“I am leading a SOC for the first time”
Every step opens something already published on this site. Skip what you already know; the order matters more than the completeness.
The MITRE book. The single most useful text for a first-time SOC lead, and it is free.
Two pieces on what the SOC is actually for, plus SOC vs NOC for the conversation you will have with IT leadership.
Three IR19 conference sessions that still hold up. The alert fatigue one will feel personal.
The Runbook for the queue your team runs. Use its verdict scale and monthly numbers as your first management instrument.
The paperwork you now own. Compare the library version with what you inherited, and fix the gaps.
The loop that turns incidents into improvement is now your job. This Runbook is the machinery.
Metrics that drive the right behaviour, and the ones that quietly drive the wrong one.
Practice for the budget meeting. Allocate, get breached, defend your choices.
First-time leadership is the loneliest stretch of the career. Thirty minutes a month with someone who has done it changes the year.