I will write a clear incident response runbook or security sop

No documented process for handling security alerts? I'll fix that.

I'm a SOC L1 analyst working hands-on daily with Splunk, Microsoft Sentinel, and Cortex XSOAR. I write clear, structured runbooks and SOPs based on real SOC triage workflows the kind your team can actually follow under pressure, not vague theory.

Each runbook tells your team exactly what to check, in what order, and when to escalate. No missing steps, no unexplained jargon.

Common runbook types I write:

- Phishing email reported by a user

- Malware or beacon alert

- Brute force / failed login spike

- Suspicious outbound traffic or DNS activity

What you get:

- Clear, numbered triage steps for your chosen alert type

- Defined escalation criteria

- Clean, reusable document (PDF and/or Word)

- Optional flowchart diagram for visual teams (Premium)

Ideal for small security teams, IT teams without a formal SOC, or startups needing a real starting playbook instead of a blank page.

Not sure which alert types to prioritize? Message me before ordering happy to help you figure out what your team needs most.