Blue Team Specialist Programme

Blue Team Specialist builds the full monitoring and detection skill set – Microsoft Sentinel and KQL, identity, endpoint, network, email, vulnerability and incident work – and then takes it to depth: owning a security investigation end to end, hypothesis-led threat hunting against MITRE ATT&CK, reconstructing a breach after the fact, and root cause analysis written for a board as well as for engineers.

What you will be able to do

• Work a live alert queue in Microsoft Sentinel and escalate with documented case notes.
• Write KQL to search and correlate events across identity, endpoint, email and network telemetry.
• Own a security investigation end to end, produce one timeline correlated across five telemetry sources, and know when it is actually closed.
• Run a hypothesis-led hunt against MITRE ATT&CK: form the hypothesis, choose the data, write the KQL, and find what no detection rule caught.
• Reconstruct a breach after the fact – scope, attacker path and dwell time – and express it as business impact.
• Run a post-incident review and write the root cause analysis for a non-technical audience without losing the technical truth.

The specialist block — 4 classes

1. 13

   Security Investigations 1 class

   One incident owned end to end: SIEM, endpoint, identity, email and network telemetry correlated into a single defensible timeline.

2. 14

   Advanced Threat Hunting Workshop 1 class

   Hypothesis-led hunting with MITRE ATT&CK and KQL. This is the assessed piece for the certification badge.

3. 15

   Breach Analysis 1 class

   Scope, attacker path and dwell time – translated into business impact rather than a list of alerts.

4. 16

   Root Cause Analysis & Reporting 1 class

   RCA method, the post-incident review, agreeing remediation, and writing the report for people who are not technical.

The first 26 classes are the Blue Team Analyst curriculum: security fundamentals, SOC structure, Sentinel and SOAR, identity, endpoint, network, email, vulnerability management, threat intelligence, compliance, incident management and AI security monitoring.

What is included

• Live, tutor-led teaching – two hours per class: 1 hour 45 minutes of teaching, then 15 minutes for your questions. Not pre-recorded video.
• Every session recorded – a missed class or a second pass over a difficult topic is never a problem.
• Hands-on labs in your own tenant – your own Azure subscription and Microsoft Defender trial tenant, with setup guidance from your tutor.
• Six months’ lab access after you finish – your environment stays open so you can keep practising while you apply and interview.
• Assignments marked by your tutor – reviewed by a person, with written feedback. They are what the certification is assessed on.
• CV rewrite and LinkedIn optimisation – ATS-friendly and written for the roles you are applying to. £120 of separately priced work, included.
• Mock interviews – run against real incident response and threat hunting specifications, with direct feedback afterwards.
• Job feed while you are registered – vetted openings through MyCyberWay Premium Jobs, free for the length of your programme.
• Verifiable certification badge – issued through Sertifier on passing the assignments, with a unique ID and a public verification link.
• Support after you are placed – most people have questions in their first weeks in a new role, and that is when having somebody to ask is worth the most.

What is not included

• Microsoft licence or Azure consumption costs in your own tenant. The labs are designed to run on trial and free-tier services wherever possible.
• Third-party examination fees, such as Microsoft certification exams.
• Your own equipment and internet connection.

Certification

To earn the MCW Certified Blue Team Specialist badge you attend at least 80% of classes, submit every assignment, and have those assignments assessed as passed before the final class. If you do not meet those criteria you receive a Certificate of Course Completion instead, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not a Microsoft certification.

Roles it prepares you for

SOC Analyst (Tier 3) · Incident Response Analyst · Threat Hunting Specialist · Security Investigations Analyst · Microsoft Security Analyst.

Paying

The price here is the full programme fee, paid at checkout (Option A in your enrolment agreement). Prefer to pay half now and the balance by class 15, or spread it over an instalment plan? (or) choose one of our payment provider who offer installment options. Book a call and we will send you the enrolment agreement with those options instead. The per-class rate is the same whichever way you pay, and the total remains same.

What happens after you buy

1. You get an order confirmation by email Straight away.
2. We agree your start date and schedule Classes run 2–3 times a week in UK hours, arranged around your job.
3. We set up your learning account We email you how to sign in before your first class. Our new learning portal opens soon.
4. Your tutor gets your labs ready with you Setup guidance for your Azure and Defender tenants comes before the modules that need them.