In every security operations center (SOC), technology gets the spotlight. Dashboards glow with metrics, alerts flood in by the thousands, and AI-powered tools promise to streamline detection and response. But in a recent episode of SOC Unlocked: Tales from the Cybersecurity Frontline, Lisa Tetrault, Senior Vice President of Security Services at Arctic Wolf, reminded us that the most powerful SOC capability isn’t a platform or algorithm—it’s culture.

For SOC leaders, that means creating intentional, repeatable rituals that keep analysts motivated, recognized, and resilient. It’s the difference between a team that survives and one that thrives. Here, we explore a few more of Lisa’s key insights on team culture.

Burnout has become the SOC’s silent breach. Studies consistently show that analyst fatigue contributes to missed alerts, high turnover, and a cycle of knowledge loss that no technology can fix. Lisa sees this up close in her work leading Arctic Wolf’s global SOC, concierge security team, and incident response division.

“Nothing screams analyst burnout more than just same task over and over again,” she explained. If leaders don’t proactively design for variety, growth, and recognition, even the best analysts lose their edge.

And when the people defending against adversaries no longer have the energy or focus to win, that’s when organizations are most vulnerable.

Lisa and her leadership team started with the fundamentals, how the work itself gets done.

• Rotating Schedules: Analysts move through a 10-week rotation that minimizes overnight shifts, balances time on weekends, and ensures people stay engaged in core hours.

• Work Variety: Instead of staring at a queue for eight straight hours, analysts split time across investigations, workflow improvements, and cross-functional projects. “We tried to give them a variety of different aspects of the role and keep the team engaged,” Lisa said.

• Integrated Workflows: Playbooks and interoperable tools prevent constant context switching. As Lisa put it: “If you continually have them context switch all the time, you’re gonna have a much lower quality of life across the board.”
  

These adjustments aren’t glamorous, but they’re practical and they create a sustainable environment where analysts can stay sharp without burning out.

Of course, even the smartest workflows won’t have measurable impact if analysts don’t feel valued. That’s why recognition should play a major role in SOC culture. Lisa implements the following key practices to ensure her team feels seen and rewarded for their hard work:

1. Celebrating Wins in Real Time
   Feedback from customers is shared openly in Slack, highlighting not just threats stopped, but the human stories behind those wins. “How was the customer delighted? How did we stop a threat actor in their tracks? We celebrate that with shout-outs,” Lisa said.

2. The Lego Program
   Analysts can also earn Lego bricks to mark milestones—from years of service to responding to zero-days to recruiting new teammates. “It was a good motivator,” Lisa said. The bricks serve as visible, playful symbols of progress that make intangible work feel tangible.
   

3. Alpha Dogs
   Each year, the top 1% of the team earns a spot in Arctic Wolf’s “Alpha Dogs” club. This year, winners were recognized with a trip to Nashville. As Lisa explained, “It’s about celebrating them and their accomplishments of what they’ve achieved.”

Recognition programs like these may sound small, but they have outsized impact. They replace the constant stress of threat response with moments of pride, belonging, and joy.

SOC leaders often think of culture as HR’s responsibility or as a side project. Lisa challenges that assumption:

“The senior leadership team really works together on looking at different ways to recognize team members. Culture isn’t like an Easy-Bake Oven. You can’t just set it up and that’s it. You have to all lean into it.”

That means recognition doesn’t come only from managers. Peers celebrate each other’s wins, executives model appreciation, and analysts themselves contribute ideas that make the culture stronger.

By democratizing culture, leaders can ensure it isn’t just a program but a practice.

For CISOs and SOC managers, the key to a high-performing SOC is to begin by focusing on the people. Metrics like mean time to detect or mean time to respond matter, but they’re outcomes of something deeper: engagement.

When analysts are supported with smarter workflows and recognized through intentional rituals, they’re more focused, creative, and resilient. They’re also more likely to stay.

And that loyalty matters. As Lisa reminded listeners, “If you’re not all continuing to do it over and over again, it’s just not going to work.”

So what does it look like to apply Lisa’s insights in your own SOC? Start small, but stay consistent:

• Audit your rotation schedules and adjust for fairness and sustainability.

• Introduce at least one variety mechanism per shift to break monotony.

• Create a “wins” channel to celebrate both team and customer outcomes.

• Design a recognition system that’s simple, visible, and fun—whether that’s Lego bricks, badges, or another symbolic gesture.

• Don’t relegate recognition to managers; invite peers and leadership to participate.

Over time, these daily habits build trust, loyalty, and performance. They’re not just “nice to haves”—they’re essential to SOC resilience.

Cybersecurity leaders face escalating threats, AI-driven social engineering, and resource constraints. But the greatest vulnerability inside any SOC may not be the technology gaps—it’s culture gaps.

As Lisa put it best: “You have to all lean into it, every single day.”

Technology may detect anomalies, but people stop breaches. And the best way to empower those people is through a culture that sustains them.

Check out the full episode below!