Filling the Cyber Gap: How Student-Powered SOCs are Building the Next Generation of Security Experts

This blog post was generated by Gemini using the transcript from the podcast episode.

The cybersecurity industry is facing a persistent skills shortage, and universities often struggle to provide students with the real-world experience needed to land a job in the Cybersecurity industry. Bruce Johnson of TekStream recently discussed a solution that is simultaneously addressing both problems: the student-powered Security Operations Center (SOC).

In a conversation with me, Bruce detailed this innovative private-public partnership, its unique funding model, and how it’s cultivating not just cyber analysts, but well-rounded professionals.

A Private-Public Partnership for Workforce Development

TekStream's student-powered SOC program is a well-established solution designed to automate proactive threat detection and remediation while also serving as a crucial workforce development initiative. This is not a simple outsourcing model; it’s a three-way collaboration that includes the state, educational institutions, and TekStream.

TekStream emphasizes that their solution is an "investment solution," where the institutions own their SIEM environment licenses and retain all built assets, fostering collaborative value building instead of an outsourced expense.

Training the Analytical Detective

Johnson noted that many new graduates struggle to find jobs due to minimum experience requirements. The student-powered SOC addresses this by providing practical, real-world experience in a working SOC environment.

The program focuses on transforming curious individuals into professional analysts. The onboarding process has been compressed to just six weeks , and students are trained on tools, runbooks, and cybersecurity fundamentals through hands-on labs.

The biggest indicator of a student’s success is a proprietary critical thinking test that assesses logical reasoning and due diligence. Students are incrementally matured by starting with low-complexity threats (like IP reputation and brute force) and gradually increasing to advanced topics like TTPs (Tactics, Techniques, and Procedures), guided by a complexity scoring system.

The Value of the "Transcript" and Placement

The program provides immense reputational value to participating schools because it boasts a 100% placement rate for students. This outcome differentiates these institutions from those offering only academic backgrounds.

For the student, the program produces a highly valuable "transcript". This document details:

• The specific use cases and threats the student tackled.

• The level of complexity involved.

• The student's productivity and quality metrics.

This transcript instills professionalism and serves as a practical skills record, giving students a significant leg up against other job candidates who only have academic backgrounds. Furthermore, the program incorporates integrated career counseling to review metrics and guide students toward roles like red teaming, forensics, or engineering.

AI Supervision: The Expert in the Loop

In a world where AI is automating level one (SA1) security tasks, students must transition from performing basic skills to supervising AI. Bruce Johnson acknowledged the concern that students might struggle with AI hallucinations or incorrect outputs due to their lack of industry experience.

TekStream’s answer is the "expert in the loop" approach. The program trains students in three areas:

1. Using AI in the context of incident response.

2. Supervising the AI.

3. Understanding AI more broadly.

The training environment requires students to second-guess the AI and understand the foundational work before they can effectively supervise. This approach emphasizes that trust in the technology is built incrementally over time.

An Investment in Future Talent

Beyond the immediate goal of cybersecurity, the student-powered SOC delivers an unexpected but profound benefit: the development of non-cybersecurity skills. Students gain critical life lessons and skills that help isolated individuals become more engaged, including: collaboration, accountability, professionalism, and general "adulting".

These detective and critical thinking skills are universally transferable to any industry. Ultimately, the program prepares students to handle complex threats and risk scenarios, teaching them that working in security is about developing a nuanced understanding of risk, not expecting "black-and-white answers." The demonstrated success—with students handling 50% of incident volume within a quarter of onboarding—proves this model is effectively bridging the skills gap and shaping the next generation of security professionals.