Security Operations Center Build For A Global Manufacturing Enterprise

Before choosing any tools, we defined how the SOC would work day to day. Workshops with IT, factory and regional leaders shaped the scope, service levels, escalation paths and the balance between in-house analysts and automation across every time zone. Every region had a voice in how the SOC would operate.

The result was a follow-the-sun model with analysts in three regions, so every alert is handled during someone's working day. Clear roles were defined for triage, investigation and incident response, and service levels were agreed with each business unit, so everyone knew exactly what the SOC would do for them and how quickly.

This operating model guided every later decision, from tooling and staffing to reporting. It also gave the board a realistic plan and budget to approve early on, which kept the project on track and avoided costly changes of direction later in the build. The same model has since been used to plan the SOC's expansion into newly acquired businesses in two more countries.

We deployed a cloud-native SIEM as the heart of the SOC, collecting and correlating security data from across the global estate. A cloud platform was chosen to avoid building data centres in 18 countries and to scale smoothly as log volumes grew. Costs were modelled carefully to avoid surprises later on.

Detection content was built in layers, starting with high-confidence rules for the most common threats and expanding to cover identity attacks, ransomware behaviour and data theft. Every rule was tested against simulated attacks before going live, so analysts could trust that an alert meant something real rather than another false alarm.

Within the first month of operation, the SIEM detected several genuine incidents that would previously have been missed, including a compromised supplier account. Detection coverage has grown steadily since, guided by threat intelligence and lessons learned from every investigation the team handles. New detections are added every month, based on emerging threats and lessons from real investigations.

A SIEM is only as good as the data it receives, and at the start just 30% of critical systems were sending logs. We built a prioritised onboarding plan, starting with identity, email, endpoints and internet-facing systems before moving to everything else. Priorities were agreed with each regional IT lead in advance.

Each data source was connected, parsed and checked for quality, so fields like usernames and IP addresses were consistent across every system. Health monitoring now alerts the SOC if a source stops sending logs, closing a common blind spot where attackers disable logging to hide their activity inside a network.

By go-live, over 95% of critical systems were feeding the SIEM, across all 18 countries. Log costs were kept under control by filtering low-value noise at the source, so the business pays only for data that genuinely helps detect and investigate threats. New systems are now onboarded as part of every IT project, so coverage keeps pace as the business grows.

With a small team covering a global estate, automation was essential. We deployed a SOAR platform to handle repetitive triage work, enriching each alert with context and taking simple, safe actions without waiting for a human analyst to step in. Every playbook was tested safely before being switched on.

Playbooks now cover more than 40 alert types, from suspicious logins and phishing reports to malware detections. They look up user details, check threat intelligence, isolate infected machines and reset compromised passwords automatically, while anything unusual or high-impact is escalated to an analyst with all the relevant evidence already gathered.

Automation reduced analyst workload by 65%, freeing the team to focus on complex investigations and threat hunting. Response times for common incidents dropped from hours to minutes, and analysts report far less alert fatigue than in the early, fully manual days. New playbooks are added regularly as analysts spot more repetitive tasks that can safely be automated.

Factory networks had never been monitored, even though an incident there could stop production entirely. We deployed passive monitoring sensors that watch industrial traffic without interfering with machines, so production was never put at risk during installation. Plant managers approved every sensor location in advance.

The sensors built a complete inventory of controllers, robots and engineering workstations, many of which had never been documented. Purpose-built detection rules now flag unusual commands, unexpected remote connections and changes to controller logic, with alerts routed to analysts trained specifically in industrial systems and their safety requirements.

For the first time, the manufacturer can see what is happening on its factory floors in every region. Several risky remote access routes used by suppliers were discovered and secured, closing a critical blind spot that had worried the board for years. Factory teams now receive regular network health reports, helping them plan maintenance and upgrades more safely.

Manufacturing is one of the most targeted sectors for ransomware and industrial espionage. We integrated commercial and industry threat intelligence feeds into the SIEM, so known malicious infrastructure is detected automatically the moment it appears in the environment. Sources were chosen for their relevance to manufacturing.

Beyond automated feeds, we set up a regular intelligence process focused on the groups most likely to target the business. Monthly briefings translate this research into practical actions, such as new detection rules, hardening priorities and awareness messages for staff in the regions currently being targeted by specific campaigns.

Threat intelligence helped the SOC spot and block an active phishing campaign aimed at the finance team before any credentials were stolen. The business now anticipates threats instead of simply reacting to them, and leadership receives clear updates on the risks facing the sector. Intelligence reports are now shared with key suppliers too, strengthening security across the wider supply chain.

When an incident happens, clear instructions make the difference between a quick recovery and a crisis. We wrote more than 60 incident response playbooks covering every major scenario, from ransomware and data theft to insider threats and factory disruptions. Each one was written with the people who would use it.

Each playbook sets out who does what, which decisions need management approval and how to communicate with staff, customers and regulators. They were tested through tabletop exercises with IT, legal, communications and plant managers, refining the steps until everyone was confident they could follow them under real pressure.

Since go-live, the SOC has handled every incident using these playbooks, with consistent, well-documented responses across all regions. Post-incident reviews feed improvements back into the playbooks, so the response process keeps getting sharper with every real event the team manages. Tabletop exercises are repeated twice a year, keeping skills sharp and making sure new managers know their roles.

A SOC depends on its people, so we invested heavily in the in-house team. Newly hired analysts worked alongside our consultants for the first months of operation, learning the tools, playbooks and environment on real alerts rather than in a classroom. Training was built into their normal shifts from day one.

Training covered investigation techniques, threat hunting, industrial systems and clear incident reporting. Regular simulated attacks tested the team's skills in a safe setting, and a structured career path was created so analysts could see how to progress, which is essential for keeping skilled people in a competitive market.

By the end of the engagement, the in-house team was running the SOC independently, with our consultants on hand only for specialist support. The manufacturer now owns a mature, self-sufficient capability rather than depending on outside help for its day-to-day security. Staff retention in the SOC has stayed high, which is rare in the industry and a strong sign of a healthy team.