I’m not currently doing it, nor have I read this whole article, but “SOC Architecture – How to build and run a Security Operations Center,” seems like a good article to reference to start with if I happen to consult with someone who is attempting to build a SOC.