Blue Team Analyst Programme

Blue Team Analyst prepares you for a first role in a Security Operations Centre. It opens with the threat landscape and the frameworks a defender works to, then builds the practical skill set the job runs on: detection and triage in Microsoft Sentinel, identity and endpoint investigation, phishing analysis, vulnerability management and incident handling. It closes with a full SOC shift simulation – an alert queue worked under time, with a written handover.

What you will be able to do

• Work a live alert queue in Microsoft Sentinel: triage by severity, separate true positives from noise, and escalate with case notes somebody else can act on.
• Write KQL to search and correlate events across identity, endpoint, email and network data.
• Investigate a compromised account in Entra ID – risky sign-ins, impossible travel, and the correct containment action.
• Take a Defender for Endpoint alert from process tree to isolation decision, and justify the decision either way.
• Analyse a reported phishing email properly: headers, message trace, quarantine, and the indicators that make it business email compromise.
• Run a vulnerability scan, prioritise the output with CVSS, EPSS and asset criticality, and track remediation to closure.
• Use Microsoft Security Copilot in triage, and work the alerts that AI tooling itself generates.
• Complete a full SOC shift simulation with a documented handover at the end.

The curriculum — 12 modules, 26 classes

1. 01

   Cyber Security Fundamentals 1 class

   The threat landscape and the attack lifecycle. CIA triad, defence in depth, least privilege. NIST CSF, CIS Controls and MITRE ATT&CK as the frameworks you will actually use.

2. 02

   IT & Cloud SOC Fundamentals 1 class

   How a SOC is structured – tiers, escalation, MTTD and MTTR. Azure and Microsoft 365 tenant structure, shared responsibility, and which services produce the telemetry you read.

3. 03

   SIEM & SOAR Operations 5 classes

   Microsoft Sentinel end to end: connectors, KQL, analytics rules, incident investigation, triage method, false-positive tuning and playbooks.

4. 04

   Identity & Access Monitoring 2 classes

   Entra ID operations, Identity Protection, suspicious sign-ins and impossible travel, and containing a compromised account.

5. 05

   Endpoint Monitoring 3 classes

   Defender for Endpoint alerts, process trees, living-off-the-land and PowerShell abuse, device compliance, and isolation.

6. 06

   Network & Firewall Monitoring 3 classes

   Protocols and trust zones, firewall and NSG logs, DNS anomalies, packet analysis in Wireshark, and firewall-led investigation.

7. 07

   Email & Phishing Investigation 2 classes

   What SPF, DKIM and DMARC failures tell you, Defender for Office 365 submissions, header forensics, message trace, quarantine and BEC indicators.

8. 08

   Vulnerability Management 3 classes

   Scanning, reading the output, prioritising with CVSS, EPSS and asset criticality, and tracking remediation with the teams who own the fix.

9. 09

   Threat Intelligence Monitoring 1 class

   Defender Threat Intelligence, feeds and IoCs, and escalating what is actually relevant to your organisation.

10. 10

    Compliance Monitoring 1 class

    How ISO 27001 and NIST requirements land on daily tasks, Intune device compliance, and collecting audit evidence.

11. 11

    Incident Management 2 classes

    Severity and priority, PICERL at analyst level, ITSM platforms (Jira, ServiceNow, Halo), and case notes and handovers.

12. 12

    GenAI & AI Security Monitoring 2 classes

    Using Security Copilot in triage and knowing what still needs verifying – and monitoring the AI itself: inherited permissions, prompt injection and Purview DSPM for AI.

What is included

• Live, tutor-led teaching – two hours per class: 1 hour 45 minutes of teaching, then 15 minutes for your questions. Not pre-recorded video.
• Every session recorded – a missed class or a second pass over a difficult topic is never a problem.
• Hands-on labs in your own tenant – your own Azure subscription and Microsoft Defender trial tenant, with setup guidance from your tutor.
• Six months’ lab access after you finish – your environment stays open so you can keep practising while you apply and interview.
• Assignments marked by your tutor – reviewed by a person, with written feedback. They are what the certification is assessed on.
• CV rewrite and LinkedIn optimisation – ATS-friendly and written for the roles you are applying to. £120 of separately priced work, included.
• Mock interviews – run against real SOC analyst specifications, with direct feedback afterwards.
• Job feed while you are registered – vetted openings through MyCyberWay Premium Jobs, free for the length of your programme.
• Verifiable certification badge – issued through Sertifier on passing the assignments, with a unique ID and a public verification link.
• Support after you are placed – most people have questions in their first weeks in a new role, and that is when having somebody to ask is worth the most.

What is not included

• Microsoft licence or Azure consumption costs in your own tenant. The labs are designed to run on trial and free-tier services wherever possible.
• Third-party examination fees, such as Microsoft certification exams.
• Your own equipment and internet connection.

Certification

To earn the MCW Certified Blue Team Analyst badge you attend at least 80% of classes, submit every assignment, and have those assignments assessed as passed before the final class. If you do not meet those criteria you receive a Certificate of Course Completion instead, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not a Microsoft certification.

Roles it prepares you for

SOC Analyst (Tier 1 and Tier 2) · Security Operations Analyst, in-house or MSSP · IT Security Administrator · Junior Cyber Security Analyst.

Paying

The price here is the full programme fee, paid at checkout (Option A in your enrolment agreement). Prefer to pay half now and the balance by class 13, or spread it over an instalment plan? (or) choose one of our payment provider who offer installment options. Book a call and we will send you the enrolment agreement with those options instead. The per-class rate is the same whichever way you pay, and the total remains same.

What happens after you buy

1. You get an order confirmation by email Straight away.
2. We agree your start date and schedule Classes run 2–3 times a week in UK hours, arranged around your job.
3. We set up your learning account We email you how to sign in before your first class. Our new learning portal opens soon.
4. Your tutor gets your labs ready with you Setup guidance for your Azure and Defender tenants comes before the modules that need them.