Training
Featured CourseView All Courses
Get a free hour of SANS training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
Cloud Security Training
Can't find what you are looking for?

Let us help.

Contact us
Resources
SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

CISO Network

Engage, challenge, and network with fellow CISOs in this exclusive community of security leaders

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations
Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Talk with an expert
Talk with an expert

LDR551: Building and Leading Security Operations Centers

LDR551Cybersecurity Leadership
  • 5 Days (Instructor-Led)
  • 30 Hours (Self-Paced)
Course created by:
John HubbardMark Orlando
John Hubbard & Mark Orlando
Register NowCourse Preview
LDR551: Building and Leading Security Operations Centers
Course created by:
John HubbardMark Orlando
John Hubbard & Mark Orlando
Register NowCourse Preview
  • GIAC Security Operations Manager (GSOM)

    Learn about certification

  • 30 CPEs

    Apply your credits to renew your certifications

  • In-Person, Virtual or Self-Paced

    Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

  • Intermediate Skill Level

    Course material is geared for cyber security professionals with hands-on experience

  • 17 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

Jump to:

Elevate your SOC's strategic defense capabilities through advanced intelligence-driven training that transforms threat management and aligns cybersecurity with critical business objectives.

Featured Quote

There are so many [organizations] that seem to be trying to reinvent the wheel. All they need to do is invest in this course for real world, actionable information that can put them on a solid path toward building, staffing, and leading their own SOC.
Brandi Loveday-Chelsey

Course Overview

LDR551 is a transformative training program designed for senior security leaders who demand more than traditional Security Operations Center (SOC) management. This executive-level course equips technology leaders with advanced intelligence-driven methodologies to proactively defend against sophisticated threat landscapes. Navigate complex cyber environments with a strategic approach that aligns security operations directly with high-stakes organizational objectives.

Key executive outcomes include designing resilient defense strategies tailored to your enterprise's unique risk profile and transforming SOC capabilities from reactive to predictive. Additionally, you'll integrate cyber leadership principles with tactical threat management, while gaining hands-on experience through 17 immersive labs and the Cyber42 leadership simulation game. 

What You’ll Learn

  • Establish mission-driven SOC foundation aligned with organizational goals
  • Develop advanced threat intelligence and detection capabilities
  • Build and empower high-performance security teams
  • Create robust incident response and threat hunting strategies
  • Implement critical metrics for continuous SOC improvement
  • Master team development, retention, and performance optimization
  • Execute comprehensive security assessment through advanced testing methodologies

Business Takeaways

  • Implement strategies for aligning cyber defense to organizational goals
  • Decrease risk profile due to improved security validation tools and techniques
  • Apply methodologies for recruiting, hiring, training, and retaining talented cyber defenders
  • Streamline effective cross-team coordination and collaboration
  • Employ immediate security optimization improvements using current assets
  • Reduce financial spend due to smoother cyber security operations

Meet Your Authors

Slide 1 of 0

Course Syllabus

Explore the course syllabus below to view the full range of topics covered in LDR551: Building and Leading Security Operations Centers.

Section 1SOC Design and Operational Planning

Section 1 introduces the core mission and foundational models of a modern SOC, establishing the strategic and operational context for effective leadership.

Topics covered

  • Cyber Defense Industry Overview
  • SOC Planning Essentials
  • SOC Functional Mapping

Labs

  • Creating a SOC Mission and Charter
  • Critical Asset Mapping
  • Defining SOC Roles

Section 2SOC Telemetry and Analysis

Section 2 of LDR551 focuses on expanding our understanding of attacker tactics, techniques, and procedures and how we might identify them in our environment.

Topics covered

  • Cyber Defense Theory and Mental Models
  • Critical SOC Tools and Technologies
  • SOC Data Collection

Labs

  • Threat Actor Assessment
  • Cyber Attack Threat Modeling and Data Source Assessments
  • ATT&CK Navigator for Technique Prioritization

Section 3Attack Detection, Hunting, and Triage

Section 3 of LDR551 is all about building and improving your threat detection capability.

Topics covered

  • Analytic Frameworks and Tools
  • Threat Detection and Analytic Design
  • The Keys to Efficient Alert Triage

Labs

  • Detection Rule Management and Visualization
  • Use Case Documentation and Structuring
  • Threat Hunting Planning and Execution

Section 4Incident Response

From toolsets to proven frameworks to tips and tricks learned in countless real-world scenarios, section four covers the full response cycle, from preparation to identification to containment, eradication, and recovery, for operations managers.

Topics covered

  • Planning and Preparation for Incident Response
  • Identification and Categorization of Incidents
  • Coordination During Incident Discovery

Labs

  • Incident Response Goals and Teamwork
  • SOC Playbook Development and Implementation
  • Investigation Quality Review

Section 5Metrics, Automation, and Continuous Improvement

The fifth and final section of LDR551 is all about measuring and improving security operations.

Topics covered

  • Staff Retention and Burnout Mitigation
  • Building Your SOC Culture
  • Metrics, Goals, and Effective Execution

Labs

  • Metric Creation, Classification, and Communication
  • Purple Team Assessment Planning and Execution
  • Improving Quality and Resilience

Things You Need To Know

Relevant Job Roles

Cybersecurity Auditor

European Cybersecurity Skills Framework

Perform cybersecurity audits on the organisation’s ecosystem. Ensuring compliance with statutory, regulatory, policy information, security requirements, industry standards and best practices.

Explore learning path

Cybersecurity Architect

European Cybersecurity Skills Framework

Plans and designs security-by-design solutions (infrastructures, systems, assets, software, hardware and services) and cybersecurity controls.

Explore learning path

Cyber Risk Officer

Cybersecurity Leadership

Lead, govern, and manage this risk for your organization.

Explore learning path

Cyber Threat Intelligence Specialist

European Cybersecurity Skills Framework

Collect, process, analyse data and information to produce actionable intelligence reports and disseminate them to target stakeholders.

Explore learning path

Technology Research and Development (OPM 661)

NICE: Design and Development

Responsible for conducting software and systems engineering and software systems research to develop new capabilities with fully integrated cybersecurity. Conducts comprehensive technology research to evaluate potential vulnerabilities in cyberspace systems.

Explore learning path

Cybersecurity Risk Manager

European Cybersecurity Skills Framework

Manage the organisation's cybersecurity-related risks aligned to the organisation’s strategy. Develop, maintain and communicate the risk management processes and reports.

Explore learning path

Media Exploitation Analyst

Digital Forensics and Incident Response

This expert applies digital forensic skills to a plethora of media that encompasses an investigation. If investigating computer crime excites you, and you want to make a career of recovering file systems that have been hacked, damaged or used in a crime, this may be the path for you. In this position, you will assist in the forensic examinations of computers and media from a variety of sources, in view of developing forensically sound evidence.

Explore learning path

Blue Teamer - All Around Defender

Cyber Defense

This job, which may have varying titles depending on the organization, is often characterized by the breadth of tasks and knowledge required. The all-around defender and Blue Teamer is the person who may be a primary security contact for a small organization, and must deal with engineering and architecture, incident triage and response, security tool administration and more.

Explore learning path

SOC Manager

Cyber Defense

Security Operations Center (SOC) managers bridge the gap between business processes and the highly technical work that goes on in the SOC. They direct SOC operations and are responsible for hiring and training, creating and executing cybersecurity strategy, and leading the company’s response to major security threats.

Explore learning path

Cybersecurity Educator

European Cybersecurity Skills Framework

Improves cybersecurity knowledge, skills and competencies of humans.

Explore learning path

Enterprise Architecture (OPM 651)

NICE: Design and Development

Responsible for developing and maintaining business, systems, and information processes to support enterprise mission needs. Develops technology rules and requirements that describe baseline and target architectures.

Explore learning path

Secure Systems Development

NICE: Design and Development

Responsible for the secure design, development, and testing of systems and the evaluation of system security throughout the systems development life cycle.

Explore learning path

Penetration Tester

European Cybersecurity Skills Framework

Assess the effectiveness of security controls, reveals and utilise cybersecurity vulnerabilities, assessing their criticality if exploited by threat actors.

Explore learning path

Digital Forensics Investigator

European Cybersecurity Skills Framework

Ensure the cybercriminal investigation reveals all digital evidence to prove the malicious activity.

Explore learning path

Cybersecurity Researcher

European Cybersecurity Skills Framework

Research the cybersecurity domain and incorporate results in cybersecurity solutions.

Explore learning path

Chief Information Security Officer (CISO)

European Cybersecurity Skills Framework

Manages an organisation’s cybersecurity strategy and its implementation to ensure that digital systems, services and assets are adequately secure and protected.

Explore learning path

Cybersecurity Implementer

European Cybersecurity Skills Framework

Develop, deploy and operate cybersecurity solutions (systems, assets, software, controls and services) on infrastructures and products.

Explore learning path

Course Schedule & Pricing

Looking for Group Purchase Options?Contact Us

GIAC Certification Attempt

Add a GIAC certification attempt and receive free two practice tests. View pricing in the info icons below.

OnDemand Course Access

When purchasing a live instructor-led class, add an additional 4 months of online access after your course. View pricing in the info icons below.

Filter by:
  • Location & instructor

    Virtual (OnDemand)

    Instructed by John Hubbard
    Date & Time
    OnDemand (Anytime)Self-Paced, 4 months access
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Enrollment options
    Self-Paced
  • Location & instructor

    Washington, DC, US & Virtual (live)

    Instructed by John Hubbard
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Enrollment options
    Virtual
  • Location & instructor

    Riyadh, SA & Virtual (live)

    Instructed by Maxim Deweerdt
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,375 USD*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Virginia Beach, VA, US & Virtual (live)

    Instructed by Mark Orlando
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Virginia Beach, VA, US & Virtual (live)

    Instructed by Mark Orlando
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Enrollment options
    In-Person
  • Location & instructor

    Amsterdam, NL & Virtual (live)

    Instructed by Mark Orlando
    Date & Time
    Fetching schedule..View event details
    Course price
    €7,715 EUR*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Las Vegas, NV, US & Virtual (live)

    Instructed by John Hubbard
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,260 USD*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Amsterdam, NL & Virtual (live)

    Instructed by Michael Lamb
    Date & Time
    Fetching schedule..View event details
    Course price
    €7,715 EUR*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
Showing 8 of 13

Learn Alongside Leading Cybersecurity Professionals From Around The World

Slide 1 of 0

Benefits of Learning with SANS

Instructor teaching class with code in the background

Get feedback from the world’s best cybersecurity experts and instructors

Learning via laptop

Choose how you want to learn - online, on demand, or at our live in-person training events

Learning via laptop

Get access to our range of industry-leading courses and resources