Part III described the AI team that works inside the security operations centre (SOC). This chapter describes the human team around it: which roles grow when triage is largely automated, which shrink, which are new, what shape the team takes, how a role is written down as a versioned charter, how the night is staffed when agents act while people sleep, and where the team meets the security architect, platform engineering, IT operations and the business. It concerns all five blue team functions: B2 Detect gains the detection engineer, B3 Investigate the investigation lead and the class owner, B4 Respond the incident commander and the agent operator who can stop what the team has started, B1 Anticipate the intelligence analyst, and B5 Learn the purple team coordinator and the evaluation engineer who test the machinery that the others rely on.
The chapter applies two earlier conclusions. A role is itself a versioned artefact, with a mandate, accountabilities and decision rights written in a charter that a reviewer can read and a test can check (The Transformed Security Architect, Chapter 4) (66, Nordqvist, 2026). And organisational design is architecture by other means: the structure of a team determines the structure of the systems it builds and the seams where they fail (AI Governance, Chapter 12) (62, Nordqvist, 2026). The question of where the next generation of analysts comes from is left to Chapter 23. This chapter shows the shape of the team that has to answer it.
The traditional SOC is a pyramid. A wide base of tier 1 analysts watches the queue, validates alerts, enriches them and escalates what looks real. A narrower tier 2 investigates the escalations. A small tier 3 hunts, reverse engineers and builds detections. A manager sits at the top. The shape was a response to volume: most alerts were noise, validating them was repetitive, and the cheapest labour that could do it was the least experienced. It was also a school. A new analyst learned what normal looks like by seeing thousands of ordinary alerts, and was promoted when the pattern recognition was good enough to be trusted with an investigation.
Primary topics explored
- The pyramid under strain
- Roles that grow
- New roles
- Shapes of the team
- Role charters
- Rotas and the night
About AI Blue
AI Blue is Book 8 of The Transformed Architecture. It examines how the blue team, the people and functions that defend an organisation, is transformed when artificial intelligence takes part in their work: anticipating, detecting, investigating, responding and learning, the team's own AI and how to verify and protect it, operating models, roles, decision rights, regulation and measurement, and the careers and wellbeing of the people involved, for European enterprises and public authorities.
It builds on the conclusions of Architecture as Code, AI Governance, AI Platform and Security, AI Red Team, AI Threat, The Transformed Security Architect and AI Boss.
Chief information security officers, heads of security operations, SOC managers, analysts, detection engineers and incident commanders, security and AI architects, boards and management bodies, procurement leads, works councils and unions, data protection and audit functions, and public-sector leaders.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 17: Team Design and Roles: After the Tier-1 Pyramid in AI Blue gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “The Team in the Organisation” and is one of 32 drawn from the manuscript.