Security Operations Centers (SOCs) are often assessed through maturity models, compliance frameworks, and performance metrics. However, real incidents frequently demonstrate that maturity does not always equate to resilience. This presentation focuses on how to practically assess whether a SOC can maintain effective detection, response, and coordination under real operational stress.
Based on field experience across financial institutions, industrial environments, and government SOCs, the session introduces a pragmatic approach to evaluating SOC resilience across people, processes, technologies, and critical dependencies. Rather than reviewing policies and tooling in isolation, the approach emphasizes observing behavior under pressure: decision-making, escalation quality, handovers, and coordination with incident response, IT, and business stakeholders.
Attendees will learn how to assess SOC resilience without waiting for a major breach, using targeted interviews, tabletop exercises, and stress-based scenarios such as concurrent incidents, degraded telemetry, or loss of key personnel. The presentation highlights common hidden failure points identified in real assessments and provides practical guidance on translating findings into prioritized resilience improvements. Participants will leave with a clear methodology and actionable checkpoints to evaluate and strengthen SOC and CSIRT resilience in their own environments.
Imane Bachane is the Founder and CEO of BLUESEC, a cybersecurity consulting firm specializing in SOC transformation, cyber governance, and intelligence-driven security operations across Africa and the Arab regions. Her work focuses on assessing and strengthening the operational effectiveness and resilience of SOCs and CSIRTs, particularly in regulated and resource-constrained environments.
Before founding BLUESEC, Imane led Cyber Threat Intelligence (CTI) activities within a major banking group, where she contributed to building an intelligence capability directly supporting detection, incident response, and security decision-making. Her experience bridges CTI, SOC maturity, and threat-informed defense, with a strong emphasis on converting frameworks and maturity models into practical, executable workflows for operational teams.
Imane works with financial institutions, industrial operators, and national organizations to assess SOC readiness, validate performance under stress scenarios, and improve coordination between SOC, incident response, and governance functions. Her assessments focus on identifying hidden operational dependencies and single points of failure revealed during real incidents.
She is certified SOC-CMM and SANS GSOM, and actively contributes to the regional cybersecurity community, advocating for resilient, maturity-driven, and operationally grounded SOC capabilities.
Jamaleddine Hadini is a cybersecurity practitioner specializing in incident response, digital forensics, and SOC modernization. With more than ten years of experience supporting critical organizations, he develops resilient defense capabilities grounded in threat-informed practices, automation, and defensible architectures. His expertise spans threat hunting, detection engineering, DFIR, and OT/industrial cybersecurity. Jamaleddine holds several certifications, including SANS GCFA, SANS GRID, and CHFI, reflecting his expertise across blue-team operations. A strong advocate for capacity building in Africa, he collaborates with industry partners to strengthen regional expertise and contribute to sustainable, sovereign cyber capabilities.
