15. SOC operations

L1 Analyst
    ↓
L2 Analyst
    ↓
L3 / Detection Engineer
    ↓
Incident Responder / Threat Hunter

And concepts like:

• alert queue
• severity
• priority
• SLA
• escalation
• ticketing
• incident lifecycle
• documentation
• evidence
• handoff between shifts