Security operations

Security operations gathers evidence of what is happening across an organisation's systems, turns some of it into alerts, and decides which alerts are real. The team doing this is usually called a security operations centre, whether it sits in one room, spans several time zones or is bought in from a managed provider. Its central instrument is a SIEM, a searchable store of logs with rules that flag suspicious patterns; SIEM products such as Splunk or Microsoft Sentinel are the names that recur in job adverts.

An alert, from arrival to verdict

1. Collection. Logs arrive from identity providers, endpoints, firewalls, cloud control planes and applications. Nothing uncollected can be detected, and data collected without a purpose costs money while burying the rest.
2. Detection. Rules, correlations and behavioural analytics raise an alert when events match a pattern. Writing and tuning those rules is detection engineering, a specialism in its own right.
3. Triage. An analyst decides within minutes whether the alert is noise, a harmless oddity or worth escalating, using context: whose account, which device, what else happened around the same time.
4. Investigation. A confirmed case is scoped: what did the intruder touch, and are they still present? Here the work hands over to incident response.
5. Improvement. Every false positive is a rule to tune and every missed attack a gap to close. Threat hunting, the deliberate search for intruders no rule has caught, feeds this last step.

Security+ gives operations its largest domain, and two specialist exams live entirely here. CySA+ covers monitoring, detection, response and the vulnerability management that fills quieter days, and it assumes several years of analyst experience. Microsoft's SC-200 tests the same work on one vendor's stack and expects fluency in its query language. The free Defender XDR applied skill is a practical assessment, a reasonable way to show an employer you have worked an incident end to end in a lab.

Alert fatigue is a design flaw, not a character flaw

Beginners imagine the job as spotting clever intruders. Most of it is managing volume. A fresh SIEM with default rules produces far more alerts than any team can read, analysts learn to close them on reflex, and the genuine intrusion gets closed along with everything else. What marks out a good analyst is knowing what normal looks like for a particular user or server, which is why people arriving from system administration often overtake those who arrive from courses alone. Learn one log source deeply, such as sign-in events from an identity provider, before learning a dozen shallowly.