What Is a Security Operations Center?
It’s a staple of cinema: a darkened room full of people bent over computers, their faces lit by screens displaying an array of impending dangers. A SOC is similar in energy: Analysts pore over potential threats, flag suspicious activity and escalate concerns to protect the company’s data.
“The security operations center and the people within are where the initial steps and triage happen,” explains Alexandria Donathan, executive director of the Institute for Cyber Security.
Regardless of industry — whether it’s healthcare, finance, real estate, education, manufacturing or a government agency — everything has systems, data and information to protect. A SOC analyst is the gatekeeper for these systems.
“A good SOC analyst is not valuable just because they understand technology. They also have to be curious, patient and able to make good decisions. They need to ask the right questions, follow the evidence, write down what they find and know when something needs to be escalated,” explains Lanham. “When they do that well, they can help an organization catch problems early, respond faster and avoid a much larger incident.”
DISCOVER: Quantifying risk can help justify cybersecurity investments.
SOC Project Illustrates the Value of Industry Partnerships
In 2025, Marshall University announced its partnership with Intuit — something that Donathan believes higher education needs more of. “Industry and academia work together to align education with real, operational workforce demands, and with that, students graduate with applied learning skills they’re ready to use on day one,” she says.
This June, Intuit launched a SOC at Marshall University. The partnership covers the cost of two full-time employees who will be working out of a shared space on campus until the new Institute for Cyber Security building is finished in August 2027.
Beyond securing the physical space, the institute had to ensure that access was restricted to the area where these computers will be held. Students will be managed by a member of the institute, but they’ll be working directly with Intuit, including using their proprietary data. Students will have the unique advantage of adding real Intuit work experience to their resumes while still in college. Donathan and her team also put students through a rigorous interview process to reflect the experience of a post-graduation job hunt.
The institute works closely with faculty from across the university to ensure that curricula mirror industry standards and employer needs. The SOC — and a future university-affiliated one — are examples of this relationship. The institute has already created several microcredentials, which are short programs or courses focused on a specific skill. While students from any major can apply to the SOC, the institute has curated a list of suggested courses that interested students can consider taking before applying.
“Higher education has an important role to play in closing the cybersecurity workforce gap. Where the institute helps is making those industry connections, but where the colleges help is making sure that students are trained appropriately. Doing so requires very strong alignment between academic, employers and operational realities,” Donathan says.
Donathan believes the future of the cybersecurity workforce will increasingly depend on these real-world, hands-on learning experiences. “Creating a sustainable talent pipeline that strengthens both economic opportunity and cyber resilience can’t be done without the academic side,” Donathan says.
While cybersecurity could easily be viewed as “just an IT problem,” Marshall University and the Institute for Cyber Security believe it’s intricately woven into the tapestry of national security and resilience. The industries that use SOCs include hospitals, banks, utilities and government agencies. For Lanham, national resilience starts at the local level — as local as West Virigina.
UP NEXT: Student-staffed security operations centers help protect university assets.
Lanham explains that students will learn how to “recognize suspicious activity, monitor systems, respond to alerts, investigate what is happening and explain it clearly to others.” It’s these moments — and the skills that are learned and reinforced — that makes the SOC such a valuable asset.
Marshall University and the Institute for Cyber Security — in partnership with Intuit — are not only creating a more qualified workforce, they’re also training students with the hope that they’ll put their talents to work back in their hometowns.
“The SOC is not just a learning space; it is helping to build the workforce,” Lanham says. “Students are seeing how the work is actually done, how professionals think through problems and what employers are really looking for.”
