Blue Team Con 2026

10:30am CDT

Life After Tier 1: Rebuilding the SOC When Triage Is Outsourced

Saturday September 12, 2026 10:30am - 11:30am CDT

For many medium-sized enterprises, outsourcing Tier 1 triage to an MSSP is positioned to reduce workload, provide 24/7 coverage, and improve efficiency. In practice, it fundamentally reshapes how a SOC operates—and introduces new challenges that many teams are unprepared for.

Outsourcing Tier 1 doesn’t eliminate work—it redistributes it in ways most SOCs are not designed to handle.

This talk examines what happens after Tier 1 is removed. Organizations place significant trust in third-party providers, yet alert volume may decrease while investigation complexity increases. Context is often lost at handoff boundaries, and traditional metrics lose meaning, while new measures—such as mean time to confirm and escalation quality—become critical for understanding performance. Teams that fail to adapt quickly often find themselves with fewer alerts, but greater uncertainty and slower response.

Operational gaps also emerge when systems do not align with MSSP onboarding models. Custom telemetry sources, delayed parser development, and the gap between deployment and monitoring readiness introduce risk that must be actively managed.

Drawing on real-world experience leading a SOC through this transition, this session focuses on how to redesign operations for a post–Tier 1 model. We will explore how analyst roles must evolve from queue processors to investigators, why detection fidelity becomes the most important metric, and how to build feedback loops that continuously improve detection quality.

Attendees will leave with a practical framework for restructuring workflows, redefining success metrics, and improving detection precision.
This talk is designed for SOC leaders, detection engineers, and analysts navigating MSSP integration or considering outsourcing triage functions and aligns with both the Management/Leadership and Security Operations tracks.

Speakers

Stuart Fairchild

Senior Manager, Cybersecurity, C Spire

Stuart Fairchild is a Senior Manager of Cybersecurity at a regional telecommunications provider, where responsibilities include leading security monitoring, incident response, and security awareness programs supporting infrastructure for over one million customers. Work focuses on improving detection... Read More →

Saturday September 12, 2026 10:30am - 11:30am CDT
Swissôtel Chicago 323 E Wacker Dr, Chicago, IL 60601, USA

Talk

Company C Spire
Audience Intermediate
Subject Management / Leadership
global Y

Blue Team Con 2026

From $0.00

Tickets

Success you have shared X tickets.

Blue Team Con 2026

10:30am CDT

Stuart Fairchild

Get help with the event

Choose your checkout method

Success you have shared X tickets.

Blue Team Con 2026

10:30am CDT

Stuart Fairchild

Get help with the event