How to Address Shift Stress in Security Operations Centers

Could having the pilot snoozing in the cockpit make your flight safer? Studies report that short naps can improve a pilot’s alertness, especially when shifts stretch across multiple time zones and long hours.

Recent research on consumer opinions shows that the American public is leery of this, but one study found that pilots who took short, 40-minute naps (called controlled rest in position or CRIP when in the cockpit) had faster reaction times and higher subjective alertness.

Pilot fatigue leads to slower reaction times, reduced attentiveness, and impaired memory, which could result in inaccurate flying, forgetting routine tasks, poor decision making, and accidents.

Long shifts with few breaks have similar effects on professionals in other high-concentration roles, such as physicians, first responders, and security operations center (SOC) personnel. While midflight napping remains a decision for aviation regulators, security leaders have many options to relieve stress for SOC operators and security personnel.

“Global security operations center (GSOC) managers need to consider the neuroscience of the brain and what we can reasonably expect people to be able to do,” says Sarah Powell, director of emergency management at Temple University. “It’s a common job description for a GSOC operator: you must be able to multitask in a crisis. And that’s just something human brains aren’t wired to be able to do in a stress response.”

Stress responses are different from typical overwork or fatigue; a stressor triggers physical and psychological changes that together form the “fight or flight” response: faster breathing, quickened pulse, and tense muscles. In the short term, the stress response heightens alertness, but prolonged exposure to these high-stress situations—particularly in conjunction with long shift lengths—eventually takes a toll on productivity, efficiency, and retention, Powell says. Any tasks involving the prefrontal cortex of the brain—the area responsible for reasoning, rationality, and executive decision making—will be hampered by the stress response.

Employee retention can also be impacted. Working in SOCs is so stressful that 65 percent of operators are considering changing careers, according to a June 2019 Ponemon Institute study, Improving the Effectiveness of the SOC. More than 70 percent of the IT security practitioners surveyed said that the increasing workload SOC staff face was causing burnout. Leading factors behind this stress included the around-the-clock on-call culture, the inability to recruit and retain expert personnel, the inability to capture actionable intelligence, the lack of resources, and the “complexity and chaos” within the SOC.

Nearly 50 percent of respondents said their SOC teams would benefit from stress management programs and psychological counseling, and 39 percent said they would like to have better support and recognition from senior leadership.

The task saturation inherent in SOCs eventually runs up against a wall; operators have only so much bandwidth to devote to different tasks, especially in a stressful situation, Powell says.

“You need to find ways to alleviate task saturation and reliance on the prefrontal cortex,” she adds. This could include automating some basic tasks, devising checklists for operators to follow, and practicing scenarios to develop a reflexive, natural response to high-pressure situations.

In the Ponemon study, two-thirds of respondents said automating the SOC workflow would most ease the pain of working in the high-stress environment, reducing the burden of responding to repetitive or low-complexity issues.

Another factor that can lessen tension on security monitors while improving results is adjusting shift lengths and assignments.

Changing from a traditional 12-hour shift schedule to shorter, seven- to nine-hour shifts enables operators to remain alert and provide better customer service throughout their shifts without “hitting a wall,” says Kerry Jones, cofounder and director of independent remote monitoring center Professional Surveillance Management (PSM).

The 12-hour shifts are common practice but tough on employees when factoring in other off-the-clock commitments. Between a 12-hour shift, a one-hour commute, and seven hours of sleep, employees are left with very little time for their family, social life, or self-care, Jones says.

PSM rotates its shifts in a predictable pattern, so employees will work afternoons for four days, followed by a few days’ rest, three night shifts, and another rest period before repeating the cycle. This program lets afternoon (4:00 p.m. to 11:00 p.m.) and night shift (11:00 p.m. to 8:00 a.m.) personnel balance their professional and personal lives more effectively and lower their risk of burnout, Jones says.

She notes that since implementing this program, PSM’s team of 12 operators only took four sick days in 2018. Jones and the operators attribute this to the more balanced work schedule.

The schedule also produced a high retention rate, which benefits PSM both in hiring costs and system development. Experienced monitors’ input is crucial because PSM writes and uses its own software.

“They live and breathe remote monitoring,” Jones says. “We nurture the individual talents of the team. One of my favorite sayings is ‘Why hire chess masters and play the pieces yourself?’ I could sit at a remote operating terminal for 100 years and never be as good as my senior operators.”

At PSM, each operator’s role is slightly different. One operator who enjoys writing is tasked with writing incident reports and contributing to the company’s blog. Another detail-oriented operator carries out internal audits.

“If somebody has a strength, then as a human being that strength shouldn’t be left dormant,” Jones says. “If the company benefits from that strength, it’s a bonus.”

Organizations that do not make changes to their 12-hour shifts will likely lose employees, Powell says.

“You want to think about your duty of care, of course, but you also want to think about what it means to your organization to have high turnover,” she explains. “If you want to retain people, you have to figure out ways to make the job bearable, even fun, and challenging in a good way—find opportunities for development, learning, practice, and team building.”

“In the contract security world, there is oftentimes a treatment of employees as just bodies to fill the post, and that will only get you so far,” Powell continues. “You are not going to have the same level of engagement.”

For the operators’ health and wellbeing, she adds that GSOC managers should build in downtime, breaks, and opportunities for stress relief on the job. When designing SOCs, leadership should ensure break areas are separate enough from the workspace that employees feel they can shift their focus away from a crisis and unwind. 

If managers have a period where they have to wind up operations, Powell notes, afterward ensure there is a period of recalibration where staff can recover. For extended high-stress situations, such as managing an ongoing crisis like a natural disaster, she recommends rotating staff out of stressful positions and ensuring there is enough redundancy to keep the SOC running without overtaxing key personnel. (For more on team stress management and health, see “Under Pressure: Managing Team Wellness.”)