They say modern SOCs are drowning in alerts. But what if the real problem is not the tools, it is the lack of strategy and unification?In this episode of the podcast, Amy Tom sits down with Reza Adineh, SOC Architect and Detection Engineer, to break down why today’s security operations models are fundamentally misaligned and what to do about it. Reza introduces his new framework, UTIOM - Unified Threat Informed Operational Model, designed to bring strategy, visibility, detection, and response into one cohesive cycle.In this episode, you'll learn: 👉 Why most SOCs operate like “alert factories” and how that leads to burnout and false positives 🎯 What it really means to protect your “crown jewels” and align detection to real threats 🔁 Why strategy must guide tools, automation, and response, not the other way around 🚀 How to communicate a unifying security vision across a 100 person SOC teamIf your SOC feels siloed, overwhelmed, or disconnected from the business it is meant to protect, this episode will challenge how you think about security operations and give you a blueprint to unify it.Relevant Links:Learn more about UTIOM: https://utiom.de/what-is-utiom/Follow Reza on LinkedIn: https://www.linkedin.com/in/rezaadineh/Follow Reza on GitHub: https://github.com/ReZaAdineHTimestamps:00:00 Why is the current SOC operating model fundamentally broken? 10:00 What does unification look like in practical terms inside a SOC? 12:31 What does strategy actually look like in a real world example? 18:17 How should a SOC analyst think about protecting crown jewels day to day? 23:13 How do you unify strategy across a 100 person SOC team? 24:06 How should detection engineers prioritize their rules? 25:40 If starting from scratch, what should you prioritize first? 27:10 How do you ensure every SOC team member truly understands the strategy?

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related