"Should we just hire someone?" is a reasonable first instinct. One person is easy to picture. The problem is that one person is not a SOC. Security monitoring only works if someone is watching when the attack happens, and attackers do not keep office hours.
How Many People Does a 24/7 SOC Need?
Do the arithmetic. A week has 168 hours. One full-time analyst works about 40 of them, minus vacation, statutory holidays, sick days and training. To keep one analyst on shift every hour of the year, you need roughly five to six people. A credible SOC also needs a second person on shift for escalation, plus senior analysts and a manager.
Then add turnover. Experienced security analysts are in demand across Canada, and losing one person from a five-person rotation means burnout for the rest.
What Else Does an In-House SOC Need?
| Component | Notes |
|---|---|
| SIEM or XDR platform | Licensing often scales with data volume |
| EDR across all endpoints | Required for meaningful response |
| Threat intelligence | Feeds and context for detections |
| Automation (SOAR) | To handle repetitive steps at scale |
| Detection engineering | Writing and tuning rules continuously |
| Playbooks and procedures | Documented response steps |
| Training and certifications | Ongoing, for every analyst |
| Management | Someone to run schedules, quality and reporting |
How Does Outsourcing Compare?
| In-house SOC | SOC as a service / MDR | |
|---|---|---|
| Time to operate | Many months to hire and build | Weeks to onboard |
| 24/7 coverage | Requires a full rotation | Included |
| Cost structure | Salaries, tools, management | Predictable monthly fee |
| Knowledge of your business | Deep | Grows over time; needs good onboarding |
| Breadth of threat experience | Limited to your environment | Sees attacks across many clients |
| Control | Full | Defined by contract |
When Does an In-House SOC Make Sense?
- Large organizations with complex, unique environments.
- Highly regulated sectors with requirements for in-house control.
- Organizations where security operations are a core competency.
- Cases where data cannot leave a controlled environment.
For a 300-person Ottawa technology company or a 600-person Winnipeg manufacturer, those conditions rarely apply.
What Is the Hybrid Model?
Many mid-sized companies settle on a hybrid. One or two internal security staff own the program, know the business and handle projects. A provider supplies 24/7 monitoring, response and threat hunting. The internal team gets escalations with context instead of raw alerts. This often gives the best of both: business knowledge plus round-the-clock coverage.
What Does a Good Handover Between Internal Staff and a Provider Look Like?
The provider should learn your environment during onboarding: critical systems, VIP accounts, normal working hours, change windows, and who can approve disruptive actions like isolating a production server. Your team should receive escalations that explain what happened, what was done and what needs a business decision. A monthly review keeps detections tuned and avoids the slow drift toward ignored alerts.
What Should You Ask Before Outsourcing?
Can the provider take response action, or only notify? Which data sources are covered? Where is data stored? How are escalations handled with your internal team and IT provider? Our questions to ask an MDR provider checklist covers this in detail. To understand what a SOC does day to day, see What is a SOC?, and for our offering, SOC as a service.