Student-led Security Operations Center an instant success for Miami
Student-led Security Operations Center an instant success for Miami
At the beginning of 2025, we announced that we would be implementing a student-led security operations center (SOC) here in IT Services. As of the Fall 2025 semester, we are up and running!
In the first few weeks of operation, the student-led SOC had already seen its share of action. As a dedicated space for student employees to monitor and respond to cybersecurity threats and incidents, the goal is for students seeking experience in the cybersecurity field to monitor the university's network for security threats, analyze security alerts, and respond to any incidents.
Security Onion: Layers of tools for a comprehensive view into our systems
The students all have access to something called a “security information and event management” (or SIEM) tool, which is a central repository of data that enables them to monitor for potential threats in real time. The SIEM provides access to threat detection and threat intelligence, allowing these students to see and act on particular kinds of malicious activity within Miami systems.
Jake Harrison, information security analyst, manages the students and oversees the operation of the center. He stressed the importance of consolidating all of that threat data into a single platform – because that makes it easier to see and act on information. The SIEM tool Miami chose is an open-source platform called Security Onion, and Jake noted that we started seeing an immediate return on the time investment necessary to set up the software.
“We were undergoing a sustained phishing attack for several months involving a number of compromised accounts prior to our SIEM, which was consuming a large portion of the information security team's time and effort to keep contained,” he said. “Once the SIEM came online, we were able to leverage the tactics of the attack and craft alerts which improved our response time so drastically that we were able to effectively shut down the campaigns.”
Successful threat detection with students in the lead
Now that the student security analysts have access to the SIEM as well, they are helping the information security team grow their capability to detect and respond to threats. Not only are the students monitoring and responding to existing alerts, they are also leveraging the threat intelligence provided by Security Onion to help identify new tactics from threat actors (the bad guys!) so that we can catch their new schemes, too. And it’s helping not only Miami, but also our higher education partners.
“Having them working side by side with us has not only improved Miami's security posture,” Harrison said. “It’s also allowed us to share some of our benefits with our higher education community. In the last two weeks, the SOC identified eight compromised accounts from other institutions and reached out to alert them.”
Let’s meet the students!
Anyway, enough about that . . . let’s meet our student analysts!
Jon Schooley
Jon is a senior with a major in computer science. As a part of the SOC team, Jon’s role is to review different security logs pertaining to Miami’s multiple IT services such as DUO, CAS, and email. When asked what his favorite part of his job was, he answered, “All the training.” When Jon isn’t at work or going to classes, he enjoys going to the gym and watching sports. He said he is a big Cincinnati REDS guy. Jon’s postgrad plans are to work at U.S. Bank.
Ali Machado
Ali is a senior with a major in information and cybersecurity management. When asked what the main role of her job is and her favorite part of the job, she answered, “The main role of my job as a Non-Technical Security Operations Center Analyst is to standardize, clarify, and measure the technical work of the SOC. I do this by translating technical security findings into clear, step-by-step guides, training programs, and executive summaries. My favorite part of the job is getting hands-on experience in cybersecurity operations, while at the same time strengthening the security at Miami.” Ali’s favorite thing to do when she isn’t at school or work is travel, and her favorite artist to listen to is Taylor Swift.
Cameron Paul
Cameron is a senior with a major in cybersecurity. When asked what the main role in his job is, he answered, “The main role of my job is to wait for alerts to pop up and then investigate those alerts and what caused them to make sure there is no suspicious or malicious activity. Not only that, but I also do continuous training and education to ensure that I am up to date on current events and strategies in cybersecurity.” Cameron was also asked about some of his personal interests, activities, and hobbies, and he answered, “In each of my previous years at Miami, I was in the marching band. This year, however, I have been too busy with work to do that, but I am still an active participant in that community. I am a member of Tau Beta Sigma, a co-ed music service sorority on campus. I also like to play tabletop games with my friends, and I enjoy listening to punk and metal music.” Lastly, Cameron would like everyone to know that he has a pet leopard gecko named Diego.
Yusuf Sevkli
Yusuf is a senior with a double major in computer science and cybersecurity. When asked what Yusuf does in his role as part of the SOC team and what his favorite part was, he said, “In my role, I primarily focus on reviewing access logs, triaging security alerts, documenting incidents, and collaborating with security teams to help maintain the safety and compliance of our network. My favorite part of the job is working alongside the security team. It's rewarding to see the direct impact of our work in keeping the university's systems secure.” Sevkli also said, “I'm particularly interested in secure software development and the intersection of security and artificial intelligence.” When Sevkli is outside of academics and work, he enjoys playing table tennis, soccer, and piano.