Oh, sorry. Security Operations Center.

They're basically the ones watching alert dashboards like suricata all day, investigating issues and trying to isolate systems that have been compromised.

So they're the operational part of an IT security department. Sometimes they're also called CSIRT.