Security operations

Original to this reference.

Levels

1. Awareness

You can:

• explain common cyber threats such as phishing and ransomware
• report a suspected security event

2. Working

You can:

• monitor alerts and triage them using runbooks
• gather evidence and escalate events
• tune simple detection rules under guidance

3. Practitioner

You can:

• investigate and contain security incidents
• write detection rules and threat hunts
• improve runbooks and tooling after incidents

4. Expert

You can:

• lead the security operations service and its strategy
• lead the response to major cyber incidents
• work with national security agencies and partners

Closest ESCO skills

• handle cybersecurity incidents (close match)
• cyber attack counter-measures (broad match)
• attack vectors (narrow match)

Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.

Role levels that expect this skill