Blue team training · live and tutor-led
Three ways into a blue team career. Investigate, respond, build.
Watching an organisation’s systems, investigating what looks wrong and building the defences are three different jobs – so these are three programmes, not three levels of one course. Start where your experience puts you, including from nothing at all.
- No experience needed to start
- Every session recorded
- CV and interview support included
- Verifiable certification
- Microsoft Security stack, and more
- UK-registered provider
Firstly, the basics
What is a blue team? Watch one at work.
In cyber security the red team attacks and the blue team defends: it watches an organisation’s systems, works out which alerts are a real attack, shuts the attack down and builds the defences so the next attempt fails. One incident, three jobs.
Illustration with an example incident. The analyst triages an impossible-travel alert, confirms it is real, contains the account and escalates it with notes. The specialist correlates five sources into one timeline and finds the root cause, a phishing email, and writes the incident report. The engineer builds the fix – Conditional Access, a new detection rule and DMARC – evidences it against CIS and NIST CSF, and the next attempt is blocked at sign-in.
Illustration with an example incident – the kind you work through in class.
- Also called defensive securityThe side of cyber security that runs every day
- Or security operations – the SOCWhere most blue team work happens
- Most security rolesare defensive ones, in every organisation with something to protect
Start here
Which one is me?
Pick whichever sounds most like you today – including “none of this yet”. You get a straight recommendation, not a sales pitch.
Your starting point · Investigate
No experience neededBlue Team Analyst – and no, you are not behind.
You do not need security experience: that is what the programme is for. People arrive straight from university, from a completely different industry, or with a certification and nothing practical behind it.
On day one you need a laptop that runs a browser, enough comfort to install things and follow instructions, and around 20 hours a week. Networking and cloud basics are taught in the first two classes.
- No security experience required
- Pre-course primer before class one
- Lab setup walked through with you
- Questions in every session
Your starting point · Investigate
You already have the hard partBlue Team Analyst – you already have the hard part.
Help desk and IT support people tend to do well here: you already know how systems break, how users behave and how to work a ticket queue properly. Those are most of the job.
The programme adds the security layer on top.
- Triage a SIEM alert queue
- Investigate a reported phishing email
- Read endpoint detections, spot a compromised account
- Escalate with notes somebody can use
Two good options
It depends on the next two yearsOperate the defences, or design them?
Move into a SOC and work alertsBlue Team Analyst. Your infrastructure knowledge makes the endpoint, identity and network modules much easier.
Design the controls insteadBlue Team Engineer. It assumes your technical depth and starts at engineering level from the first class.
Genuinely unsure? That is exactly what the fit call is for: twenty minutes, and we tell you which one fits – including if the answer is neither yet.
Your starting point · Respond
Tier 3 · threat huntingBlue Team Specialist – stop escalating, start being escalated to.
The same 26 foundation classes as the Analyst programme – useful for filling the gaps everyone picks up on the job – plus four it does not have.
Those four are the difference between working a queue and owning an investigation: between Tier 1 or 2 and the Tier 3 specialist the hard cases go to.
- Security Investigations
- Advanced Threat Hunting Workshop
- Breach Analysis
- Root Cause Analysis & Reporting
Your starting point · Build
Not an introductory courseBlue Team Engineer – build it, harden it, explain it.
Fourteen modules at engineering depth: detection logic and data pipelines, Conditional Access and privileged identity, network segmentation, cloud posture, AI security, risk assessment and recommendations reporting.
It ends with three configuration practice sessions in your own tenants: you build the identity, detection and cloud layers, evidence them against a control framework and walk your tutor through every setting. You leave with that configuration pack for your portfolio.
- 28 live classes, 14 modules
- Configuration practice in your own tenants
- A configuration pack for your portfolio
- Assumes you are already technically capable
The ladder
Three programmes. One foundation, two directions.
Analyst and Specialist share the same 26-class foundation; Specialist adds four classes on top. Engineer is a separate programme for people who want to design rather than operate. All three include AI security, pitched at the right level for each.
Blue Team Analyst26 classes · 52 hours
The foundation
Blue Team Specialist30 classes · 60 hours
The same 26, plus 4 specialist classes
Blue Team Engineer28 classes · 56 hours
A separate programme · ends with 3 build sessions
AI securitySpecialist block / configuration practiceEach square is one two-hour class
MCWBTA · Level 1 → 2
Blue Team Analyst
InvestigateYou’ll run the daily security operation – reviewing what the tools flag, deciding what’s real, and escalating the rest properly.
- Triage a SIEM alert queue and justify every verdict
- Investigate a reported phishing email end to end
- Review endpoint and compliance reports, and chase the fixes
- Spot a compromised account and act on it
- Log, prioritise and hand over incidents properly
- Use GenAI in the SOC – and monitor the AI itself when it goes wrong
Finishes withA live SOC shift simulation – a full queue, worked under time, handed over properly.
MCWBTS · Level 2 → 3
Blue Team Specialist
RespondEverything in the Analyst programme, plus four classes that change what job you can do.
The specialist block · 4 classes
- Security Investigations – one incident, end to end, across five sources
- Advanced Threat Hunting Workshop – hypothesis-led hunting with ATT&CK
- Breach Analysis – scope, attacker path and business impact
- Root Cause Analysis & Reporting – the RCA and the post-incident review
Preceded by the same 26 classes as the Analyst programme.
Finishes withA full end-to-end investigation and a written incident report.
MCWBTE · Level 3
Blue Team Engineer
BuildYou’ll build what the other two teams operate – and be able to justify every setting you chose.
- Engineer detection logic and data pipelines, not just tune someone else’s
- Configure Conditional Access, PIM and a tiered admin model
- Build a risk-based vulnerability programme with real governance
- Produce a security risk register and recommendations report
- Build the whole stack hands-on in configuration practice sessions
- Secure an AI deployment – Copilot pre-flight, agent controls, AI telemetry
Finishes withThree configuration practice sessions – you build the stack yourself, evidence it, and talk a tutor through every decision.
Side by side
The full comparison. Every row a real difference.
Pick a programme to light up its column – on a phone, to see it on its own.
| Compared | Blue Team Analyst |
Blue Team Specialist |
Blue Team Engineer |
|---|---|---|---|
| Code | MCWBTA | MCWBTS | MCWBTE |
| In one word | Investigate | Respond | Build |
| Level | Level 1 → 2 | Level 2 → 3 | Level 3 |
| You’re ready if… | You are new to security – from IT, university or another industry | You’re in a SOC and tired of passing tickets upward – or you already know you want Tier 3 work | You build and run infrastructure and want to build the defences |
| The core skill | Triage – deciding fast, and being right | Correlation – making five sources tell one story | Configuration – making the controls work, and proving they do |
| Relationship | The foundation | Analyst + 4 specialist classes | A separate programme |
| Tools stance | Uses them | Queries and tunes them | Configures and engineers them |
| What you write | Case notes and handovers | Incident reports and post-incident reviews | Configuration evidence, risk registers, recommendations reports |
| Finishes with | A live SOC shift simulation | A full end-to-end investigation and written report | Three configuration practice sessions and a build walkthrough |
| Classes | 26 · 52 hours | 30 · the same 26, plus 4 | 28 · 56 hours |
| AI security | 2 classes – using GenAI in the SOC, and monitoring the AI itself | 2 classes – the same as Analyst | 1 class – designing the controls around AI and agents |
| Optional add-on | – | – | Security Architecture Design – 2 days, 3 classes, after the programme |
| Lab access | 6 months after the programme | 6 months after the programme | 6 months after the programme |
| The badge needs | Every assignment passed, each handed in by the final class | Every lab passed, plus both master assignments | Every assignment passed, plus the configuration pack and build walkthrough |
| Job titles | SOC Analyst (Tier 1 and 2) · Security Operations Analyst · IT Security Administrator | SOC Analyst (Tier 3) · Incident Response Analyst · Threat Hunting Specialist | Security Engineer · Cloud Security Engineer · Detection Engineer · Security Consultant |
The fees for all three are set out side by side further down, under what it costs – after everything each programme includes.
Certification
Our badges are earned, not issued on attendance.
MyCyberWay awards two different things, and the difference matters to anyone reading your profile.
Assessed · verifiable
Professional certification badge
- A digital credential issued through Sertifier
- A unique credential ID and a public verification link
- One click to LinkedIn, with your assessed skills attached
- Records the programme version you were assessed against
- Does not expire
Attendance only
Certificate of course completion
For anyone who completes the classes without meeting the badge criteria. It confirms which programme you attended and for how many hours.
It does not carry the badge, and it does not claim assessed competence – because we are not going to tell an employer something we have not checked.
| Requirement | Analyst | Specialist | Engineer |
|---|---|---|---|
| Attend at least 80% of the classes | Yes | Yes | Yes |
| Pass every assignment, each handed in by the final class | Yes | Yes | Yes |
| Complete the four specialist classes | No | Yes | No |
| Pass both master assignments | No | Yes | No |
| Submit the configuration pack from all three practice sessions | No | No | Yes |
| Deliver the build walkthrough | No | No | Yes |
The badge is MyCyberWay’s own verifiable credential – not a regulated or accredited qualification, and not a Microsoft certification. How our badges work
Included
In every programme, whichever rung you start on.
The classes are the start. Everything below comes with each of the three, at no extra cost.
- Live, tutor-led classesTwo hours each: 1 hr 45 teaching, then 15 minutes for your questions. Not pre-recorded video.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
- Hands-on labsYour own Azure subscription and Defender trial tenant, with setup guidance.
- Six months’ lab access afterYour lab stays open after the final class, so you keep practising while you apply and interview.
- Assignments marked by your tutorReviewed by a person, with written feedback. Not auto-graded.
- CV rewrite and LinkedInATS-friendly, written for the roles you are applying for – work we also sell on its own, included in your fee.
- Mock interviewsRun against real role specifications, with direct feedback.
- Premium Jobs, free while you studyEvery UK cyber security role, filtered your way and scored against your CV, from joining your batch until three months after your final class.
- Private job group and mentorshipVetted openings, application guidance and peers on the same path – and a mentor after the last class.
- Verifiable certification badgeOn passing the assessed work. Shareable to LinkedIn in one click.
Not included
- Microsoft licence or Azure consumption costs in your own tenant – the labs run on trial and free-tier services wherever possible
- Third-party exam fees, such as Microsoft certification exams
- Your own computer and internet connection
How it runs
Built for people with a full-time job.
Live online in UK hours, two to three classes a week, every one recorded.
One class, to scale
Two hours, live. 1 hour 45 minutes of teaching, then 15 minutes set aside for your questions.
A typical week, to scale
2–3 live classes (4–6 hours)Lab work and assignments
Around 20 hours a week in total, built for people with a full-time job.
- Frequency
- Two to three classes a week, scheduled around your working pattern
- Delivery
- Live online in UK hours; every session recorded and shared
- Labs
- Your own Azure subscription and Defender trial tenant – free tiers are enough
- Class counts
- Indicative – your tutor adjusts them to your gaps and agrees any change with you in advance
How this course was built
Written by practitioners, for the job you actually want.
A cyber-industry course customised to what UK employers hire for – not a generic syllabus with a logo dropped on the front. When a portal changes or a technique stops mattering, the material changes with it.
- Microsoft Certified TrainersCurrent, annually renewed
- 10+ yearsHands-on enterprise security
- Microsoft Security stackSentinel · Defender · Entra · Purview
- Industry-customisedBuilt from real role specs
- Job-ready, not exam-readyEvery exercise is something you would be asked to do in the role. Certifications are a useful side effect, never the point.
- Examples from real engagementsThe scenarios come from actual estates and actual incidents, with the names changed.
- Questions answered by practitionersYou ask the people who do this work, live in the session – nothing goes to a support queue.
- The same tutor throughoutNobody hands you over halfway: your tutor knows what you have covered and where you struggled.
The journey
From a first phone call to a job offer.
Identical on all three programmes. Every step is included in the fee: nothing is an upsell, and nothing is left to you to work out alone.
1Before you start
A free 20-minute fit call
What you do now, what you want next, and which programme fits – including “not this one” or “not yet”. No obligation, no pressure to enrol.
Free · no commitmentEnrol, and agree your schedule
Two to three classes a week, around your job. The course handout, the terms and the pre-course primer reach you before you pay anything.
2While you learn
Live classes, with your own lab
Tutor-led in UK hours, all recorded, in your own Azure and Defender tenants – not a sandbox, not a video – open for six months after the last class.
Weekly assignments, marked by your tutor
Practical work reviewed by a person, with written feedback – not auto-graded. They are what earn the certification.
Certification – the badge for your programme
Pass every assignment and the badge for your programme is issued: a verifiable credential with a unique ID and a public verification link, added to LinkedIn in one click with your assessed skills attached.
Earned, not automatic
3Getting the job
Your CV rewritten and LinkedIn optimised
ATS-friendly and written for the roles you are applying for – recruiters search LinkedIn by skill, so we make sure yours are the skills they search for.
Mock interviews against real role specs
Run as a SOC or security engineering interview would actually run, with direct feedback – you practise the hard questions before somebody asks them for real.
Free job feed while you are a student
Vetted openings through MyCyberWay Premium Jobs, free from joining your batch until three months after your final class, plus application guidance and a private group applying for the same roles.
Included · normally paidPlaced – and still supported
Mentorship does not stop on the last class. The first weeks in a new role are when having somebody to ask is worth the most.
Being straight with you. We do not guarantee a job, and you should be wary of anyone who does. What we guarantee is that every step above happens, that a person does it with you, and that we will tell you honestly where you stand at each one.
What it costs
Priced by the class. Nothing hidden.
Every class is two hours. The fee is simply the class rate times the number of classes, plus your CV rewrite and LinkedIn optimisation.
MCWBTA · Investigate
Blue Team Analyst
£1,160in total
- 26 classes × £40
- £1,040
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,160
Or half now (£580) and half by class 13 – ask us
MCWBTS · Respond
Blue Team Specialist
£1,470in total
- 30 classes × £45
- £1,350
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,470
Or half now (£735) and half by class 15 – ask us
MCWBTE · Build
Blue Team Engineer
£1,660in total
- 28 classes × £55
- £1,540
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,660
Or half now (£830) and half by class 14 – ask us
Three ways to pay – the class rate is the same whichever you choose
- In full at checkoutEnrol online and pay the programme fee.
- Half now, half by mid-programmeHalf on enrolment and the balance by the middle class – set out in your enrolment agreement.
- An instalment planBook a call and we send the enrolment agreement with the plan in it.
Already done the Analyst programme?
Upgrading to Specialist is the four specialist classes at the Specialist rate – £180, not the full fee. The 26 classes you have done are never charged twice.
Talk to us first
Have a conversation before you commit to anything.
Pricing, payment plans, a schedule that fits shift work, whether this is even the right programme for you – all of it is easier settled in a twenty-minute chat than guessed at from a web page.
- Pricing and packagesWe put the elements together per person rather than selling a fixed bundle, so the figure depends on what you actually need.
- Payment plansInstalments are available on every programme.
- SchedulingEvenings, weekends, around shifts or a full-time job.
- Anything elseIncluding whether you should wait, or start on a different rung.
Class counts are indicative and agreed with you in advance; you are only ever charged for classes delivered. Withdraw at any time – you pay for the classes delivered and the rest is refunded (refund policy). The course handout, with the full terms, reaches you before you pay anything.
Aren’t Analyst and Specialist the same thing?
The first 26 classes are the same, deliberately – both teach you to operate the security stack and work a live alert queue. Specialist then adds four classes Analyst does not have: Security Investigations, an Advanced Threat Hunting Workshop, Breach Analysis, and Root Cause Analysis & Reporting. Those four are the difference between working the queue and owning the investigation – between a Tier 1 or 2 analyst and the Tier 3 specialist the hard cases are escalated to.
Can I start with Analyst and add the Specialist classes later?
Yes, and plenty of people do. You pay only for the four specialist classes, at the Specialist rate – £180. The 26 shared classes are never charged twice. Tell us when you are ready and we schedule the four with the next group running them.
Which one should I start with?
Match it to the job you want next. A first SOC role: Analyst is enough. Tier 3 and investigation work, or you already work a queue: Specialist. You build or run infrastructure and want to design security rather than operate it: Engineer. If you are unsure, book a fit call and we will tell you honestly – including if the answer is “not yet”.
Do I need prior security experience?
For Analyst, no. It is the entry point and it is built for people with none – students, graduates and career changers from outside IT. You need comfort using a computer, a willingness to learn and about 20 hours a week; networking and cloud basics are taught in the first two classes. Specialist starts from the same beginning but works at depth and expects you to keep pace. Engineer assumes existing technical competence from class one.
How do I earn the certification?
Attend at least 80% of the classes, and pass every assignment your tutor sets, each handed in by the final class. The Specialist badge also needs both master assignments. The Engineer badge also needs the configuration pack from all three practice sessions and the build walkthrough. Complete the classes without meeting the criteria and you receive a certificate of course completion instead.
Can I move from one programme to the next?
Yes. Analyst upgrades to Specialist by adding the four specialist classes, and you pay only for those. Engineer is a separate programme: it assumes technical competence rather than prior MyCyberWay study, and nothing in it repeats the other two.
How much time does it take each week?
Two to three classes a week, two hours each, scheduled around your job. Budget around 20 hours a week in total, including lab work and assignments. The programmes are built for people in full-time work, but they are not passive.
Do you guarantee a job at the end?
No, and be cautious of anyone who does. What is included is a rewritten CV, an optimised LinkedIn profile, mock interviews against real role specifications, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market – and we will be straight with you about all three.
What do I need for the labs?
A Microsoft Azure subscription and a Defender trial tenant – the free tiers are enough for the course – and a machine that comfortably runs a browser. We send setup guidance before the modules that need them. Your lab stays open for six months after the programme ends, so you can keep practising while you job hunt.
What if I need to pause or stop?
Give us a week’s notice before your next scheduled class and we pause the programme. You are charged for the classes delivered, pro rata at the per-class rate, and you can withdraw at any time. The full terms are in the course handout, which you receive before paying anything.
How do I get into my course after I enrol?
Your MyCyberWay account is created when you check out. We then agree your start date and schedule with you, set up your learning account and email you how to sign in before your first class. Our new learning portal opens soon – see what happens after you enrol.
Can my employer pay?
Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure which one fits?
Book a free 20-minute fit call.
We will ask what you do now and what you want next, and tell you which programme fits – or if the honest answer is that you are not ready for one yet.
