24/7 SOC, delivered as a managed service
A functional Security Operations Center is hard to build in-house for most organizations. Twelve-plus full-time analysts, best-in-category tooling, mature detection engineering, and a response discipline that is tested under pressure — all of that costs $3-5M per year fully loaded and takes 18+ months to reach operational maturity.
Our managed SOC service delivers the same capability on a scope- and budget-based engagement. The analysts are ours; the detection engineering is ours; the tooling is either ours or the client's depending on the architecture; the incident response is shared and documented.
What the engagement covers
24/7 monitoring across the full stack
- Cloud. AWS, Azure, GCP — CloudTrail, Azure Activity, GCP Audit, plus cloud-native threat detection.
- Endpoint. EDR telemetry from CrowdStrike, SentinelOne, Defender, or whichever platform the client runs.
- Identity. Entra, Okta, Ping, AD sign-in and authorization events.
- Network. Firewall, IDS/IPS, DNS, proxy logs where applicable.
- Application. Custom application logs for high-value applications.
Detection engineering
The difference between a working SOC and a noisy SOC is detection engineering. Our engineers tune detection rules to the client's environment and threat profile, continuously. Generic detection content produces 10:1 false-positive ratios that exhaust analyst time; tuned detection content produces signal the analyst acts on. Detection engineering is a monthly cadence, not a one-time setup.
Tier-1 and tier-2 triage
Analysts triage incoming alerts, validate or dismiss, and escalate confirmed incidents via documented paths. The goal is that every alert reaches a human within SLA and every confirmed incident reaches the right owner within the client's IR plan.
Incident response support
On a confirmed incident, we execute the agreed scope — containment, evidence preservation, forensics support, remediation coordination — and hand off to the client's IR lead or our IR team per the engagement terms. For clients who want full IR coverage, we deliver that under an expanded scope.
Threat intelligence
Curated feeds applied to the client's environment. Not every feed helps every client; we filter for relevance and tune the IOC matching to avoid noise.
SOAR and automation
Common response actions are automated — isolate endpoint, disable account, block IOC, open ticket with context attached. Automation is scoped and reviewed per client; we do not ship aggressive auto-response to environments that cannot tolerate a false positive.
Reporting
Monthly operational report with alert volume, incident count, mean time to detect and contain, detection engineering changes, and threat-landscape commentary. Quarterly detection review that covers new threat categories and recommended changes to the detection scope.
Onboarding
4-6 weeks typical. The work:
- Week 1. Tooling integration. Pull telemetry from SIEM, EDR, identity, cloud, and network sources into our platform (or integrate with the client's platform).
- Weeks 2-3. Detection tuning. Baseline the environment; tune existing rules; add client-specific detections.
- Week 4. Playbook development. Document escalation paths, IR handoffs, and automation scope per incident class.
- Weeks 5-6. Shadow mode. Run the SOC in parallel with existing operations; validate signal; tune further.
Cut-over to production is an event, not a slide. After cut-over, the monthly tuning cadence keeps the program improving.
Who this fits
Most of our managed SOC engagements are mid-market to enterprise organizations where:
- The economics of 12+ full-time analysts do not work.
- Compliance obligations require 24/7 monitoring (HIPAA, PCI-DSS, SOC 2, state privacy laws).
- The talent market is not producing SOC analysts at the comp the organization can offer.
- The internal security team exists but is thin on operational staffing.
For the deeper comparison of managed versus in-house versus hybrid, see the managed SOC vs in-house comparison.
The hybrid posture
Many of our enterprise clients run hybrid — our SOC handles 24/7 tier-1 and tier-2 with integrated detection engineering; the client's team owns security engineering, threat hunting, IR leadership, vendor oversight, and strategic direction. The boundary is documented; the handoffs are practiced; the relationship improves year over year.
Why Thoughtwave
- Detection engineering depth, not just alert-forwarding.
- Shared-responsibility model documented, not ambiguous.
- Regulated-industry experience — HIPAA, PCI-DSS, SOC 2, state privacy.
- MBE and GSA-approved.
For the broader cybersecurity practice, see the Cybersecurity Solutions service. To start a conversation, book a consultation.