Operations Assessment
Evaluate an existing SOC or NOC against its mission — coverage, detection quality, workflow, staffing — with a prioritized uplift plan.
Security Operations · Flagship Service
SOC Design, Build & Operations
A security operations center is a system of people, process, and detection content — not a product purchase. Ironhawk designs, builds, and operates SOC capability sized to your threat model and staffing reality, and transfers it to your team.
Engagement Methodology
Five Phases, Defined Handover Criteria
The phases below describe a full buildout; assessment-only and uplift engagements use the subset that fits. Scope, client responsibilities, and handover criteria are agreed before build begins.
PHASE 01
Assess
Current state, requirements, threat model, telemetry coverage, and constraints — including the staffing you can realistically hire and retain.
TYPICAL DELIVERABLES: assessment report · target operating model · roadmap
PHASE 02
Design
SIEM and tooling architecture, detection use-case catalog, triage and escalation workflow, staffing and shift model.
TYPICAL DELIVERABLES: design package · use-case catalog · staffing plan
PHASE 03
Build
Platform deployment, log source onboarding, detection engineering, playbooks, and integration with ticketing and escalation.
TYPICAL DELIVERABLES: detection content · playbooks · runbooks
PHASE 04
Operate
Monitoring, triage, tuning, and reporting — operated alongside your analysts as they onboard, against agreed KPIs.
TYPICAL DELIVERABLES: KPI reporting · operational reviews · tuning log
PHASE 05
Transfer
Knowledge transfer, documentation, and handover against the criteria defined at the start — capability stays with you.
TYPICAL DELIVERABLES: transition plan · documentation · training recordsWhat You Receive
Deliverables
Every engagement produces documented, reviewable work product — findings you can act on and hand to the people who need them, from engineers to the board.
Detection built for your environment
Use cases engineered against your threat model and telemetry — not a vendor's defaults.
Workflows that hold up under pressure
Triage, escalation, and reporting your analysts can follow at 3 a.m.
Capability that stays
Build-operate-transfer means the engagement ends with your team running the floor.
Typical Deliverables
- Target operating model and SOC roadmap
- SIEM architecture and tooling design
- Detection use-case catalog and engineered content
- Triage playbooks and escalation procedures
- Staffing and shift model with role definitions
- KPI framework and operational reporting
- Handover documentation and training materials
Engagement Options
Scoped to Where You Are
Each option is scoped and agreed before work begins — including access requirements, client responsibilities, and the deliverables the engagement produces.
Design & Buildout
Project-based delivery from target operating model through deployment, detection content, and go-live.
Build-Operate-Transfer
Ironhawk builds and operates the capability while your team is hired and trained, then transfers it against agreed criteria.
Operations Support
Ongoing engineering and advisory alongside your team: detection tuning, use-case expansion, and operational reviews.
Questions Buyers Ask
FAQs
Should we build in-house, outsource, or combine the two?
It depends on your threat model, your hiring market, and how much operational control you need — and the honest answer requires an assessment, not a sales call. Build-operate-transfer exists precisely for organizations that want in-house capability but cannot staff it on day one. The assessment phase produces a recommendation with the reasoning attached.
How long does a buildout take?
It depends on scope, environment complexity, tooling decisions, and hiring timelines — which is why the engagement starts with an assessment that produces a roadmap with a schedule attached to your specifics. Beware of fixed timelines quoted before anyone has looked at your environment.
Are you tied to a specific SIEM or vendor stack?
Recommendations are driven by your requirements, your existing investments, and your team's ability to operate the platform long-term. Where you already own capable tooling, the design works with it rather than replacing it by default.
What coverage model do you staff for?
The coverage model — hours, shifts, escalation outside staffed hours — is designed to your requirements and risk tolerance during the design phase, and staffed accordingly. It is defined in the operating model rather than promised in advance.
What exactly transfers at handover?
Everything the capability runs on: detection content, playbooks, runbooks, architecture documentation, KPI reporting, and the training your team received along the way. Handover criteria are defined in the design phase so 'done' is measurable, not negotiable.
What happens if we lose analysts after transfer?
Attrition is planned for, not hoped against: the staffing model includes role documentation and cross-training so the capability survives individual departures, and Operations Support engagements can backfill engineering depth while you rehire.
See the shape of the work product: a sample SOC maturity assessment.
View Sample AssessmentStart With the Assessment
An operations assessment gives you the baseline, the roadmap, and the build-versus-buy answer — whatever you decide to do next.