How to build a security operations center: start with the operations
● Sep 11, 2026
Planning a security operations center starts with defining the work. This practical guide covers operator needs, integrations, resilience, communications and long-term growth.
WRITTEN BY
Jessi Greenlee
SHARE THIS POST
A security operations center (SOC), or global security operations center (GSOC), should be designed around the work its operators perform. Before choosing technology, define what the SOC will monitor, which incidents it will handle, who will make decisions and how the team will respond.
This guide covers what a security operations center does and the operational, technology, resilience and workplace questions to answer when planning one.
What does a security operations center actually do?
A SOC's responsibilities depend on the organization.
Security teams responsible for hundreds of properties in one city may monitor activity, respond to incidents, protect customers and tenants, and help reduce liability. A global security team may also track employees, offices, shipments and business travelers across several countries.
Manufacturers and distributors may focus on high-value inventory moving between facilities. Other security teams may be responsible for intellectual property, critical infrastructure or large groups of employees. Most modern SOCs handle far more than video surveillance.
Depending on the business, operators may monitor:
- Security cameras and access control systems
- Intrusion and other alarms
- Employees and travelers
- Buildings and remote sites
- Vehicles and other mobile assets
- High-value shipments
- Severe weather
- Flooding, storms and natural disasters
- Protests or other local disruptions
- Global events that could affect employees or operations
- Requests for assistance from customers, tenants or employees
Consider a property organization responsible for locations throughout a major city.
Its SOC combines security and day-to-day operational support. The team monitors activity across the properties and helps the people using them. Someone who encounters a problem can contact the SOC for help leaving an area safely, reaching the right person on site or escalating an incident.
Another security team may focus on shipments. When billions of dollars of inventory move around the world each year, the team needs to know whether a shipment arrived, was delayed, left its route or may have been stolen.
Those questions affect security, insurance, customer commitments and day-to-day business operations. Security remains central to the mission, while the SOC also supports how the business functions.
What should you define before choosing SOC technology?
One of the easiest ways to make a SOC project unnecessarily complicated is to start with a technology shopping list.
Technology comes later.
First, define the work.
- Who will be sitting in the SOC?
- What are they responsible for?
- What events require their attention?
- What decisions are they expected to make?
- What information do they need before they can make those decisions?
- Who do they communicate with?
- What happens after hours?
- What requires escalation?
- What needs to happen if a major system becomes unavailable?
The answers will differ for every organization.
A center serving one campus has different requirements from one monitoring hundreds of locations, global shipments and traveling employees.
The room, systems and workflows should reflect those responsibilities.
How should you design a SOC for its operators?
People determine whether a technology-heavy SOC works. The operator experience deserves more attention than it usually receives.
When Corning redesigned its GSOC, it asked its operators what made their jobs harder.
They used that feedback to prioritize three things:
- a layout that encourages group communication
- a main working space that minimizes noise and distraction
- a separate space for deeper incident analysis
Before choosing a workstation, study how operators work. Watch how information moves during an incident, then look at what operators need within reach and what interrupts common tasks.
Operators may spend eight, ten or twelve hours at a workstation. During an incident, they need to understand the situation quickly and use several systems without stopping to work out the technology.
A useful test for any feature is whether the person using it can learn it easily. If an operator needs to share something with the room, one clear action should send it to the right display.
Every extra step adds friction during an incident.
What function does a video wall provide in a Security Operation Center?
The video wall is usually the most visible part of a SOC, so it often receives too much attention during design.
Its purpose is shared awareness. Operators already have monitors at their desks; the wall should show information that several people need at once, such as a developing incident, related cameras, a map, severe weather or alarms.
The layout may change with the situation. Normal operations might call for a standard mix of cameras and information, while a major incident may require one large display or a different arrangement of sources.
Continental has paired Datapath video wall controllers with Milestone XProtect to make those changes easier for operators. The controller manages the displays independently, and an operator can select or "track" relevant cameras so they appear on the shared wall.
Operators only need to know which action to take. The controller handles the display arrangement behind the scenes.
What should you consider when choosing a SOC display?
The physical display technology also affects how operators use the wall.
Commercial monitors are common and work well for many layouts. Their seams may be acceptable for separate camera feeds and distracting when the wall needs to work as one large canvas.
Direct-view LED creates one continuous display surface and is relatively simple to maintain after installation. It costs more, requires different cabling, and careful planning around display dimensions, viewing distance, resolution and room layout.
Choose the display based on how operators will use it and plan accordingly.
How should you choose furniture for a SOC?
Operators interact with their furniture throughout every shift. An SOC workstation needs more than enough surface area to hold a computer.
Plan around everything an operator needs within reach:
- Several monitors
- Radio equipment
- Phone charging
- Communications hardware
- Network connections
- Storage
- Controls
- Power
- Equipment racks or other integrated hardware
The length of the shift matters too. Monitor height, reach, lighting, room temperature and cable management all affect how comfortably someone can use several screens.
Purpose-built furniture can also simplify servicing and future equipment changes. Continental commonly uses configurable console systems such as Watson in North America and RDI in Europe because each workstation can fit the operator and the equipment.
Build the workstation around the way the SOC will be used.
Should your SOC have a separate room for equipment?
While it may require a little additional effort and planning up front, we have found enormous value in creating a separate space for equipment so operators can move freely about the room and not be interrupted by maintenance activities.
Our advice is to move as much infrastructure as possible out of the operations room.
Traditional setups often place a powerful computer at every desk, and some of those computers also drive large displays.
The arrangement adds heat and wiring, spreads battery backup throughout the room, and forces technicians to work around active operators during maintenance.
A separate equipment or server room centralizes servers, workstation hardware, video wall controllers, UPS systems and other infrastructure in a space designed for equipment.
Centralizing the equipment makes cooling, wiring, backup power and maintenance easier to manage. It also keeps the operations room focused on the people doing the work.
If you have the opportunity to make that decision during the design stage, it is much easier than trying to fix it after the room has already been built.
Does it require more effort and planning up front? Yes, but the payoff is well worth it.
How to choose technology for your SOC
Technology decisions become easier once the operational requirements are clear. Most modern SOCs bring several systems together.
What should a SOC video management system do?
Video remains one of the main tools available to a security operator. The video management system has to support live monitoring, investigation, alarm response and the integrations the organization depends on.
Large, distributed environments also need clear answers to several questions:
- How many sites and cameras will the system support?
- How much video will operators view at the same time?
- What will happen when bandwidth is limited or a remote connection disappears?
- Which functions must continue working locally?
How should a SOC integrate access control and intrusion systems?
Video is more useful when operators know why they are looking at it. An access-control event may report a forced door, while the related video shows what happened.
Operators need to move quickly between video, access-control information, intrusion alarms and other security events.
How can a SOC monitor vehicles, assets and shipments?
Some SOCs monitor GPS data from company vehicles, shipments or other high-value assets. That information can extend visibility beyond a building perimeter and show where an asset has been, whether it is moving as expected and when its status changes.
A recent cargo theft in Southern California shows how quickly a logistics problem can become a security problem.
In August 2026, approximately $70,000 worth of beer disappeared from an Anheuser-Busch distribution center in two pickups about an hour apart. One shipment left for delivery and never arrived. In the second incident, investigators say a purported subcontractor used fraudulent documentation to arrange the pickup.
The product left the facility under circumstances that initially appeared legitimate. A SOC may be expected to identify and respond to that kind of threat when an organization moves high-value inventory.
In another 2026 case, thieves took a high-value electronics shipment from a secured carrier yard in Canada. GPS devices on the load alerted a 24/7 command center after the shipment passed its intended destination without arriving. The team confirmed the theft, contacted law enforcement and provided live coordinates. Authorities recovered the trailer within hours.
Operators need to verify the driver and vehicle, follow the shipment after pickup, watch for route changes and confirm arrival.
Video, access control, GPS or telematics, and shipping information may each hold part of the answer. The SOC brings those signals together so the team can spot a problem and act while the shipment can still be recovered.
How does a SOC respond to weather and global events?
Security teams responsible for employees and locations around the world need awareness of events outside traditional physical security systems.
Floods, typhoons, wildfires, major storms and civil disruptions can affect employees, offices, retail locations and supply chains.
Ahead of the 2026 World Cup, Adidas expanded its relationship with risk-management provider Healix to access its global security operations center. Adidas has employees, offices, retail operations and supply chains around the world, with no security expert positioned in every region.
Its security team described the GSOC as a way to understand events affecting employee safety, retail locations and supply chains, then give people across the business the information they need to respond.
When a typhoon, protest or other event occurs, the security team has to determine which people, locations and operations are affected. The SOC may also communicate with employees, provide instructions and confirm that people are safe.
A SOC gives the security team situational awareness across people and operations.
How should a SOC communicate during an incident?
A SOC needs a clear way to reach people across the organization. That may include radios, phone systems, messaging platforms, mass-notification tools or direct communication with employees and customers.
The technology will vary. In every case, the operator needs a direct path from seeing a problem to reaching someone who can act.
When should a SOC use cloud technology?
Cloud services have a place in modern security systems, depending on the workload.
A workstation that displays several live video streams all day has different performance and resilience requirements from a person checking one camera remotely.
Large enterprise video environments may include distributed recording servers, remote sites, heavy bandwidth demands and systems that must keep working during an external connectivity failure.
Continental generally treats core SOC video infrastructure differently from casual remote viewing. An open platform such as Milestone XProtect lets designers support a large, distributed system and connect other technologies around it.
Choose the architecture that fits the workload.
What tasks should SOC operators avoid managing?
Operator attention is limited. Every dashboard, alarm and task uses some of it.
Reliable automation, or moving a responsibility to the team best equipped to handle it, can keep operators focused on incidents that require their judgment.
Camera and video-system health is a good example. During the April 2022 Brooklyn subway shooting, surveillance cameras at the 36th Street station were reportedly not operating properly.
Cameras at another station connected to the suspect's escape were also reported to be malfunctioning. A later New York City Council resolution cited those failures while calling for more frequent inspections and timely repairs.
A critical camera failure should be found before an emergency. A technology team can own the health checks for thousands of cameras and recording servers.
In one current SOC project, health monitoring sits outside the operator workflow. An integration such as The Boring Toolbox monitors the Milestone environment and gives the technology team visibility into camera and infrastructure problems.
The monitoring now happens largely in the background. Operators avoid another dashboard, and the technology team avoids checking camera status manually all day.
Good automation can remove a task from the operator's workload.
How should you plan for SOC system failures?
A SOC handles information that the organization considers important, and its design has to account for failure.
Plan for several possibilities:
- A workstation or server fails.
- Power is lost.
- Connectivity to a remote location disappears.
- The SOC itself becomes unavailable.
The response will depend on the organization's risk tolerance and operational requirements. Discuss it before the system is built.
Redundancy may cover power, servers, recording, networks, workstations, communications, remote access or the physical SOC location. Each organization needs to know which functions will stop when part of the system fails.
How should you plan for future SOC growth?
SOC requirements change as security teams add locations, cameras, systems and responsibilities. Acquisitions may also introduce technology that was never part of the original plan.
A system that fits on launch day can become restrictive sooner than expected. Open platforms can make large enterprise deployments easier to expand.
Design for likely growth without trying to predict every technology the organization may use over the next decade.
Leave room for more operators, equipment and integrations. Work through how another location or a new technology would fit into the existing workflow.
Planning for change during design is usually cheaper than changing the system after construction.
What makes a security operations center effective?
A modern security operations center may contain sophisticated technology. Operators should experience a straightforward system.
The right information appears when they need it, related systems work together and routine technical work stays out of their way.
Operators can understand an event, share information with the room and use their workstation for an entire shift. When something goes wrong, the tools help them make a decision.
A SOC works when the people inside it can understand what is happening and act.
About Continental Computers
Continental Computers is a security integrator and managed security service provider based in Los Angeles, California. We specialize in building and supporting physical security systems across facilities, people, and critical assets.
Our work includes defining requirements, integrating systems, designing operator workflows and supporting technology after deployment. That experience informs the recommendations in this guide.
Subscribe
Subscribe to our email list to receive updates about new product releases, updates and exclusive customer discounts directly to your inbox.