Cybersecurity and SOC
Build or strengthen a security operations capability: people, process, tooling and the runbooks that make it work at 3 a.m.
A SOC is not a product you buy; it is a team with procedures, tools that fit those procedures, and documentation that lets the night shift act like the day shift. I help organisations build that from where they are, a data centre, a hosting provider, an in-house IT team, without pretending every one needs a Fortune-500 setup.
What I do
- Assess the current state: what is monitored, who reacts, how incidents really flow.
- Design the operating model: roles, shifts, escalation, severity levels, what gets automated.
- Write the runbooks and playbooks, in a form the team will actually keep up to date.
- Select and configure tooling with your engineers, not for them.
- Run tabletop exercises and the first real incident reviews.
Who it's for
Hosting and data-centre providers, managed-service teams, companies that just passed an audit and now have to live up to it.
Background
Thirteen years inside a managed-services provider, from on-call Linux engineer to team manager: incidents, escalations, customer platforms across Mauritius and Asia. I write the procedures I used to live by.