Brought in by the Head of Security Operations at one of Europe’s fastest-growing MSSPs, where a rapidly scaling SOC of 30+ analysts was straining under inconsistent triage and rising alert noise - eroding SLAs, consuming analyst time, and denting morale.
The work combined process and engineering: a unified triage methodology for consistent handling, new operational processes to protect SLAs, and a structured detection-tuning framework on a daily/weekly/monthly cadence. Analysts were upskilled to spot tuning opportunities, with a clear escalation path to detection engineers, so the improvements kept compounding after handover.
The tuning programme cut alert volume by 32% - a substantial saving in analyst time across a 30-strong team, and capacity the MSSP could put back into growth rather than chasing noise.
Key Achievements
- Established a unified triage methodology to ensure consistent alert handling
- Implemented new operational processes to improve SLA adherence and client satisfaction
- Led the creation of a structured detection tuning framework (daily/weekly/monthly cadence) to reduce false positives
- Upskilled SOC analysts to identify tuning opportunities and built a clear escalation process for detection engineers
Ready to strengthen your defences?
Whether it's SOC maturity, detection and response, or a security project that needs hands-on delivery - let's discuss how SecurityBakedIn can help.