Workshop on SOC Operations and Construction (WOSOC) 2025 Program

08:30 - 09:00

Welcome

09:00 - 09:50

Keynote: “What a SOC wants, what a SOC needs” by Jason Rouse, Bloomberg

10:00 - 10:20

Morning Break 2025

Pacific Ballroom D

10:20 - 12:00

Session 1

• Tools Make Me Snore: A Next-Gen Framework for Training SOC Analysts Non-Perishable Skills

  Francis Hahn (USF)
• A Test Tool to Evaluate the Skill Sets of Tier-1 Security Analysts in a SOC Environment: A Case Study from Recruitment to Operations

  Leon Kersten (TU Eindhoven)
• Evaluating the Impact of Cybersecurity Training: Exploring the Utility of Behavior Intentions and Security Best Practices

  Chris Fennell (Walmart)
• Human Performance in Security Operations: A Survey on Burnout, Wellbeing and Flow State Among Practitioners

  Kashyap Thimmaraju (TU Berlin)

12:00 - 13:30

Lunch 2025

Loma Vista Terrace and Harborside

13:30 - 15:00

Session 2

• From Observations to Insights: Constructing Effective Cyberattack Provenance with PROVCON

  Anis Yusof (NU Singapore)
• Tackling Long-Term Network Trace Retention Challenges Using Deep Generative Compression

  Fenghao Dong (CMU)
• Authentication-Event Processing for Enhanced SOC Investigations

  Seth Hasings (University of Tulsa)

15:10 - 15:40

Afternoon Break 2025

Pacific Ballroom D

15:40 - 17:20

Session 3

• Detection-as-Code: Build threat detections the way you build software

  Cherlynn Cha (ExpressVPN)
• AI Adoption and Skill Development in Security Operations Centers

  Philip Stoner (Deloitte)
• To understand anomalies, you must first understand your past

  Wes Hardaker (USC)
• Mismatched SOCs: A Case Study of Cybersecurity Goal Incongruency Within An Academic SOC

  Andrew Morin (University of Tulsa)