LogFAQs > #968375603

MFBKBass5 posted...

Haha yeah that makes sense. I guess a good SOC team would have a fair amount of downtime if things are built correctly from the ground up too though, right?

Yeah once all of your monitoring systems are fine tuned and reporting properly there would be potential downtime. You'd have to stay on top of zero day vulns that pop up in the news and pester whatever sysadmin/engineers managing those systems to fix the vulns. Depending on the company and the amount of support your team has though, there might not be a lot of reason for the IT guys to listen to you. InfoSec doesn't have a lot of authority to make other teams fix their shit. They can only inform them.

You'd also want to be part of new projects to ensure whatever the teams plan to roll out is approved from a security standpoint.