SecOps (Security Operations)
Overview
SecOps maintains security at runtime: detection, security alerts and coordinated incident response.
Responsible for continuous security monitoring, alert configuration and execution of response playbooks. General operations — availability, routine patching, rollback — belong to DevOps / SRE.
Specialisations: SecOps (IR), also called Incident Response; SecOps (SOC); SecOps (Incident Commander); and the security on-call. The availability on-call belongs to DevOps / SRE.
Key Responsibilities
- Ensure the detection of security events at runtime
- Trigger the security patch when a vulnerability in running systems requires it
- Coordinate incident response (Ch. 12)
- Ensure incident notification within the regulatory deadlines
Organisational Context
SecOps is the front line in NIS2 compliance (incident response; early warning within 24 h, incident notification within 72 h and final report 1 month after the notification, for significant incidents) and DORA (operational continuity and management of critical events).
Regulatory Framework
Front line in:
- NIS2: Early warning of significant incidents within 24h (incident notification within 72h)
- DORA: Operational continuity and resilience
Activities by Chapter
Ch. 09 - Containers and Images
Track vulnerabilities in running images and trigger the security patch; maintaining the baseline belongs to DevOps / SRE.
Ch. 11 - Secure Deployment
Trigger the rollback when a deploy introduces a security incident; executing the rollback belongs to DevOps / SRE.
Ch. 12 - Monitoring and Operations
Configure critical alerts with SLAs, integrate alerts with incident response playbooks, correlate multi-source events, tune alerts to reduce false positives, coordinate incident response and work with detection and response metrics.
User Stories:
- US-03: Critical alerts with SLAs - Timely incident response
- US-10: Incident response playbooks - Fast, coordinated action
- US-05: Event correlation - Detection of suspicious patterns (with AppSec Engineer)
- US-06: Alert validation and tuning - Reduce false positives (with AppSec Engineer)
Ch. 13 - Training and Onboarding
Take part in incident simulations (war room, tabletop exercises) to validate response processes.
Ch. 14 - Governance and Contracting
Document incidents and lessons learned, ensuring continuous improvement of response processes.
Chapter References
For full context and framing: