Brought in by the Head of Security Operations at one of Europe’s fastest-growing MSSPs, where a rapidly scaling SOC of 30+ analysts was straining under inconsistent triage and rising alert noise - eroding SLAs, consuming analyst time, and denting morale.
The work combined process and engineering: a unified triage methodology for consistent handling, new operational processes to protect SLAs, and a structured detection-tuning framework on a daily/weekly/monthly cadence. Analysts were upskilled to spot tuning opportunities, with a clear escalation path to detection engineers, so the improvements kept compounding after handover.
The tuning programme cut alert volume by 32% - a substantial saving in analyst time across a 30-strong team, and capacity the MSSP could put back into growth rather than chasing noise.
Key Achievements
- Established a unified triage methodology to ensure consistent alert handling
- Implemented new operational processes to improve SLA adherence and client satisfaction
- Led the creation of a structured detection tuning framework (daily/weekly/monthly cadence) to reduce false positives
- Upskilled SOC analysts to identify tuning opportunities and built a clear escalation process for detection engineers
Tell us what you're working on.
Whether it's a noisy SOC, detections you don't trust, an untested response plan or a security project that needs delivering, a short call is the quickest way to work out what to do next.
Free 30-minute call · No obligation · Speak directly with the person who'd do the work