u/Mafriel_

Hey everyone, I need a reality check because I’m starting to second-guess myself. I honestly don't know if I'm the one being difficult or if I've just landed in an absolute clown show.

I work as a systems administrator. Overall, I actually like the company I'm at. The environment is fine, I get along with my coworkers, and I genuinely enjoy my actual job. The issue is that the company also sells a SOC (Security Operations Center) service.

Up until now, this entire SOC has been run by a single guy. He's completely on his own and hasn't received a shred of proper training from the company (whatever he knows, he learned on his own or at previous jobs). On top of that, the platform we use (an XDR) is a total janky workaround—it's a mono-tenant solution that we are forcing to run as multi-tenant to manage multiple clients, with all the massive limitations and data risks that come with it.

The owner finally realized the SOC isn't working like this, but instead of hiring dedicated personnel, he decided that "we need to make what we already have work with internal resources." Translation: he decided to draft me and another sysadmin to force us into doing SOC shifts. The plan is a weekly rotation where each of us spends one full week a month, 8 hours a day, glued to the dashboard monitoring security alerts.

The problem is, I don't like cybersecurity, I know nothing about it, and it's not my job. Taking me away from my actual department for a whole week every month just means my own clients and sysadmin projects are going to pile up and fall behind.

A few days ago, we had a "training" session with the owner. I was hoping he’d actually walk us through step-by-step procedures on how to handle alerts. Instead, he just pulled up a bunch of logs and asked us, "What would you guys do here?". In my head, I was literally screaming, "How the fuck should I know? You tell me! I'm here because I've never done security in my life!". I felt like a newborn baby; I literally understand nothing of what I'm looking at.

Seeing how things went, I went to talk to my direct manager to tell him I'm seriously struggling and that I don't have the skills for this. The result? He got incredibly pissed off. He told me "we are only at the beginning of the training" and that if I have a problem, I should go talk to the owner directly (basically passing the buck so he doesn't have to deal with it). Both my manager and the owner are completely aligned on this: there's no escaping it, the shifts have to be done.

I didn't have the guts to tell my manager that I absolutely hate the idea of doing security, especially since he blew up over a simple vent. But I'm genuinely anxious. If a piece of ransomware gets through during my shift week and I miss it because I don't have the trained eye for it, whose fault is it going to be?

Am I crazy for pushing back on this? Is it normal for a company to expect to completely alter a employee's role overnight just to save money on a new hire? How can I stand my ground with the owner without starting a war, considering I actually want to stay at this company for everything else?

Thanks to anyone who can give me some advice.