MCWBTS · Level 2 → 3 · Respond
You’ll own the investigation, start to finish.
Everything in Blue Team Analyst, plus four classes that take you from working the alert queue to owning what happens next – the investigation, the hunt, the breach reconstruction and the report somebody senior actually reads. Written for the roles a SOC escalates its hardest cases to: Tier 3 analyst and threat hunter.
- 26 foundation + 4 specialist
- 30 live classes
- 60 hours tutor-led
- 16 modules
- Online, UK hours
- All sessions recorded
- 6 months’ lab access after
No security experience required – the foundation starts from the beginning · start dates agreed with you
Illustration of an investigation: events from email, endpoint, network, identity and SIEM telemetry are placed on one timeline – a phishing email at 08:02, the link opened, a password typed into a fake page, a sign-in from abroad, a forwarding rule and the alert at 08:45 – and the root cause, dwell time and scope are written up as a report.
Firstly, the job
What is a Tier 3 analyst, or a threat hunter?
Security operations centres are layered. Tier 1 and 2 work the alert queue. Tier 3 is who the hard cases are escalated to – and threat hunting is the other half of the same seniority. Together, that is the subject-matter expert role in a SOC.
Tier 3 · reactive
Take the hard case, and work it all the way through.
Across every system it touched, until you can say what happened, how far it went, and what to do about it.
Threat hunting · proactive
Don’t wait for the alert. Start from a hypothesis.
“If an attacker were doing this, what would it look like in our telemetry?” – then go looking.
- Blue teamDefensive security
- Tier 1 and 2Work the queue
- Tier 3The specialist it escalates to
- HuntingLooking before the alert
How this programme is built
26 classes of foundation. 4 that change the job.
The first 26 classes are the Blue Team Analyst programme – the tools, the telemetry and the daily security operation. You need all of it. The last four are what Analyst does not have, and the reason this one leads to a Tier 3 role.
Classes 1–26 · the foundation
Identical to Blue Team Analyst: SIEM and SOAR, identity, endpoint, network, email, vulnerability management, threat intelligence, compliance, incident management and AI security monitoring.
Classes 27–30 · the specialist block
- Security InvestigationsOne incident owned end to end, correlated across five telemetry sources into a single defensible timeline
- Advanced Threat Hunting WorkshopHypothesis-led hunting with MITRE ATT&CK – finding what no rule caught.
- Breach AnalysisScope, attacker path, dwell time and business impact
- Root Cause Analysis & ReportingThe RCA, the post-incident review, and writing it for people who are not technical
30 classes60 hours · Tier 3 and threat hunting
Already hold the Blue Team Analyst certification?
You do not repeat the first 26 classes and you are not charged for them again. Join the four specialist classes with the next group running them and pay for those four only, not the full fee – what they cost is with the fee, further down.
Who this is for
People who want to be escalated to, not to escalate.
The middle rung. It assumes you can use a computer properly and are willing to work at depth – and nothing else about security.
- Already working a queueYou triage alerts now and hand the interesting ones upward. These four classes are what you hand them to.
- Aiming past the queue from the startNew to security, but you already know which job you want.
- Blue Team Analyst graduatesYou hold the Analyst badge and want the investigation skill set – just the four specialist classes, never the full fee.
- Stuck at the same levelA year or two in a SOC and the work has stopped getting harder. Owning an investigation moves the conversation.
- Sysadmins and engineers moving acrossThe endpoint, identity and network modules will feel familiar fast; the investigation work is the new part.
- Certified, but never done itSC-200, CySA+ or similar, and told you lack hands-on experience. The specialist block is the evidence.
- You only need a first SOC role and the Tier 1 and 2 skill set – Blue Team Analyst is the same first 26 classes, for less
- You want to design and build controls rather than investigate incidents – Blue Team Engineer is a separate programme and shares nothing with this one
What you need on day one
- A laptop or desktop that runs a modern browser
- Enough comfort to install software and follow written steps
- Around 20 hours a week, including the classes
- The patience to sit with an investigation that does not resolve in ten minutes – that is the job at this level
What you do not need
- Blue Team Analyst first – its 26 classes are included here
- Any security experience or certification
- A computing degree, or networking knowledge – the first two classes cover it
- Coding – you will write queries, taught from nothing
- Your own lab hardware – you use free Microsoft trial tenants
Before class one we send a short primer and step-by-step lab setup. If any of it does not land, that is what the first session is for.
What it looks like
From no experience to a defensible investigation, in order.
Roughly three and a half months at two to three classes a week. Your tutor adjusts the pace to you.
- Weeks 1–2 · Get your bearingsThreat landscape, security principles, how a SOC is structured, and the cloud and identity groundwork. Lab tenants go live.
- Weeks 3–6 · Learn the tools properlyMicrosoft Sentinel end to end, your first KQL, triage method, and working a real queue.
- Weeks 7–10 · Investigate across the estateEndpoint, phishing and email, identity risk, vulnerability scans, network and firewall logs.
- Weeks 11–13 · Close out the foundationIncident management, compliance, GenAI and AI security monitoring. Here Analyst ends: you can do the Tier 1 and 2 job.
- Weeks 14–15 · The specialist blockInvestigations, the hunting workshop, breach analysis, root cause and reporting – the part an employer will ask about.
- Then · Get job-readyCV, LinkedIn, mock interviews against Tier 3 and hunting role specs, the job group – and your badge.
The curriculum
16 modules, 30 classes, two phases. Pick one to look inside.
Phase 1 is shared with Blue Team Analyst, class for class; phase 2 is what this programme adds. Class counts are indicative and agreed with you in advance.
Class map 30 classes · 16 modules · 2 hours each
Module 01 · 1 class · class 1
Cyber Security Fundamentals
The threat landscape and the attack lifecycle. CIA triad, defence in depth, least privilege. NIST CSF, CIS Controls and MITRE ATT&CK as the frameworks you will actually use.
Module 02 · 1 class · class 2
IT & Cloud SOC Fundamentals
How a SOC is structured – tiers, escalation, MTTD and MTTR. Azure and Microsoft 365 tenant structure, shared responsibility, and which services produce the telemetry you read.
Module 03 · 5 classes · classes 3–7
SIEM & SOAR Operations
Microsoft Sentinel end to end: connectors, KQL, analytics rules, incident investigation, triage method, false-positive tuning and playbooks.
Module 04 · 2 classes · classes 8–9
Identity & Access Monitoring
Entra ID operations, Identity Protection, suspicious sign-ins and impossible travel, and containing a compromised account.
Module 05 · 3 classes · classes 10–12
Endpoint Monitoring
Defender for Endpoint alerts, process trees, living-off-the-land and PowerShell abuse, device compliance, and isolation.
Module 06 · 3 classes · classes 13–15
Network & Firewall Monitoring
Protocols and trust zones, firewall and NSG logs, DNS anomalies, packet analysis in Wireshark, and firewall-led investigation.
Module 07 · 2 classes · classes 16–17
Email & Phishing Investigation
What SPF, DKIM and DMARC failures tell you, Defender for Office 365 submissions, header forensics, message trace, quarantine and BEC indicators.
Module 08 · 3 classes · classes 18–20
Vulnerability Management
Scanning, reading the output, prioritising with CVSS, EPSS and asset criticality, and tracking remediation with the teams who own the fix.
Module 09 · 1 class · class 21
Threat Intelligence Monitoring
Defender Threat Intelligence, feeds and IoCs, and escalating what is actually relevant to your organisation.
Module 10 · 1 class · class 22
Compliance Monitoring
How ISO 27001 and NIST requirements land on daily tasks, Intune device compliance, and collecting audit evidence.
Module 11 · 2 classes · classes 23–24
Incident Management
Severity and priority, PICERL at analyst level, ITSM platforms (Jira, ServiceNow, Halo), and case notes and handovers.
Module 12 · 2 classes · classes 25–26
GenAI & AI Security Monitoring
Using Security Copilot in triage and knowing what still needs verifying – and monitoring the AI itself: inherited permissions, prompt injection and Purview DSPM for AI.
Module 13 · 1 class · class 27
Security Investigations
One incident owned end to end: SIEM, endpoint, identity, email and network telemetry correlated into a single defensible timeline.
Module 14 · 1 class · class 28
Advanced Threat Hunting Workshop
Hypothesis-led hunting with MITRE ATT&CK and KQL.
Module 15 · 1 class · class 29
Breach Analysis
Scope, attacker path and dwell time – translated into business impact rather than a list of alerts.
Module 16 · 1 class · class 30
Root Cause Analysis & Reporting
RCA method, the post-incident review, agreeing remediation, and writing the report for people who are not technical.
Finishes with
A full end-to-end investigation, and a written incident report
One incident, owned from first alert to root cause, with the timeline, the evidence and the write-up. It is the closest thing to the task a Tier 3 or threat hunting interview will set you – and the thing you talk about when someone asks what experience you have.
The tools you’ll use
The Microsoft Security stack most UK teams run, and the tools you will meet alongside it.
- SIEM
- Falcon · EDR
- EDR
- Email security
- Nessus · Vulnerability
- Case management
Product names and logos are trademarks of their owners, shown only to identify the tools the programme teaches. No partnership or endorsement is implied.
What you will be able to do
Everything the Analyst can do – plus the five that matter at Tier 3.
Not topics covered: tasks you can perform, unsupervised, in a live environment.
From the foundation
Work a SIEM alert queue in Microsoft Sentinel and justify every verdict you record
Investigate a reported phishing email – headers, delivery path, verdict, quarantine or release
Review endpoint alerts in Defender for Endpoint and isolate a device when it is warranted
Spot a compromised account in Entra ID and take the right containment action
Run a vulnerability scan and turn it into a prioritised, assigned remediation list
Tune a noisy rule so the queue stops drowning without losing the detection
Use Security Copilot to speed up triage – and know which parts still need checking
From the specialist block
Own an incident end to end – correlate SIEM, endpoint, identity, email and network into one timeline you can defend
Run a hypothesis-led hunt against MITRE ATT&CK and find what no detection rule caught
Reconstruct a breach – scope, attacker path, dwell time, and what it actually cost the business
Produce a root cause analysis that survives being read by somebody senior
Write the post-incident report for an audience that is not technical, without losing the technical truth
Certification
Earn the badge, don’t just attend.
Everyone holding this badge has passed the same two master assignments, under the same conditions – that is what makes it worth something.
Verifiable digital badge
MCW Certified Blue Team Specialist
Issued through Sertifier · shareable to LinkedIn
Skills attached when you add it to LinkedIn
Threat huntingIncident responseSecurity investigationsMITRE ATT&CKKQLMicrosoft SentinelMicrosoft Defender XDR
To earn it you
- Attend at least 80% of the scheduled classes
- Pass every lab set by the MyCyberWay team, each handed in by the final class
- Pass both master assignments: a multiple-choice knowledge check across the whole programme, and a practical investigation written up as a findings report
You receive a Certificate of Course Completion instead: the programme and the hours you attended, without the badge and without claiming assessed competence.
The badge is MyCyberWay’s own credential – not a regulated or accredited qualification, and not a Microsoft certification. How our badges work
Where it leads
The roles this programme is written for.
The roles a SOC escalates its hardest cases to – and your CV and mock interviews are aimed at them too.
- SOC AnalystTier 3
- Incident Response AnalystIn-house or MSSP
- Threat Hunting SpecialistHypothesis-led hunting
- Cyber Security AnalystA generalist, at depth
- Security Investigations AnalystAn investigation-led role
- Microsoft Security AnalystSentinel and Defender estates
Where this sits on the ladder
- No experience
- AnalystInvestigate · the first 26 classes
- SpecialistRespond · you are here
- EngineerBuild · a separate track
Blue Team Analyst is the first 26 classes of this programme and stops there – the Tier 1 and 2 skill set, for less. Blue Team Engineer is not the next rung up from here: it is a separate track for people who want to design and build controls rather than investigate incidents.
The journey
From a first phone call to a job offer.
Every step is included in the programme fee. Nothing is an upsell, and nothing is left to you to work out alone.
1Before you start
A free 20-minute fit call
What you do now, what you want next, and which programme fits – including “not this one” or “not yet”. No obligation, no pressure to enrol.
Free · no commitmentEnrol, and agree your schedule
Two to three classes a week, around your job. The course handout, the terms and the pre-course primer reach you before you pay anything.
2While you learn
30 live classes, with your own lab
Tutor-led in UK hours, all recorded, in your own Azure and Defender tenants – not a sandbox, not a video – open for six months after the last class.
Weekly assignments, marked by your tutor
Practical work reviewed by a person, with written feedback – not auto-graded. They are what earn the certification.
Certification – MCW Certified Blue Team Specialist
Pass every lab and both master assignments, and the badge is issued: a verifiable credential with a unique ID and a public verification link, added to LinkedIn in one click with your assessed skills attached.
Earned, not automatic
3Getting the job
Your CV rewritten and LinkedIn optimised
ATS-friendly and written for the roles you are applying for – recruiters search LinkedIn by skill, so we make sure yours are the skills they search for.
Mock interviews against real role specs
Run as a Tier 3 SOC, threat hunting or incident response interview would actually run, with direct feedback – you practise the hard questions before somebody asks them for real.
Free job feed while you are a student
Vetted openings through MyCyberWay Premium Jobs, free from joining your batch until three months after your final class, plus application guidance and a private group applying for the same roles.
Included · normally paidPlaced – and still supported
Mentorship does not stop on the last class. The first weeks in a new role are when having somebody to ask is worth the most.
Being straight with you. We do not guarantee a job, and you should be wary of anyone who does. What we guarantee is that every step above happens, that a person does it with you, and that we will tell you honestly where you stand at each one.
Included
What you get, beyond the classes.
All of it in the fee, written by practitioners and taught live by them.
- Live, tutor-led classesTwo hours each: 1 hr 45 teaching, then 15 minutes for your questions. Not pre-recorded video.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
- Hands-on labsYour own Azure subscription and Defender trial tenant, with setup guidance.
- Six months’ lab access afterYour lab stays open after the final class, so you keep practising while you apply and interview.
- Assignments marked by your tutorReviewed by a person, with written feedback. Not auto-graded.
- CV rewrite and LinkedInATS-friendly, written for the roles you are applying for – work we also sell on its own, included in your fee.
- Mock interviewsRun against real Tier 3 SOC, threat hunting and incident response role specifications, with direct feedback.
- Premium Jobs, free while you studyEvery UK cyber security role, filtered your way and scored against your CV, from joining your batch until three months after your final class.
- Private job group and mentorshipVetted openings, application guidance and peers on the same path – and a mentor after the last class.
- Verifiable certification badgeOn passing the assessed work. Shareable to LinkedIn in one click.
Not included
- Microsoft licence or Azure consumption costs in your own tenant – the labs run on trial and free-tier services wherever possible
- Third-party exam fees, such as Microsoft certification exams
- Your own computer and internet connection
How this course was built
Written by practitioners, for the job you actually want – customised to what UK employers hire for, not to an exam.
- Microsoft Certified TrainersCurrent, annually renewed
- 10+ yearsHands-on enterprise security
- Microsoft Security stackSentinel · Defender · Entra · Purview
- Industry-customisedBuilt from real role specs
- Job-ready, not exam-readyEvery exercise is something you would be asked to do in the role. Certifications are a useful side effect, never the point.
- Examples from real engagementsThe scenarios come from actual estates and actual incidents, with the names changed.
- Questions answered by practitionersYou ask the people who do this work, live in the session – nothing goes to a support queue.
- The same tutor throughoutNobody hands you over halfway: your tutor knows what you have covered and where you struggled.
The fee, and how it runs
Priced by the class. Built around your job.
The fee is the class rate times the classes, plus your CV rewrite and LinkedIn optimisation. Instalments are available.
Programme fee
Blue Team Specialist
£1,470in total
- 30 classes × £45
- £1,350
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,470
Or half now (£735) and half by class 15, or an instalment plan – ask us
Already done Blue Team Analyst? You join the four specialist classes only – 4 × £45 = £180. The 26 classes you did are never charged twice: contact our payments team to take this route.
One class, to scale
Two hours, live. 1 hour 45 minutes of teaching, then 15 minutes set aside for your questions.
A typical week, to scale
2–3 live classes (4–6 hours)Lab work and assignments
Around 20 hours a week in total, built for people with a full-time job.
- Frequency
- Two to three classes a week, scheduled around your working pattern
- Delivery
- Live online in UK hours; every session recorded and shared
- Labs
- Your own Azure subscription and Defender trial tenant – free tiers are enough
- Class counts
- Indicative – your tutor adjusts them to your gaps and agrees any change with you in advance
Talk to us first
Have a conversation before you commit to anything.
Pricing, payment plans, a schedule that fits shift work, whether this is even the right programme for you – all of it is easier settled in a twenty-minute chat than guessed at from a web page.
- Pricing and packagesWe put the elements together per person rather than selling a fixed bundle, so the figure depends on what you actually need.
- Payment plansInstalments are available on every programme.
- SchedulingEvenings, weekends, around shifts or a full-time job.
- Anything elseIncluding whether you should start on the Analyst rung instead and add the four classes later.
You are only ever charged for classes delivered. Withdraw at any time – you pay for the classes delivered and the rest is refunded (refund policy). The course handout, with the full terms, reaches you before you pay anything.
Aren’t the Analyst and Specialist programmes the same thing?
The first 26 classes are the same, deliberately – both teach you to operate the security stack and work a live alert queue. Specialist then adds four classes Analyst does not have: Security Investigations, an Advanced Threat Hunting Workshop, Breach Analysis, and Root Cause Analysis & Reporting. Those four are the difference between a Tier 1 or 2 analyst and the Tier 3 specialist the hard cases go to. We would rather tell you exactly what the extra £310 buys than be vague about it.
Should I do the Analyst programme first?
You do not need to. Start here if you already know you want Tier 3, threat hunting and breach investigation work. Start on Blue Team Analyst if you only need a first SOC role, or if the fee matters more than the timeline – you can add the four specialist classes later for £180, and you are never charged for the same class twice.
Do I need security experience to start?
No. The foundation begins at the beginning, exactly as the Analyst programme does – networking and cloud basics are taught in the first two classes. You need comfort using a computer, a willingness to learn and about 20 hours a week. The specialist block comes after 26 classes of groundwork, not before it.
I already hold the Blue Team Analyst certification. What do I pay?
£180 – four classes at the Specialist rate of £45. You do not repeat the first 26 classes and you are not charged for them again. You join the four specialist classes with the next group running them, and the Specialist badge criteria then apply in full, including both master assignments.
What are the two master assignments?
Master Assignment 1 is a multiple-choice check across the whole programme. Master Assignment 2 is a practical investigation in the lab, from first alert to root cause, written up as a findings report. Your tutor marks both, and both are needed for the badge, so everyone holding it has done the same assessed work.
What do I need for the labs?
A Microsoft Azure subscription and a Defender trial tenant – the free tiers are enough – and any machine that comfortably runs a browser. We send setup guidance before the modules that need them. Your lab stays open for six months after the programme ends.
What happens if I miss a class?
Every session is recorded and shared. Give 48 hours’ notice to reschedule and there is no charge. Attendance below 80% affects eligibility for the badge, though not the course completion certificate.
Do you guarantee a job?
No, and be cautious of anyone who does. What is included is a rewritten CV, an optimised LinkedIn profile, mock interviews against real role specifications, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market – and we will be straight with you about all three.
Can I pause the programme?
Yes. Give a week’s notice before your next scheduled class. You are charged for classes delivered, pro rata at the per-class rate. The full terms are in the course handout, which you receive before paying anything.
Can my employer pay?
Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure this is the right rung?
Book a free 20-minute fit call.
We will ask what you do now and what you want next, and tell you which of the three programmes fits – or whether you should wait.
Only need the foundation? Blue Team Analyst is the same first 26 classes. Want to design controls rather than investigate incidents? Blue Team Engineer is the separate engineering track.
