# SOC Foundations for Federal Cyber Defense and Operations Course Canonical URL: ## Overview This course readies analysts to work effectively inside a federal Security Operations Center. It serves both people new to SOC work and analysts already doing the job who want to firm up the federal standards and terminology behind their daily practice. What separates it from generic SOC training is that every operational topic — log collection, continuous monitoring, detection engineering, incident response — is grounded in the statutes, policy memoranda, and technical standards that actually govern federal cyber defense. Sessions are led live by an instructor, so participants can raise agency-specific questions against each requirement as it comes up. ## What you'll learn - The way FISMA, OMB policy, NIST guidance, and CISA directives interlock to govern federal SOC operations - SOC organizational models and what Tiers 1 through 3 each own, mapped to the NICE Workforce Framework - Which log sources a federal SOC is obliged to collect, and what OMB M-26-14 currently requires - Detection engineering and MITRE ATT&CK coverage mapping, put to work on alert triage and prioritization - The incident response lifecycle as NIST SP 800-61 Rev. 3 sets it out, alongside the CISA federal response playbooks - Federal incident reporting obligations, and the route from a SOC finding into RMF and the ATO lifecycle - SOC performance metrics, the standard toolset, and career pathways keyed to DoD 8140.03 ## Curriculum #### Module 1 Foundations of Federal Cybersecurity & the SOC Mission #### Module 2 SOC Team Structure, Roles & Responsibilities #### Module 3 Log Collection & Federal Logging Standards #### Module 4 Continuous Monitoring & Detection Engineering #### Module 5 Incident Response Workflow — NIST SP 800-61 Rev. 3 #### Module 6 Reporting, Coordination & Compliance #### Module 7 SOC Metrics, Tools & Career Pathways ## Schedule - Nov 17, 2026 – Nov 18, 2026 — Live Online - Jan 28, 2027 – Jan 29, 2027 — Live Online - Feb 17, 2027 – Feb 18, 2027 — Live Online - Mar 2, 2027 – Mar 3, 2027 — Live Online - Apr 28, 2027 – Apr 29, 2027 — Live Online - May 20, 2027 – May 21, 2027 — Live Online - Jun 7, 2027 – Jun 8, 2027 — Live Online - Jul 26, 2027 – Jul 27, 2027 — Live Online ## Instructors ### Wes Bryan — Instructor Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar. ### Chuck Moore — Instructor With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively. ## Pricing **Tuition:** $1249