IICTI Certified Security Operations Manager

Holders demonstrate that they can apply and evaluate sOC operating model, sourcing and target architecture, detection engineering lifecycle and ATT&CK coverage, security data architecture, SIEM and XDR platforms and cyber threat intelligence and threat-informed defence, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Security Operations Manager.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01SOC operating model, sourcing and target architecture13% of the exam

   • Design a SOC operating and sourcing model aligned to the organisation's threat profile, risk appetite and budget.
   • Scope: In-house, hybrid, MSSP and MDR models, tiered vs pod and swarm structures, 24x7 coverage design, SOC-CMM capability assessment, NIST CSF 2.0 Detect and Respond functions, service catalogue.
2. 02Detection engineering lifecycle and ATT&CK coverage10% of the exam

   • Lead a detection engineering programme that measurably improves coverage of prioritised adversary behaviours.
   • Scope: Detection-as-code, Sigma rules, MITRE ATT&CK coverage mapping and gap analysis, purple team validation, detection testing, false positive tuning, rule lifecycle and version control.
3. 03Security data architecture, SIEM and XDR platforms10% of the exam

   • Architect security telemetry platforms that balance visibility, query performance and cost.
   • Scope: Log source prioritisation, OCSF normalisation, data pipelines and security data lakes, tiered storage economics, Microsoft Sentinel, Splunk and Google SecOps, XDR integration.
4. 04Cyber threat intelligence and threat-informed defence9% of the exam

   • Evaluate threat intelligence to drive defensive priorities and communicate risk to stakeholders.
   • Scope: Priority intelligence requirements, STIX/TAXII and MISP, Diamond Model and kill chain analysis, intelligence sharing communities, CTI-driven detection and hunting priorities.
5. 05Threat hunting programme leadership5% of the exam

   • Lead a structured threat hunting programme that uncovers undetected threats and strengthens detection coverage.
   • Scope: Hypothesis-driven hunting with PEAK and TaHiTI, behavioural baselining, UEBA, hunting maturity model, converting hunt findings into detections, hunt metrics.
6. 06Incident response leadership and crisis management13% of the exam

   • Lead complex security incidents from detection to recovery while meeting legal, regulatory and executive obligations.
   • Scope: NIST SP 800-61r3, ISO/IEC 27035, playbook design, major incident command, ransomware response decision-making, forensic readiness, crisis communications, regulatory notification (NIS2, GDPR, EU DORA).
7. 07SOAR and AI-augmented security operations5% of the exam

   • Evaluate and govern automation and AI in the SOC to increase throughput without unacceptable risk.
   • Scope: SOAR playbook design, case management, agentic AI triage and investigation, human-in-the-loop controls, guardrails and validation of AI outputs, automation efficacy measurement.
8. 08Identity, cloud and SaaS security operations5% of the exam

   • Design detection and response capability for identity-centric, cloud and SaaS attack surfaces.
   • Scope: Identity threat detection and response (ITDR), Entra ID and Okta telemetry, token theft and session hijacking, business email compromise, cloud audit logs (CloudTrail, Azure Activity, GCP Audit), SaaS posture.
9. 09Exposure management and vulnerability prioritisation5% of the exam

   • Evaluate exposure data to prioritise remediation by exploitability and business impact.
   • Scope: Continuous Threat Exposure Management (CTEM), EPSS, CISA KEV, SSVC, attack surface management, integration of exposure data with detection and response priorities.
10. 10SOC performance metrics and executive reporting12% of the exam

    • Design SOC performance measures that drive improvement and communicate security posture to executives.
    • Scope: MTTD and MTTR limitations, detection efficacy and coverage metrics, analyst workload and alert quality, risk-based KPIs, board and regulator reporting, SLAs for MSSP and MDR providers.
11. 11SOC workforce, governance and legal compliance13% of the exam

    • Lead a sustainable SOC workforce and governance framework that complies with legal and regulatory obligations.
    • Scope: NICE Workforce Framework, shift and rota design, analyst burnout and retention, career paths and training, ISO/IEC 27001:2022 controls, employee monitoring privacy and legal constraints, evidence handling.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner