tablets). Classes will take place with a "Live" instructor at the date/times listed below.
Upon registration, the instructor will send along additional information about how to log-on and participate in the class.
