A last business post for now. If the SOC is becoming agentic, who should you recruit?<\/p>\n
The traditional SOC was built like a pyramid. Many junior analysts at the bottom handling alerts, fewer experienced ones in the middle doing investigations, and a few experts at the top. The juniors learned by doing the routine work, and some of them became the experts of tomorrow.<\/p>\n
Agents are taking over the bottom of the pyramid. That creates two problems. Where do the future experts learn, if the routine work is gone? And what skills do we need now?<\/p>\n
Here is what I would look for. People who understand how attacks really work, not just how tools display them. People who can supervise automation: read what an agent did, judge if it was right and improve it. People with business understanding, who can weigh security against operations. Engineers who can build and maintain playbooks, detections and integrations. And people who communicate well, because explaining risk is becoming a bigger part of the job.<\/p>\n
Keep hiring juniors. But give them a different path: let them learn alongside the agents, review their work and work on the hard cases with a senior. Otherwise there will be no seniors in ten years.<\/p>\n
And look for every kind of mind, as I wrote in 2024. The person who notices half a second is still the one who finds what the agents miss.<\/p>\n
Compliance plays in here too. The new cybersecurity act requires training for management and staff. Make it part of the plan, not a checkbox.<\/p>\n
Recruit for judgement. The machines bring the speed.<\/p>\n","protected":false},"excerpt":{"rendered":"
A last business post for now. If the SOC is becoming agentic, who should you recruit? The traditional SOC was built like a pyramid. Many junior analysts at the bottom handling alerts, fewer experienced ones in the middle doing investigations, and a few experts at the top. The juniors learned by doing the routine work, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[11,4],"tags":[38,207,208],"class_list":["post-1547","post","type-post","status-publish","format-standard","hentry","category-business","category-security-architecture","tag-business","tag-recruiting","tag-skills"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1547","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1547"}],"version-history":[{"count":1,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1547\/revisions"}],"predecessor-version":[{"id":1548,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1547\/revisions\/1548"}],"wp:attachment":[{"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1547"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1547"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowmoor.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1547"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}