Staffing for MSSPs and the security side of an MSP

A rotation is a schedule, and a schedule is several seats

Start from the hours you promise clients, not from headcount. A position covered around the clock is 168 hours a week, and one person works the hours you agree with us, so that position is several people plus someone to cover planned absences. Write each block as its own seat: the tier, the hours, the consoles, where escalations land. A rotation with no slack fails the first time a seat is empty.

Then choose where each block sits. Which region suits a seat depends on its hours, and Dokimo recruits in the Philippines and in Mexico. Central Mexico runs an hour behind US Eastern in winter and two hours behind during US daylight time. A Philippine workday falls in the US evening and overnight. Dokimo doesn't promise a time zone. The hours are agreed seat by seat.

Keep the ladder short. Tier 1 triage, Tier 2 investigation, and a Tier 3 analyst who tunes detections and owns escalations don't all have to sit in the same place. You may want the decisions on containment, client notification and anything regulated held by a named US-side lead. Dokimo doesn't design your SOC. It fills the seats you design, and if your design says a US person holds the escalation, a US person holds it.

The four roles on a security bench

SOC analysts work the queue at Tier 1 through Tier 3, and the page on remote SOC analysts covers that seat in depth. Security engineers own the stack: EDR and MDR tooling, identity, hardening and the security work at client onboarding, which the page on remote security engineers covers. Vulnerability management analysts run scans, sort findings by what matters at that client, open the remediation tickets, and chase them until they close.

GRC and compliance analysts do the paperwork side of a security practice: collecting evidence, mapping controls to a client's framework, working through client security reviews, drafting policies, and keeping the tracker current. These seats prepare and your own people approve. A GRC analyst doesn't attest to anything, and the review and the signature stay with a named person on your side.

SOC analyst seats run from $2,000 a month in the Philippines and from $2,750 a month in Mexico. Security engineer seats run from $3,500 a month in the Philippines and from $4,150 a month in Mexico. GRC and vulnerability management seats are priced on request, and the level of the work sets where any seat lands. Five things sit inside each price: the person's pay, the employer costs their country's law requires (year-end pay included), the search and screening, their employment and payroll through Dokimo's employer of record (EOR) partner, and one monthly invoice. Licenses, which your MSSP provides, stay outside the price. A bench of several seats still comes on one invoice, at a fraction of a comparable US hire per seat.

Four seats, four live tests

Every candidate is tested on the real work before you meet them, and the test changes by role because the work does. An analyst gets an alert to work. An engineer gets a config to review. The other two bench roles get a practical assessment built for the role.

Each test is a live piece of the real work. Dokimo doesn't assume any candidate already knows your SIEM, your EDR or your GRC platform. Reading the result takes judgment: what the candidate flagged, what they set aside, and whether the write-up would hold up in front of a client's security team.

Dokimo won't quote a time to shortlist, because the testing comes first and a number promised now would be one to apologize for later.

What stays US-side on a security bench, and the surge cover this can't be

Some client environments must stay US-only, and your agreements decide which. Two kinds are closed to these seats outright: environments with export-controlled defense data and criminal justice systems, where Dokimo will not place anyone. Beyond those, the limits are contract or insurance terms that vary by client. HIPAA on its own doesn't ban work from outside the US, but an MSSP that touches health data has agreements to read and a risk analysis to keep, and many clients' terms go further. One workable answer is a US-only pod for those clients, and Dokimo fits seats to whichever answer you choose.

The analysts sign nothing. No incident report, client notification, attestation or compliance statement goes out under the name of anyone in a remote seat, and none of them is the voice a client hears on a serious incident. Those stay with a named person on your staff who reviews the work and puts a name to it. Dokimo makes no claim of any compliance certification, for itself or for anyone it places, and a placement doesn't stand in for the controls and audits your own program has to show. You answer your clients' security reviews yourself, accurately, including the questions about where your staff sit.

Two more limits are practical rather than contractual. On-site work stays local: forensics on a physical device, hardware, anything that needs a person in a client's building. And short-term surge cover isn't what these seats are for. If you need extra hands around an incident, or an incident response retainer, look elsewhere. A seat takes time to recruit and ramp, so it doesn't suit a short spike. Nothing here is legal advice; your agreements and your counsel decide.