Security Operations Centre (SOC) Management (IMCS-012) Training Course

Security Operations Centre (SOC) Management

A security operations centre monitors, detects and responds to cyber threats around the clock. Building and running an effective SOC requires the right people, processes…

5 daysClassroom or online

15Upcoming dates

6Cities

£2,750Fees from

Course overview

Why Attend

A security operations centre monitors, detects and responds to cyber threats around the clock. Building and running an effective SOC requires the right people, processes, technology and metrics.

This LLMI course covers SOC models, people and skills, processes and playbooks, SIEM and security tooling, threat detection use cases, triage and escalation, incident handling, metrics and continuous improvement, and outsourcing decisions. Participants design SOC processes and performance measures.

The course suits security managers and analysts building or improving SOC capabilities.

Course Objectives

Explain SOC functions and operating models

Define SOC roles, skills and staffing

Design SOC processes and playbooks

Use SIEM and security tools effectively

Manage alert triage and escalation

Measure and improve SOC performance

Target Audience

SOC managers and team leads

Security analysts

Information security managers

IT operations managers

Managed security service staff

CISOs

Course Methodology

Process design workshops

Tool demonstrations

Case studies

Playbook exercises

Metrics discussions

Course outline

1Day 1: SOC Fundamentals

Purpose of a SOC
Operating models
In-house versus managed
Maturity levels
Business case
Exercise: SOC maturity review

2Day 2: People and Processes

Roles and tiers
Skills and training
Shift models
Processes
Playbooks
Workshop: Playbook design

3Day 3: Technology

SIEM
EDR and XDR
SOAR and automation
Threat intelligence feeds
Log sources
Demonstration: SIEM workflow

4Day 4: Detection and Response

Use-case development
Alert triage
Escalation
Incident handling
Threat hunting links
Simulation: Alert triage

5Day 5: Performance and Improvement

SOC metrics
Reporting
Reducing alert fatigue
Continuous improvement
Outsourcing management
Capstone: SOC improvement plan

Frequently asked questions

How long is the Security Operations Centre (SOC) Management course?

The course runs over 5 days of classroom training, usually Monday to Friday.

When is the next Security Operations Centre (SOC) Management course?

The next public date is 16 - 20 Nov 2026 in Amsterdam. There are 15 upcoming dates in total.

Where is this course held?

Upcoming sessions run in Amsterdam, Paris, Barcelona, London, Munich, Istanbul.

Can I take Security Operations Centre (SOC) Management online?

Yes. Every date can also be joined live online in a virtual classroom with the trainer, for £1,280 per participant. Choose "Live online" in the dates table when you register.

How much does the course cost?

Fees start from £2,750 per delegate, depending on the city. Fees include tuition and course materials.

Do participants receive a certificate?

Yes. Delegates who complete the course receive a London Leadership Management Innovation certificate of completion.

Can this course be delivered in-house for our team?

Yes. LLMI can tailor and deliver this course privately for your organisation at your premises or in one of our training cities.

Course information last updated 14 November 2026.

Security Operations Centre (SOC) Management

Course overview

Course outline

Dates and fees

Frequently asked questions

More IT Management and Cyber Security courses

AI Security: Protecting Machine Learning Systems

Application Security and Secure Software Development

Artificial Intelligence (AI) in Cyber Forensics: Investigating Advanced Cyber Crimes

Training a team?