Which metrics would you report on to show the SOC is doing its job?

Report outcome metrics alongside activity. Useful ones are time to detect and time to contain by severity, the proportion of incidents found by your own detections versus reported from outside, validated detection coverage against your priority techniques, false positive rate per rule, and the age of open risk exceptions. Avoid raw alert counts and tickets closed as headline numbers, since they reward noise over security outcomes.

My headline is the proportion of incidents we detected ourselves versus ones we learned about from a user, a customer, a vendor or law enforcement. That single number says whether the function is working. Underneath it, time to detect and time to contain split by severity, because averaging a phishing report with a ransomware attempt hides everything that matters. Then coverage against the techniques we decided were priorities for our threat model, graded from validation testing rather than self assessment, and false positive rate per rule so tuning work has a number attached to it. I deliberately avoid leading with alert volume or tickets closed, because those rise when the environment gets noisier, and I have watched a team be congratulated for a metric that was pure telemetry regression. When a month is bad I present it with the reason and the fix, because the moment you curate the dashboard you lose the ability to ask for budget with a straight face.