MCWBTA · Level 1 → 2 · Investigate
Your first real job in a security operations centre.
Run the daily security operation: review what the tools flag, decide what is real, take the routine action, and escalate the rest with notes somebody can actually use. No security experience required.
- No experience needed
- 26 live classes
- 52 hours tutor-led
- 12 modules
- Online, UK hours
- All sessions recorded
- 6 months’ lab access after
Start dates agreed with you · two to three classes a week, around your job · your CV rewrite and LinkedIn optimisation included
Illustration of a SOC shift: four alerts – impossible travel, an encoded PowerShell command, a phishing email reported by staff and a port scan – each triaged and given a verdict, then an escalation note written for Tier 3.
Firstly, the job
What is a security operations centre? Where the alerts land.
The red team attacks; the blue team defends. A SOC is where the blue team sits, watching an organisation’s systems all day. Tools raise alerts constantly and most turn out to be nothing – the job is telling the difference, handling what you can, and passing on what you cannot with enough detail that nobody starts from scratch.
This programmeTier 1 and 2
Tier 3, nextBlue Team Specialist- Blue teamDefensive security
- SOCThe team that watches
- Tier 1 and 2Where the analysts sit – and where this programme takes you
Who this is for
Six ways people arrive here. All of them work.
The first rung of the ladder. It assumes you can use a computer properly and are willing to learn – and nothing else about security.
- Students and graduatesComputing or otherwise – and you want the practical skills employers test for.
- Career changersRetail, healthcare, the forces, teaching, finance – from outside IT completely.
- Help desk and IT supportYou keep getting the security tickets and want to do them properly.
- Sysadmins and engineersThe endpoint, identity and network modules will feel familiar fast.
- Certified, but never done itSecurity+, SC-900 or similar, and told you lack hands-on experience.
- Returning to workCurrent tooling and something recent for your CV – at a pace that can flex.
What you need on day one
- A laptop or desktop that runs a modern browser
- Enough comfort to install software and follow written steps
- Around 20 hours a week, including the classes
- Willingness to be wrong in front of people while you learn – that is the whole job, honestly
What you do not need
- Any security experience or certification
- A computing degree
- Networking knowledge – the first two classes cover it
- Coding – you will write queries, taught from nothing
- Your own lab hardware – you use free Microsoft trial tenants
Before class one we send a short primer – the vocabulary and the handful of concepts worth arriving with – plus step-by-step lab setup. Nobody is expected to arrive knowing it.
What it looks like
From no experience to a portfolio, in order.
Roughly three months at two to three classes a week. Your tutor adjusts the pace to you.
- Weeks 1–2 · Get your bearingsThreat landscape, security principles, how a SOC is structured, and the cloud and identity groundwork. Your lab tenants go live.
- Weeks 3–6 · Learn the tools properlyMicrosoft Sentinel end to end, your first KQL, triage method, and working a real queue without drowning in it.
- Weeks 7–10 · Investigate across the estateEndpoint, phishing and email, identity risk, vulnerability scans, network and firewall logs. Weekly marked assignments.
- Weeks 11–13 · Put it togetherIncident management, compliance, GenAI and AI security monitoring – and the live SOC shift simulation.
- Then · Get job-readyCV rewritten, LinkedIn optimised, mock interviews, the private job group – and your badge.
The curriculum
12 modules, 26 classes. Pick one to look inside.
Each square is a two-hour class. Class counts are indicative: your tutor adjusts them to your gaps and agrees any change with you in advance. These modules are shared, class for class, with Blue Team Specialist.
Class map 26 classes · 12 modules · 2 hours each
Module 01 · 1 class · class 1
Cyber Security Fundamentals
The threat landscape and the attack lifecycle. CIA triad, defence in depth, least privilege. NIST CSF, CIS Controls and MITRE ATT&CK as the frameworks you will actually use.
Module 02 · 1 class · class 2
IT & Cloud SOC Fundamentals
How a SOC is structured – tiers, escalation, MTTD and MTTR. Azure and Microsoft 365 tenant structure, shared responsibility, and which services produce the telemetry you read.
Module 03 · 5 classes · classes 3–7
SIEM & SOAR Operations
Microsoft Sentinel end to end: connectors, KQL, analytics rules, incident investigation, triage method, false-positive tuning and playbooks.
Module 04 · 2 classes · classes 8–9
Identity & Access Monitoring
Entra ID operations, Identity Protection, suspicious sign-ins and impossible travel, and containing a compromised account.
Module 05 · 3 classes · classes 10–12
Endpoint Monitoring
Defender for Endpoint alerts, process trees, living-off-the-land and PowerShell abuse, device compliance, and isolation.
Module 06 · 3 classes · classes 13–15
Network & Firewall Monitoring
Protocols and trust zones, firewall and NSG logs, DNS anomalies, packet analysis in Wireshark, and firewall-led investigation.
Module 07 · 2 classes · classes 16–17
Email & Phishing Investigation
What SPF, DKIM and DMARC failures tell you, Defender for Office 365 submissions, header forensics, message trace, quarantine and BEC indicators.
Module 08 · 3 classes · classes 18–20
Vulnerability Management
Scanning, reading the output, prioritising with CVSS, EPSS and asset criticality, and tracking remediation with the teams who own the fix.
Module 09 · 1 class · class 21
Threat Intelligence Monitoring
Defender Threat Intelligence, feeds and IoCs, and escalating what is actually relevant to your organisation.
Module 10 · 1 class · class 22
Compliance Monitoring
How ISO 27001 and NIST requirements land on daily tasks, Intune device compliance, and collecting audit evidence.
Module 11 · 2 classes · classes 23–24
Incident Management
Severity and priority, PICERL at analyst level, ITSM platforms (Jira, ServiceNow, Halo), and case notes and handovers.
Module 12 · 2 classes · classes 25–26
GenAI & AI Security Monitoring
Using Security Copilot in triage and knowing what still needs verifying – and monitoring the AI itself: inherited permissions, prompt injection and Purview DSPM for AI.
Finishes with
A live SOC shift simulation
A full alert queue, worked under time, with a proper handover at the end. It is the closest thing to the task an interview will set you – and the thing you talk about when someone asks what experience you have.
The tools you’ll use
The Microsoft Security stack most UK teams run, and the tools you will meet alongside it.
- SIEM
- Falcon · EDR
- EDR
- Email security
- Nessus · Vulnerability
- Case management
Product names and logos are trademarks of their owners, shown only to identify the tools the programme teaches. No partnership or endorsement is implied.
What you will be able to do
Eleven things you can do on day one of the job.
Not topics covered: tasks you can perform, unsupervised, in a live environment.
Work a SIEM alert queue in Microsoft Sentinel and justify every verdict you record
Investigate a reported phishing email – headers, delivery path, verdict, quarantine or release
Review endpoint alerts in Defender for Endpoint and isolate a device when it is warranted
Spot a compromised account in Entra ID and take the right containment action
Run a vulnerability scan and turn the output into a prioritised, assigned remediation list
Tune a noisy rule so the queue stops drowning – without losing the detection
Check device compliance and chase the non-compliant estate to closure
Log and prioritise an incident properly in ServiceNow, Jira or Halo
Read a threat intelligence feed and act on what is relevant to your organisation
Review firewall logs and trace suspicious traffic during an investigation
Use Security Copilot to speed up triage – and know which parts of its answer still need checking
Certification
Earn the badge, don’t just attend.
MyCyberWay issues two different things, and the difference matters to anyone reading your profile.
Verifiable digital badge
MCW Certified Blue Team Analyst
Issued through Sertifier · shareable to LinkedIn
Skills attached when you add it to LinkedIn
Microsoft SentinelKQLIncident triagePhishing analysisEndpoint securityVulnerability managementMicrosoft Entra ID
To earn it you
- Attend at least 80% of the scheduled classes
- Pass every assignment set by the MyCyberWay team, each handed in by the final class
You receive a Certificate of Course Completion instead. It confirms the programme and the hours you attended – without the badge, and without claiming assessed competence, because you would not want us telling an employer something we had not checked.
The badge is MyCyberWay’s own credential – not a regulated or accredited qualification, and not a Microsoft certification. How our badges work
Where it leads
The roles this programme is written for.
Every module was shaped around the job adverts for these roles – and your CV and mock interviews are aimed at them too.
- SOC AnalystTier 1 and Tier 2
- Security Operations AnalystIn-house or MSSP
- IT Security AdministratorA hybrid IT and security role
- Junior Cyber Security AnalystYour entry to the profession
Upgrading later
Blue Team Specialist is this programme, plus four classes.
Security Investigations, an Advanced Threat Hunting Workshop, Breach Analysis, and Root Cause Analysis & Reporting – the four that take you from working the queue to being the Tier 3 specialist it gets escalated to. Join them whenever you are ready – you pay for those four only, never for the same class twice. What they cost is with the fee, further down.
Exams it pairs with: Blue Team Analyst covers the SOC work behind SC-200, and many people take SC-900 alongside it. We teach the job, not the exam.
The journey
From a first phone call to a job offer.
Every step is included in the programme fee. Nothing is an upsell, and nothing is left to you to work out alone.
1Before you start
A free 20-minute fit call
What you do now, what you want next, and which programme fits – including “not this one” or “not yet”. No obligation, no pressure to enrol.
Free · no commitmentEnrol, and agree your schedule
Two to three classes a week, around your job. The course handout, the terms and the pre-course primer reach you before you pay anything.
2While you learn
26 live classes, with your own lab
Tutor-led in UK hours, all recorded, in your own Azure and Defender tenants – not a sandbox, not a video – open for six months after the last class.
Weekly assignments, marked by your tutor
Practical work reviewed by a person, with written feedback – not auto-graded. They are what earn the certification.
Certification – MCW Certified Blue Team Analyst
Pass every assignment and the badge is issued: a verifiable credential with a unique ID and a public verification link, added to LinkedIn in one click with your assessed skills attached.
Earned, not automatic
3Getting the job
Your CV rewritten and LinkedIn optimised
ATS-friendly and written for the roles you are applying for – recruiters search LinkedIn by skill, so we make sure yours are the skills they search for.
Mock interviews against real role specs
Run as a SOC analyst interview would actually run, with direct feedback – you practise the hard questions before somebody asks them for real.
Free job feed while you are a student
Vetted openings through MyCyberWay Premium Jobs, free from joining your batch until three months after your final class, plus application guidance and a private group applying for the same roles.
Included · normally paidPlaced – and still supported
Mentorship does not stop on the last class. The first weeks in a new role are when having somebody to ask is worth the most.
Being straight with you. We do not guarantee a job, and you should be wary of anyone who does. What we guarantee is that every step above happens, that a person does it with you, and that we will tell you honestly where you stand at each one.
Included
What you get, beyond the classes.
All of it in the fee, written by practitioners and taught live by them.
- Live, tutor-led classesTwo hours each: 1 hr 45 teaching, then 15 minutes for your questions. Not pre-recorded video.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
- Hands-on labsYour own Azure subscription and Defender trial tenant, with setup guidance.
- Six months’ lab access afterYour lab stays open after the final class, so you keep practising while you apply and interview.
- Assignments marked by your tutorReviewed by a person, with written feedback. Not auto-graded.
- CV rewrite and LinkedInATS-friendly, written for the roles you are applying for – work we also sell on its own, included in your fee.
- Mock interviewsRun against real SOC analyst role specifications, with direct feedback.
- Premium Jobs, free while you studyEvery UK cyber security role, filtered your way and scored against your CV, from joining your batch until three months after your final class.
- Private job group and mentorshipVetted openings, application guidance and peers on the same path – and a mentor after the last class.
- Verifiable certification badgeOn passing the assessed work. Shareable to LinkedIn in one click.
Not included
- Microsoft licence or Azure consumption costs in your own tenant – the labs run on trial and free-tier services wherever possible
- Third-party exam fees, such as Microsoft certification exams
- Your own computer and internet connection
How this course was built
Written by practitioners, for the job you actually want – customised to what UK employers hire for, not to an exam.
- Microsoft Certified TrainersCurrent, annually renewed
- 10+ yearsHands-on enterprise security
- Microsoft Security stackSentinel · Defender · Entra · Purview
- Industry-customisedBuilt from real role specs
- Job-ready, not exam-readyEvery exercise is something you would be asked to do in the role. Certifications are a useful side effect, never the point.
- Examples from real engagementsThe scenarios come from actual estates and actual incidents, with the names changed.
- Questions answered by practitionersYou ask the people who do this work, live in the session – nothing goes to a support queue.
- The same tutor throughoutNobody hands you over halfway: your tutor knows what you have covered and where you struggled.
The fee, and how it runs
Priced by the class. Built around your job.
The fee is the class rate times the classes, plus your CV rewrite and LinkedIn optimisation. Instalments are available.
Programme fee
Blue Team Analyst
£1,160in total
- 26 classes × £40
- £1,040
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,160
Or half now (£580) and half by class 13, or an instalment plan – ask us
Upgrading to Specialist later? You add the four specialist classes only, at the Specialist rate – 4 × £45 = £180. The 26 classes you have done are never charged twice.
One class, to scale
Two hours, live. 1 hour 45 minutes of teaching, then 15 minutes set aside for your questions.
A typical week, to scale
2–3 live classes (4–6 hours)Lab work and assignments
Around 20 hours a week in total, built for people with a full-time job.
- Frequency
- Two to three classes a week, scheduled around your working pattern
- Delivery
- Live online in UK hours; every session recorded and shared
- Labs
- Your own Azure subscription and Defender trial tenant – free tiers are enough
- Class counts
- Indicative – your tutor adjusts them to your gaps and agrees any change with you in advance
Talk to us first
Have a conversation before you commit to anything.
Pricing, payment plans, a schedule that fits shift work, whether this is even the right programme for you – all of it is easier settled in a twenty-minute chat than guessed at from a web page.
- Pricing and packagesWe put the elements together per person rather than selling a fixed bundle, so the figure depends on what you actually need.
- Payment plansInstalments are available on every programme.
- SchedulingEvenings, weekends, around shifts or a full-time job.
- Anything elseIncluding whether you should wait, or start on a different rung.
You are only ever charged for classes delivered. Withdraw at any time – you pay for the classes delivered and the rest is refunded (refund policy). The course handout, with the full terms, reaches you before you pay anything.
How is this different from Blue Team Specialist?
Specialist is this programme plus four classes: Security Investigations, an Advanced Threat Hunting Workshop, Breach Analysis, and Root Cause Analysis & Reporting. The first 26 classes are identical. Those last four are the difference between working the queue and owning the investigation – between a Tier 1 or 2 analyst and the Tier 3 specialist the hard cases go to. Start here and you can add them later for £180.
Do I need security experience to start?
No. This is the entry point and it is built for people with none – students, graduates and career changers from outside IT. You need comfort using a computer, a willingness to learn and about 20 hours a week; networking and cloud basics are taught in the first two classes. Still unsure? Book the fit call and we will tell you straight.
Do I need a certification like Security+ first?
No. Many students arrive with one and no practical experience – exactly the gap this programme fills. Others arrive with neither. Both work.
What do I need for the labs?
A Microsoft Azure subscription and a Defender trial tenant – the free tiers are enough – and any machine that comfortably runs a browser. We send setup guidance before the modules that need them. Your lab stays open for six months after the programme ends, so you can keep practising while you job hunt.
What happens if I miss a class?
Every session is recorded and shared. Give 48 hours’ notice to reschedule and there is no charge. Attendance below 80% affects eligibility for the badge, though not the course completion certificate.
Do you guarantee a job?
No, and be cautious of anyone who does. What is included is a rewritten CV, an optimised LinkedIn profile, mock interviews against real role specifications, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market – and we will be straight with you about all three.
Can I pause the programme?
Yes. Give a week’s notice before your next scheduled class. You are charged for classes delivered, pro rata at the per-class rate. The full terms are in the course handout, which you receive before paying anything.
How do I get into my course after I enrol?
Your MyCyberWay account is created when you check out. We agree your start date and schedule with you, set up your learning account and email you how to sign in before your first class. Our new learning portal opens soon – see what happens after you enrol.
Can my employer pay?
Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure this is the right rung?
Book a free 20-minute fit call.
We will ask what you do now and what you want next, and tell you which of the three programmes fits – or whether you should wait.
