MCWBTE · Level 3 · Build
Stop running security controls. Start building them.
For experienced technical people who want to build defences rather than operate them: engineer the detection logic, configure the platforms hands-on, assess the risk – and justify every setting to the people who have to live with it.
- Configuration practice sessions
- 28 live classes
- 56 hours tutor-led
- 14 modules
- Online, UK hours
- 6 months’ lab access after
Not an introductory course – existing technical competence assumed · start dates agreed with you
Illustration of a build: Conditional Access requiring MFA and blocking legacy sign-in, break-glass accounts excluded and alerted on, admin roles made eligible rather than standing in PIM, and a Sentinel rule for forwarding to outside addresses – then each control evidenced against NIST CSF 2.0 and CIS v8, and the three walkthrough questions answered: what it blocks, what it breaks and what it costs to run.
Firstly, the job
What does a security engineer build? What everyone else runs on.
Within the blue team, some people operate the defences and some build them. This programme is for the builders – in your own tenants, hands on, with somebody asking why you chose each setting.
- The detectionsthat raise the alerts
- The rulesdeciding who can sign in from where
- The segmentationthat stops an attacker moving sideways
- The cloud configurationeverything else sits on
Somebody designs, configures and evidences all of it. That is security engineering – a different job from watching the alerts it produces.
- Blue teamDefensive security
- Engineers buildAnalysts operate
- Not an introductory courseA recalibration, at engineering depth from the first class
What makes this different
It ends with a working build, not a document about one.
Three consolidated build sessions at the end, in your own Azure and Defender tenants. Not guided click-alongs: you are given the requirement and you configure it, the way a ticket would arrive on a Monday morning.
You configure
- A Conditional Access policy set, with break-glass
- PIM roles
- A tiered admin model
You configure
- Connectors and ingestion
- Analytics rules and watchlists
- A SOAR playbook
- Defender policies and attack surface reduction
You configure
- Defender for Cloud and Azure Policy
- Segmentation and firewall rules
- SPF, DKIM and DMARC
- The requirementAs a ticket would arrive
- You configure itIn your own tenants
- You evidence itAgainst CIS and NIST CSF
- You walk it throughEvery setting, explained
- Your configuration packFor your portfolio
You leave with a configuration pack: the exported policies, the rules you wrote, the evidence screenshots and a short note on every decision. It is the portfolio piece that maps most directly onto a security engineering interview, because it is the same work the job asks for on day one.
Moving towards architecture instead?
Security architecture – trust zones, control mapping, residual risk and a costed roadmap defended to a board – is a separate two-day add-on, not part of the core programme. Most people do not need it to land a security engineering role, so we do not charge everybody for it.
Who this is for
Engineers who have outgrown operating other people’s designs.
This programme assumes existing technical competence and moves at engineering depth from the first class.
This is you if…
- You are an infrastructure, cloud or network engineer moving into security
- You work in a SOC and want to build the detections rather than tune them
- You are already in security and want to move from operating to building
- You are being asked to configure controls and produce risk registers you have never been taught to produce
- You want to consult – and need the hands-on depth that justifies a consultant’s day rate
Start elsewhere if…
- You are new to security operations entirely – start with Blue Team Analyst
- You want to specialise in investigation and threat hunting rather than building – start with Blue Team Specialist
- You want a certification cram course. This programme teaches the job, not the exam – though it maps closely to SC-500, SC-200 and SC-300
The curriculum
14 modules, 28 classes, two phases. Pick one to look inside.
Thirteen technical modules build the capability one platform at a time. The fourteenth makes you configure all of it together, under your own hands. Class counts are indicative and agreed with you in advance.
Class map 28 classes · 14 modules · 2 hours each
Module 01 · 1 class · class 1
Fundamentals — an Engineer’s Lens
Frameworks as engineering blueprints: NIST CSF, MITRE ATT&CK, CIS Controls and Zero Trust, and where each control sits.
Module 02 · 3 classes · classes 2–4
SIEM & SOAR Engineering
Ingestion design, retention and cost, detection rules from threat hypotheses, KQL across every source, and SOAR playbook design.
Module 03 · 4 classes · classes 5–8
Identity & Access Management Engineering
Entra ID architecture, hybrid identity, Conditional Access engineering, PIM, identity threat detection, and AD tiering.
Module 04 · 2 classes · classes 9–10
Threat Intelligence — Operational & Strategic
CTI into detection engineering, ATT&CK coverage gaps, platform integration, and briefings in business-risk language.
Module 05 · 2 classes · classes 11–12
Endpoint Security Engineering
EDR architecture across Windows, Linux, macOS and mobile, ASR, policy design, advanced hunting and live response.
Module 06 · 2 classes · classes 13–14
Vulnerability Management Engineering
Scanner architecture, risk-based prioritisation with CVSS, EPSS and asset criticality, governance and reporting.
Module 07 · 1 class · class 15
Compliance Management & Security Controls
ISO 27001 Annex A, NIST CSF 2.0, CIS v8, Cyber Essentials Plus, Purview and Intune compliance design.
Module 08 · 1 class · class 16
Email Security Engineering
SPF, DKIM and DMARC architecture, Defender for Office 365 policy, BEC investigation, simulation and quarantine governance.
Module 09 · 2 classes · classes 17–18
Incident Management & Response Engineering
PICERL at depth, playbooks for ransomware, phishing, privilege escalation and insider threat, and evidence handling.
Module 10 · 2 classes · classes 19–20
Network Security Engineering
Segmentation and trust zones, ZTNA, firewall and cloud network policy, C2 detection and DNS security.
Module 11 · 2 classes · classes 21–22
Cloud Security Engineering
CSPM at scale, CIS hardening, cloud-native detection and response, and mapping Azure controls to AWS and GCP.
Module 12 · 2 classes · classes 23–24
Risk Assessment & Recommendations Reporting
FAIR, STRIDE and PASTA, the risk register, and the recommendations report and investment case.
Module 13 · 1 class · class 25
AI Security Engineering
The four-part AI attack surface – data, prompt, actions and identity – Copilot pre-flight hardening and agent security.
Module 14 · 3 classes · classes 26–28
Configuration Practice Sessions
Three build sessions: identity, detection and response, cloud, network and email – evidenced against CIS and NIST CSF.
The tools you’ll engineer
Configured, tuned and evidenced in your own tenants – and mapped across to AWS and Google Cloud.
- Nessus · Vulnerability
- Cloud
Product names and logos are trademarks of their owners, shown only to identify the tools the programme teaches. No partnership or endorsement is implied.
What you will be able to do
Build it, harden it, evidence it, explain it.
Eleven things you can do at the end – each one practised in your own tenants, not watched on a slide.
Build
- Engineer detection logic and data ingestion pipelines, rather than tuning someone else’s rules
- Design a Conditional Access policy set, PIM model and tiered admin structure for a hybrid estate
- Build a risk-based vulnerability programme with SLA tracking, exception handling and remediation governance
- Configure network segmentation that a four-person team can actually operate across dozens of sites
Harden
- Harden a cloud estate with CSPM, Azure Policy and a landing zone that scales
- Secure an AI deployment – Copilot pre-flight, agent identity and tool control, and AI telemetry into the SIEM
Evidence
- Map framework requirements to technical controls, with the evidence an auditor will actually ask for
- Run a structured risk assessment using STRIDE, FAIR and a real risk register
- Write a recommendations report with a costed, phased roadmap
- Build a complete control set from a requirement – configured, tested and evidenced against the framework that asked for it
Explain
- Explain every configuration decision – what it blocks, what it breaks, and what it costs to run
“What it blocks, what it breaks, what it costs” – the three questions behind every setting, and every interview.
What you leave with
A portfolio, not just a certificate.
Every one of these is a real piece of work you can show an interviewer.
- A configuration packExported policies, the rules you wrote, evidence screenshots and a short rationale for every decision
- A risk registerWritten properly – inherent, treatment, residual, named acceptor and review date
- A recommendations reportExecutive summary, findings, priorities and delivery roadmap
- Control evidence, mappedYour build traced to CIS v8 and NIST CSF 2.0 – the artefact an auditor asks for
- Detection rules you engineeredBuilt from threat hypotheses, not copied from a gallery
- An incident reportTimeline, root cause, control gap and remediation plan
- A build walkthroughYou talking through what you configured and why, under challenge – exactly the technical interview format
Certification
Earned on the work, not the attendance.
The most demanding of the three credentials, and deliberately so: it is the one that says you can build, not just operate.
Verifiable digital badge
MCW Certified Blue Team Engineer
Issued through Sertifier · shareable to LinkedIn
Your configuration pack is assessed against six published criteria
- 25%Correctness of configuration
- 15%Coverage against the mapped framework
- 15%Operability by a small team
- 15%Evidence quality
- 15%Least privilege and risk honesty
- 15%The walkthrough
Skills attached when you add it to LinkedIn
Security engineeringDetection engineeringZero Trust implementationConditional AccessCloud securityRisk assessment
To earn it you
- Attend at least 80% of the scheduled classes, across all fourteen modules
- Pass every assignment set by the MyCyberWay team, each handed in by the final class
- Submit the completed configuration pack from all three practice sessions – exported policies, detection rules and control evidence
- Deliver the build walkthrough, and answer challenge questions on your own configuration decisions
You receive a Certificate of Course Completion instead – the programme and the hours you attended, with no claim of assessed competence.
The badge is MyCyberWay’s own credential – not a regulated or accredited qualification, and not a Microsoft certification. The architecture add-on is not part of it. How our badges work
Where it leads
The roles this programme is written for.
Building what the SOC runs on – and designing, assessing and evidencing it for clients.
- Security EngineerBlue team and detection engineering
- Security Operations EngineerBuilding what the SOC runs on
- Cloud Security EngineerAzure-focused, multi-cloud aware
- Security ConsultantClient-facing design and assessment
- Information Security ConsultantRisk, compliance and architecture
- Detection EngineerBuilding what catches the attack
Microsoft exams it maps to
We teach the job rather than the exam. If you intend to sit them, ask on the fit call and we will tell you which to take and when – and see Microsoft security certifications.
The journey
From a first phone call to a job offer.
Every step is included in the programme fee. Nothing is an upsell, and nothing is left to you to work out alone.
1Before you start
A free 20-minute fit call
What you do now, what you want next, and which programme fits – including “not this one” or “not yet”. No obligation, no pressure to enrol.
Free · no commitmentEnrol, and agree your schedule
Two to three classes a week, around your job. The course handout, the terms and the pre-course primer reach you before you pay anything.
2While you learn
28 live classes, with your own lab
Tutor-led in UK hours, all recorded, in your own Azure and Defender tenants – not a sandbox, not a video – open for six months after the last class.
Weekly assignments, marked by your tutor
Practical work reviewed by a person, with written feedback – not auto-graded. They are what earn the certification.
Certification – MCW Certified Blue Team Engineer
Pass every assignment, submit the configuration pack and walk your tutor through your build, and the badge is issued: a verifiable credential with a unique ID and a public verification link, added to LinkedIn in one click with your assessed skills attached.
Earned, not automatic
3Getting the job
Your CV rewritten and LinkedIn optimised
ATS-friendly and written for the roles you are applying for – recruiters search LinkedIn by skill, so we make sure yours are the skills they search for.
Mock interviews against real role specs
Run as a security engineer or consultant interview would actually run, with direct feedback – you practise the hard questions before somebody asks them for real.
Free job feed while you are a student
Vetted openings through MyCyberWay Premium Jobs, free from joining your batch until three months after your final class, plus application guidance and a private group applying for the same roles.
Included · normally paidPlaced – and still supported
Mentorship does not stop on the last class. The first weeks in a new role are when having somebody to ask is worth the most.
Being straight with you. We do not guarantee a job, and you should be wary of anyone who does. What we guarantee is that every step above happens, that a person does it with you, and that we will tell you honestly where you stand at each one.
Included
What you get, beyond the classes.
All of it in the fee, written by practitioners and taught live by them.
- Live, tutor-led classesTwo hours each: 1 hr 45 teaching, then 15 minutes for your questions. Not pre-recorded video.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
- Hands-on labsYour own Azure subscription and Defender trial tenant, with setup guidance.
- Six months’ lab access afterYour lab stays open after the final class, so you keep practising while you apply and interview.
- Assignments marked by your tutorReviewed by a person, with written feedback. Not auto-graded.
- CV rewrite and LinkedInATS-friendly, written for the roles you are applying for – work we also sell on its own, included in your fee.
- Mock interviewsRun against real security engineering role specifications, with direct feedback.
- Premium Jobs, free while you studyEvery UK cyber security role, filtered your way and scored against your CV, from joining your batch until three months after your final class.
- Private job group and mentorshipVetted openings, application guidance and peers on the same path – and a mentor after the last class.
- Verifiable certification badgeOn passing the assessed work. Shareable to LinkedIn in one click.
Not included
- Microsoft licence or Azure consumption costs in your own tenant – the labs run on trial and free-tier services wherever possible
- Third-party exam fees, such as Microsoft certification exams
- Your own computer and internet connection
How this course was built
Written by practitioners, for the job you actually want – customised to what UK employers hire for, not to an exam.
- Microsoft Certified TrainersCurrent, annually renewed
- 10+ yearsHands-on enterprise security
- Microsoft Security stackSentinel · Defender · Entra · Purview
- Industry-customisedBuilt from real role specs
- Job-ready, not exam-readyEvery exercise is something you would be asked to do in the role. Certifications are a useful side effect, never the point.
- Examples from real engagementsThe scenarios come from actual estates and actual incidents, with the names changed.
- Questions answered by practitionersYou ask the people who do this work, live in the session – nothing goes to a support queue.
- The same tutor throughoutNobody hands you over halfway: your tutor knows what you have covered and where you struggled.
The fee, and how it runs
Demanding, and scheduled around your job.
The fee is the class rate times the classes, plus your CV rewrite and LinkedIn optimisation. Instalments are available.
Programme fee
Blue Team Engineer
£1,660in total
- 28 classes × £55
- £1,540
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,660
Or half now (£830) and half by class 14, or an instalment plan – ask us
One class, to scale
Two hours, live. 1 hour 45 minutes of teaching, then 15 minutes set aside for your questions.
The three practice sessions run differently: one hour taught, one hour building it yourself, with the tutor on hand.
A typical week, to scale
2–3 live classes (4–6 hours)Lab work and assignments
Around 20 hours a week in total, built for people with a full-time job.
- Frequency
- Two to three classes a week, scheduled around your working pattern
- Delivery
- Live online in UK hours; every session recorded and shared
- Labs
- Your own Azure subscription, Sentinel workspace and Defender trial tenant
- Class counts
- Indicative – your tutor adjusts them to your gaps and agrees any change with you in advance
Talk to us first
Have a conversation before you commit to anything.
Pricing, payment plans, a schedule that fits shift work, whether this is even the right programme for you – all of it is easier settled in a twenty-minute chat than guessed at from a web page.
- Pricing and packagesWe put the elements together per person rather than selling a fixed bundle, so the figure depends on what you actually need.
- Payment plansInstalments are available on every programme.
- SchedulingEvenings, weekends, around shifts or a full-time job.
- Anything elseIncluding whether you should wait, or start on a different rung.
You are only ever charged for classes delivered. Withdraw at any time – you pay for the classes delivered and the rest is refunded (refund policy). The course handout, with the full terms, reaches you before you pay anything.
Optional add-on
Security Architecture Design – if the role actually needs it.
Some people go straight into a security engineering role. Others are heading for consultancy or an architect title, where somebody will ask for a design document and a costed roadmap. This workshop is for the second group.
The client brief · two workshop days, after the programme
A UK care provider, designed end to end.
- 73sites
- 6,400staff
- 450clinical devices that cannot take an agent
- £850kto spend over 18 months
…plus an acquisition nobody integrated and a ransomware incident in its recent past. You produce the requirements, the trust-zone model, the control mapping, the residual risk register and the phased roadmap, in a provided draw.io template.
Then you present it to a simulated board
- CFOWants the smaller number
- CEOWants growth unblocked
- CGLThe clinical governance lead wants to know who can see a resident’s medical history
Your tutor plays all three – and they do not agree with each other.
Add-on fee
£1653 classes at £55
- Open to anyone who has completed Blue Team Engineer
- You keep the finished architecture as a portfolio piece
- The natural preparation for SC-100
- Not required for the MCWBTE badge
Why it is not in the core price: most people applying for security engineering roles will not be asked for a board-level architecture in their first two years, and we would rather not charge everybody for something most of them will not use.
How is this different from Blue Team Specialist?
Specialist teaches you to investigate – to take one incident and own it end to end. Engineer teaches you to build – to configure the controls, engineer the detections and stand behind the settings you chose. A Specialist answers “what happened?”. An Engineer answers “what should be switched on, configured how, and how do we prove it works?”.
Do I need to have done Analyst or Specialist first?
No. This programme assumes technical competence, not prior MyCyberWay study – plenty of students come straight in from infrastructure, cloud or network engineering. If you have done one of the others, nothing is repeated, and some modules may be shortened, which we agree with you beforehand.
Is this an introductory course?
No, and it will be uncomfortable if you treat it as one. It assumes you are already technically capable and focuses on building, configuring, detecting and designing at enterprise level from the first class.
What are the configuration practice sessions, exactly?
Three build sessions at the end of the programme, in your own Azure and Defender tenants. You are given a requirement – the way it would arrive as a ticket – and you configure it yourself: identity in the first, detection and response in the second, and cloud, network and email in the third. Each ends with you evidencing the build against CIS and NIST CSF and walking your tutor through every decision. The resulting configuration pack is required for the badge.
Is the security architecture workshop included?
It is a separate two-day add-on – 3 classes, £165 – rather than part of the core price. The programme trains security engineers, and most engineering roles do not ask for a board-level architecture in the first couple of years. Heading towards consultancy or an architect title? Take it: you design a full target-state architecture for a realistic client and defend it to a simulated board. Say so on the fit call and we will plan it in.
Will this prepare me for SC-500 or SC-200?
It covers most of the ground for both, and for SC-300. It teaches the job rather than the exam syllabus, so you would want some focused revision before sitting them. SC-100, the architect exam, goes further than this programme deliberately – the architecture add-on is the bridge if that is where you are heading. Ask on the fit call and we will tell you which is worth your time.
What do I need for the labs?
An Azure subscription, a Sentinel workspace and a Defender for Endpoint trial tenant. Free tiers are enough for most modules. Setup guidance comes before the modules that need it, and you are expected to have the environment ready in advance. Your lab stays open for six months after the programme ends.
How much independent work is expected?
Around 20 hours a week, including the classes. This is an engineering-level programme with a high expectation of independent practice: the classes give the instruction and the guidance, and the capability comes from the hours you spend in the lab between them.
Can I pause the programme?
Yes. Give a week’s notice before your next scheduled class. You are charged for classes delivered, pro rata at the per-class rate. The full terms are in the course handout, which you receive before paying anything.
Can my employer pay?
Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Find out whether this is the right rung
Book a free 20-minute fit call.
We will ask what you build today and what you want to be building in two years, and tell you honestly whether this programme fits, whether Specialist is the better starting point, and whether you need the architecture add-on.
