Blue Team Engineer Programme

Blue Team Engineer takes one domain at a time – detection engineering, identity, endpoint, vulnerability, compliance, email, incident response, network, cloud, risk and AI security – each configured hands-on in your own Azure and Microsoft Defender tenants. It closes with three consolidated build sessions in which you configure the whole stack, evidence it against CIS and NIST CSF, and defend every decision: what it blocks, what it breaks, and what it costs to run.

What you will be able to do

• Engineer detection logic and data ingestion pipelines rather than tuning rules somebody else wrote.
• Design a Conditional Access policy set, a PIM model and a tiered admin structure – and run the break-glass path.
• Build a risk-based vulnerability programme with SLAs, exception handling and reporting that survives an executive audience.
• Harden a cloud estate with CSPM, Azure Policy and a landing zone that scales.
• Run a structured risk assessment using STRIDE and FAIR, and keep a risk register written properly.
• Secure an AI deployment: Copilot pre-flight hardening, agent identity and tool allow-lists, and AI telemetry routed into the SIEM.
• Explain every configuration decision – what it blocks, what it breaks, and what it costs to run.

The curriculum — 14 modules, 28 classes

1. 01

   Fundamentals — an Engineer’s Lens 1 class

   Frameworks as engineering blueprints: NIST CSF, MITRE ATT&CK, CIS Controls and Zero Trust, and where each control sits.

2. 02

   SIEM & SOAR Engineering 3 classes

   Ingestion design, retention and cost, detection rules from threat hypotheses, KQL across every source, and SOAR playbook design.

3. 03

   Identity & Access Management Engineering 4 classes

   Entra ID architecture, hybrid identity, Conditional Access engineering, PIM, identity threat detection, and AD tiering.

4. 04

   Threat Intelligence — Operational & Strategic 2 classes

   CTI into detection engineering, ATT&CK coverage gaps, platform integration, and briefings in business-risk language.

5. 05

   Endpoint Security Engineering 2 classes

   EDR architecture across Windows, Linux, macOS and mobile, ASR, policy design, advanced hunting and live response.

6. 06

   Vulnerability Management Engineering 2 classes

   Scanner architecture, risk-based prioritisation with CVSS, EPSS and asset criticality, governance and reporting.

7. 07

   Compliance Management & Security Controls 1 class

   ISO 27001 Annex A, NIST CSF 2.0, CIS v8, Cyber Essentials Plus, Purview and Intune compliance design.

8. 08

   Email Security Engineering 1 class

   SPF, DKIM and DMARC architecture, Defender for Office 365 policy, BEC investigation, simulation and quarantine governance.

9. 09

   Incident Management & Response Engineering 2 classes

   PICERL at depth, playbooks for ransomware, phishing, privilege escalation and insider threat, and evidence handling.

10. 10

    Network Security Engineering 2 classes

    Segmentation and trust zones, ZTNA, firewall and cloud network policy, C2 detection and DNS security.

11. 11

    Cloud Security Engineering 2 classes

    CSPM at scale, CIS hardening, cloud-native detection and response, and mapping Azure controls to AWS and GCP.

12. 12

    Risk Assessment & Recommendations Reporting 2 classes

    FAIR, STRIDE and PASTA, the risk register, and the recommendations report and investment case.

13. 13

    AI Security Engineering 1 class

    The four-part AI attack surface – data, prompt, actions and identity – Copilot pre-flight hardening and agent security.

14. 14

    Configuration Practice Sessions 3 classes

    Three build sessions: identity, detection and response, cloud, network and email – evidenced against CIS and NIST CSF.

What is included

• Live, tutor-led teaching – two hours per class: 1 hour 45 minutes of teaching, then 15 minutes for your questions. Not pre-recorded video.
• Every session recorded – a missed class or a second pass over a difficult topic is never a problem.
• Hands-on labs in your own tenant – your own Azure subscription and Microsoft Defender trial tenant, with setup guidance from your tutor.
• Six months’ lab access after you finish – your environment stays open so you can keep practising while you apply and interview.
• Assignments marked by your tutor – reviewed by a person, with written feedback. They are what the certification is assessed on.
• CV rewrite and LinkedIn optimisation – ATS-friendly and written for the roles you are applying to. £120 of separately priced work, included.
• Mock interviews – run against real security engineering specifications, with direct feedback afterwards.
• Job feed while you are registered – vetted openings through MyCyberWay Premium Jobs, free for the length of your programme.
• Verifiable certification badge – issued through Sertifier on passing the assignments, with a unique ID and a public verification link.
• Support after you are placed – most people have questions in their first weeks in a new role, and that is when having somebody to ask is worth the most.

What is not included

• Microsoft licence or Azure consumption costs in your own tenant. The labs are designed to run on trial and free-tier services wherever possible.
• Third-party examination fees, such as Microsoft certification exams.
• Your own equipment and internet connection.

Certification

To earn the MCW Certified Blue Team Engineer badge you attend at least 80% of classes, submit every assignment, and have those assignments assessed as passed before the final class. If you do not meet those criteria you receive a Certificate of Course Completion instead, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not a Microsoft certification.

Optional add-on — Security Architecture Design

Three classes at £165, taken after the programme, for people heading for consultancy or an architect title. You design the target-state security architecture for a realistic UK client and present it to a simulated board. It is priced separately because most engineering roles will not call for it in the first two years.

Roles it prepares you for

Security Engineer · Security Operations Engineer · Cloud Security Engineer · Detection Engineer · Security Consultant · Information Security Consultant.

Paying

The price here is the full programme fee, paid at checkout (Option A in your enrolment agreement). Prefer to pay half now and the balance by class 14, or spread it over an instalment plan? (or) choose one of our payment provider who offer installment options. Book a call and we will send you the enrolment agreement with those options instead. The per-class rate is the same whichever way you pay, and the total remains same.

What happens after you buy

1. You get an order confirmation by email Straight away.
2. We agree your start date and schedule Classes run 2–3 times a week in UK hours, arranged around your job.
3. We set up your learning account We email you how to sign in before your first class. Our new learning portal opens soon.
4. Your tutor gets your labs ready with you Setup guidance for your Azure and Defender tenants comes before the modules that need them.