Governed cyber workforce

Build a specialist cyber workforce, not one enormous agent.

Start with the focused 12-persona regulated SOC suite, then inspect its source roles, defensive skills and workflow handoffs. Runtime scope, evidence, tools and accountable human decisions remain explicit throughout.

12SOC suite

46Source roles

08Skills

08Workflows

Regulated SOC product profile

Twelve specialists. One evidence model. Consequential authority stays human.

A focused Agentic SOC workforce for regulated organisations, particularly banks and payment providers. Personas compose existing OPEN-SOC roles; they do not create standing permissions or a cybersecurity super-agent.

12personas

03team patterns

L2maximum

Command

Investigation Lead and Incident Commander

Specialists

Nine narrow operational and banking roles

Assurance

Independent Quality and Safety Reviewer

Shared services

Evidence, knowledge, cases, policy and tools

Tier A

Core SOC

Build first

A credible minimum product for investigation, detection, hunting, command and independent safety review.

01SOC Investigation LeadCorrelate multi-source evidence into a defensible account of what occurred, what is affected and what decision is needed next.L1-L2

Owns

investigation planning
competing hypotheses
evidence timeline
impact assessment
specialist coordination

Does not own

production containment approval
legal notification decisions
public attribution
employee misconduct conclusions

Knowledge packs

organisation context
incident playbooks
mitre attack
previous incidents

Signature outputs

investigation plan
evidence timeline
case narrative

May read

telemetry.search
identity.events.read
asset.context.read
case.evidence.read
threat.intelligence.read

May propose

case.task.create
response.action.propose

Prohibited capabilities

endpoint.network.isolate
identity.account.disable
network.indicator.block
evidence.record.delete

Composes OPEN-SOC roles: functional.investigation-planner · functional.correlation-timeline · functional.hypothesis-tester · functional.incident-synthesizer

02Splunk-first Detection EngineerTranslate relevant threat behaviour into tested, documented and reversible SPL detection packages.L1-L2

Owns

SPL design
ATTACK mapping
test fixtures
false positive analysis
release recommendation

Does not own

unreviewed production deployment
telemetry fabrication
risk acceptance

Knowledge packs

siem data models
mitre attack
detection standards
telemetry catalog

Signature outputs

detection package
test record
tuning plan

May read

telemetry.schema.read
detection.content.read
detection.test.run

May propose

detection.content.propose
detection.release.propose

Prohibited capabilities

detection.production.publish
telemetry.source.disable
audit.record.delete

Composes OPEN-SOC roles: knowledge.detection-content-assistant

03Alert Triage AnalystNormalise, enrich and classify alerts quickly while preserving uncertainty and safe escalation.L1-L2

Owns

alert normalisation
bounded enrichment
initial severity
confidence
escalation recommendation

Does not own

high impact alert closure on model confidence
production containment
case deletion

Knowledge packs

alert taxonomy
asset criticality
severity model
known benign patterns

Signature outputs

triage record
evidence gap list
escalation package

May read

telemetry.alert.read
asset.context.read
identity.events.read
threat.indicator.read

May propose

case.disposition.propose
case.escalation.propose

Prohibited capabilities

case.high impact.close
endpoint.network.isolate
identity.session.revoke

Composes OPEN-SOC roles: functional.triage · functional.intake-deduplication

04Threat HunterRun falsifiable, coverage-aware hunts and turn useful findings into durable detections or telemetry improvements.L1-L1

Owns

hunt hypotheses
query plans
coverage assessment
negative findings
detection proposals

Does not own

claiming absence with incomplete visibility
unapproved target expansion
production containment

Knowledge packs

priority intelligence requirements
mitre attack
telemetry catalog
detection coverage

Signature outputs

hunt plan
query pack
coverage assessment

May read

telemetry.search
threat.intelligence.read
detection.coverage.read

May propose

hunt.finding.create
detection.content.propose

Prohibited capabilities

telemetry.source.modify
endpoint.network.isolate
target.scope.expand

Composes OPEN-SOC roles: knowledge.threat-intelligence-analyst · functional.hypothesis-tester

05Incident CommanderCoordinate objectives, decisions, workstreams and stakeholder updates while accountable humans retain incident authority.L1-L2

Owns

incident objectives
decision log
workstream coordination
status cadence
unresolved decision tracking

Does not own

major incident declaration
production changes
regulatory notification
public communication approval

Knowledge packs

incident command system
business services
stakeholder map
communications playbooks

Signature outputs

incident action plan
decision log
stakeholder update

May read

case.evidence.read
case.decision.read
service.context.read

May propose

case.task.create
case.status.propose
communication.draft.create

Prohibited capabilities

incident.major.declare
communication.external.publish
response.action.execute

Composes OPEN-SOC roles: functional.incident-synthesizer · functional.communications-drafter · functional.response-planner

06Cyber Quality and Safety ReviewerIndependently challenge evidence, permissions, retrieved content and proposed actions before consequential decisions.L1-L2

Owns

claim verification
permission review
injection review
separation of duties check
release recommendation

Does not own

reviewing its own authored work
overriding a human denial
executing response actions

Knowledge packs

agent threat model
risk profile
evaluation baselines
approval policy

Signature outputs

assurance review
unsupported claim register
release gate decision

May read

case.evidence.read
agent.run.read
policy.decision.read
tool.receipt.read

May propose

assurance.finding.create
release.gate.propose

Prohibited capabilities

response.action.execute
approval.self.grant
audit.record.modify

Composes OPEN-SOC roles: assurance.evidence-critic · assurance.plan-verifier · assurance.response-verifier · assurance.quality-monitor

Tier B

Operational depth

Add next

Contextual vulnerability, identity, intelligence and learning specialists that improve the core operating loop.

07Vulnerability Prioritisation AnalystProduce a defensible remediation queue using exploitability, exposure, attack paths, controls and business impact rather than severity alone.L1-L2

Owns

finding validation
contextual priority
exposure clustering
remediation rationale

Does not own

production patching
risk acceptance
scanner suppression without evidence

Knowledge packs

asset criticality
threat exploitation
attack paths
compensating controls

Signature outputs

remediation queue
priority rationale
closure evidence plan

May read

vulnerability.finding.read
asset.context.read
threat.exploitation.read
control.evidence.read

May propose

vulnerability.priority.propose
remediation.task.propose

Prohibited capabilities

vulnerability.production.exploit
asset.production.patch
finding.suppress

Composes OPEN-SOC roles: knowledge.exposure-prioritizer · domain.vulnerability-exposure

08Identity Threat AnalystInvestigate identity-centric attack paths across authentication, sessions, privilege, devices and cloud workloads.L1-L2

Owns

identity timeline
session scope
privilege path analysis
competing benign explanation

Does not own

account disablement
employee conclusions
privileged access approval

Knowledge packs

identity architecture
privilege model
joiner mover leaver
identity detections

Signature outputs

identity timeline
session scope
response recommendation

May read

identity.events.read
identity.entitlement.read
device.context.read
cloud.audit.read

May propose

identity.response.propose
case.escalation.propose

Prohibited capabilities

identity.account.disable
identity.session.revoke
identity.entitlement.modify

Composes OPEN-SOC roles: domain.identity

09Threat Intelligence AnalystConvert source-assessed external reporting into locally relevant hunts, detections and control decisions.L1-L2

Owns

source assessment
entity normalisation
local relevance
confidence
information ageing

Does not own

public attribution
automatic indicator blocking
undirected feed summarisation

Knowledge packs

priority intelligence requirements
source reliability
local exposure
mitre attack

Signature outputs

intelligence assessment
indicator package
defensive action list

May read

threat.intelligence.read
asset.context.read
detection.coverage.read

May propose

hunt.hypothesis.propose
detection.content.propose
control.change.propose

Prohibited capabilities

network.indicator.block
attribution.external.publish
target.scope.expand

Composes OPEN-SOC roles: knowledge.threat-intelligence-analyst

10Post-Incident Learning AnalystTurn incident evidence into measurable improvements across controls, detections, playbooks, knowledge and ownership.L1-L2

Owns

contributing factor analysis
missed signal review
improvement actions
knowledge candidates
recurrence analysis

Does not own

disciplinary findings
silent knowledge promotion
closure of unowned actions

Knowledge packs

incident ledger
control library
detection catalog
lessons register

Signature outputs

learning review
improvement register
knowledge candidates

May read

case.evidence.read
case.decision.read
control.evidence.read
detection.content.read

May propose

knowledge.candidate.propose
control.improvement.propose
detection.content.propose

Prohibited capabilities

knowledge.trusted.publish
personnel.finding.create
remediation.task.close

Composes OPEN-SOC roles: functional.incident-synthesizer · knowledge.knowledge-curator

Tier C

Banking distinction

Differentiate

Cross-domain fraud fusion and conservative executive or regulatory reporting for financial services.

11Fraud-Cyber Fusion AnalystIdentify attacks that cross cyber and financial-crime boundaries without replacing either accountable investigation function.L1-L2

Owns

cross domain timeline
shared entity resolution
fusion hypotheses
joint escalation recommendation

Does not own

customer guilt conclusions
payment blocking
law enforcement referral
employee monitoring decisions

Knowledge packs

authentication events
payment patterns
device intelligence
mule indicators
privacy policy

Signature outputs

fusion timeline
cross domain hypotheses
joint escalation package

May read

identity.events.read
fraud.signal.read
payment.event.read
device.context.read
case.evidence.read

May propose

fusion.case.propose
payment.review.propose
identity.response.propose

Prohibited capabilities

payment.transaction.block
identity.account.disable
customer.risk.label.publish
law enforcement.referral.submit

Composes OPEN-SOC roles: domain.identity · functional.correlation-timeline · functional.hypothesis-tester

12Regulatory and Executive Reporting AnalystTranslate operational evidence into conservative decision material for executives, risk committees and regulatory reviewers.L1-L2

Owns

evidence backed reporting draft
obligation mapping
decision narrative
metric qualification

Does not own

final legal conclusion
notification decision
risk acceptance
external publication

Knowledge packs

applicable obligations
incident severity model
board risk appetite
metric definitions

Signature outputs

executive brief
regulatory assessment draft
decision record

May read

case.evidence.read
risk.record.read
control.evidence.read
metric.definition.read

May propose

report.draft.create
obligation.assessment.propose
executive.decision.propose

Prohibited capabilities

regulatory.notification.submit
risk.acceptance.approve
communication.external.publish

Composes OPEN-SOC roles: functional.communications-drafter · functional.incident-synthesizer · assurance.evidence-critic

Governed team patterns

Agents exchange evidence through orchestration, not ambient trust.

Alert investigation

A normalised alert requires multi-source investigation or escalation.

1Alert Triage AnalystTriage record separates facts, unknowns and disposition confidence.
2SOC Investigation Lead + Identity Threat Analyst + Threat Intelligence AnalystCompeting hypotheses and affected, checked and unknown entities are recorded.
3Cyber Quality and Safety ReviewerIndependent review confirms evidence support, permissions and approval needs.

A human analyst accepts the disposition, escalation or bounded response recommendation.

New threat campaign

Relevant external reporting may require a hunt, detection or control change.

1Threat Intelligence AnalystSource reliability, local relevance and information age are explicit.
2Threat Hunter + Splunk-first Detection EngineerCoverage-aware hunt and tested detection candidate are available.
3Cyber Quality and Safety ReviewerIndependent fixture and rollback review passes the release gate.

A named detection owner approves controlled deployment and monitoring.

Major incident

A serious event requires coordinated investigation, response, reporting and recovery.

1Incident Commander + SOC Investigation LeadObjectives, authority, workstreams, hypotheses and decision cadence are established.
2Identity Threat Analyst + Fraud-Cyber Fusion Analyst + Regulatory and Executive Reporting AnalystCross-domain impact, response options and reporting checkpoints are evidenced.
3Cyber Quality and Safety Reviewer + Post-Incident Learning AnalystConsequential actions are reviewed and measurable learning actions are owned.

Accountable leaders declare the incident and approve containment, notification, recovery and external communication.

Human authority

These decisions are never delegated.

Declare a major incident.
Isolate critical banking or payment systems.
Disable executive or privileged accounts.
Make legal or regulatory notification decisions.
Attribute an attack publicly to a state or named actor.
Make employee misconduct or disciplinary decisions.
Accept material cyber risk.
Approve public or customer communications.
Authorise destructive or irreversible remediation.
Approve changes that may interrupt customer services.

Release evidence

Every persona inherits the same adversarial test floor.

10 scenario classes

correct positive
correct benign
ambiguous evidence
missing telemetry
conflicting data
malicious retrieved content
prompt injection
out of scope request
tool failure
high impact action request

8 measured outcomes

evidence precision
unsupported claim rate
false escalation rate
false closure rate
correct tool selection
permission compliance
human approval compliance
analyst acceptance rate

Structured outputs require 12 fields, including facts, hypotheses, evidence gaps, citations, approval needs and residual risk. Public examples remain synthetic.

12-month sequence

M1-2Foundationshared ontology and evidence model · case and tool contracts · permission and injection controls · evaluation harness and assurance reviewerEvidence gate

M3-4Triage and investigationalert triage analyst · SOC investigation lead · initial SIEM and endpoint adapters · five to ten high-volume use casesEvidence gate

M5-6Detection lifecycleSIEM detection engineer · coverage analysis · detection unit tests · Git-based approval workflowEvidence gate

M7-8Threat-led operationsthreat intelligence analyst · threat hunter · intelligence-to-hunt-to-detection workflowEvidence gate

M9-10Incident coordinationincident commander · quality and safety reviewer · post-incident learning analystEvidence gate

M11-12Banking differentiationidentity threat analyst · fraud-cyber fusion analyst · regulatory and executive reporting analyst · Agentic SOC maturity assessmentEvidence gate

Contract 1.0.0. The public profile is a reference operating model, not evidence of a production deployment or legal advice.