Blue Team Analyst
Your first real job in a security operations centre: 26 live classes from no security experience to Tier 1 and 2 work.
- Level1 to 2
- Live classes26, two hours each
- Classroom time52 hours
- Modules12
- Before you startNo experience needed
The roles it prepares you for
Every module is shaped around the job adverts for these roles, and so are your CV and mock interviews.
- SOC AnalystTier 1 and Tier 2
- Security Operations AnalystIn-house or MSSP
- IT Security AdministratorA hybrid IT and security role
- Junior Cyber Security AnalystYour entry to the profession
What you will be able to do
Not topics covered: tasks you can perform, unsupervised, in a live environment.
- Work a live alert queue in Microsoft Sentinel: triage by severity, separate true positives from noise, and escalate with case notes somebody else can act on.
- Write KQL to search and correlate events across identity, endpoint, email and network data.
- Investigate a compromised account in Entra ID – risky sign-ins, impossible travel, and the correct containment action.
- Take a Defender for Endpoint alert from process tree to isolation decision, and justify the decision either way.
- Analyse a reported phishing email properly: headers, message trace, quarantine, and the indicators that make it business email compromise.
- Run a vulnerability scan, prioritise the output with CVSS, EPSS and asset criticality, and track remediation to closure.
- Use Microsoft Security Copilot in triage, and work the alerts that AI tooling itself generates.
- Complete a full SOC shift simulation with a documented handover at the end.
12 modules, 26 live classes
Open any module to see what it covers. Your tutor adjusts class counts to your gaps and agrees any change first.
01Cyber Security Fundamentals
The threat landscape and the attack lifecycle. CIA triad, defence in depth, least privilege. NIST CSF, CIS Controls and MITRE ATT&CK as the frameworks you will actually use.
02IT & Cloud SOC Fundamentals
How a SOC is structured – tiers, escalation, MTTD and MTTR. Azure and Microsoft 365 tenant structure, shared responsibility, and which services produce the telemetry you read.
03SIEM & SOAR Operations
Microsoft Sentinel end to end: connectors, KQL, analytics rules, incident investigation, triage method, false-positive tuning and playbooks.
04Identity & Access Monitoring
Entra ID operations, Identity Protection, suspicious sign-ins and impossible travel, and containing a compromised account.
05Endpoint Monitoring
Defender for Endpoint alerts, process trees, living-off-the-land and PowerShell abuse, device compliance, and isolation.
06Network & Firewall Monitoring
Protocols and trust zones, firewall and NSG logs, DNS anomalies, packet analysis in Wireshark, and firewall-led investigation.
07Email & Phishing Investigation
What SPF, DKIM and DMARC failures tell you, Defender for Office 365 submissions, header forensics, message trace, quarantine and BEC indicators.
08Vulnerability Management
Scanning, reading the output, prioritising with CVSS, EPSS and asset criticality, and tracking remediation with the teams who own the fix.
09Threat Intelligence Monitoring
Defender Threat Intelligence, feeds and IoCs, and escalating what is actually relevant to your organisation.
10Compliance Monitoring
How ISO 27001 and NIST requirements land on daily tasks, Intune device compliance, and collecting audit evidence.
11Incident Management
Severity and priority, PICERL at analyst level, ITSM platforms (Jira, ServiceNow, Halo), and case notes and handovers.
12GenAI & AI Security Monitoring
Using Security Copilot in triage and knowing what still needs verifying – and monitoring the AI itself: inherited permissions, prompt injection and Purview DSPM for AI.
How the classes run
Built for people with a full-time job.
- Live, two-hour classes1 hour 45 of teaching, then 15 minutes for your questions.
- When2–3 live classes a week, arranged around your job
- Time each weekAround 20 hours a week in total, including the classes
- Labs in your own tenantYour own Azure subscription and Defender trial tenant; the free tiers are enough. Open for six months after you finish.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
How you earn the badge
To earn the MCW Certified Blue Team Analyst badge you attend at least 80% of classes and pass every assignment, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not a Microsoft certification.
Priced by the class
The class rate times the classes, plus your CV rewrite and LinkedIn optimisation, paid in full when you enrol.
£1,160in total
- 26 classes × £40
- £1,040
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,160
Paid in full at checkout. To spread the cost, choose PayPal there: PayPal may offer Pay Later, subject to its own checks.
Upgrading to Specialist later? You add the four specialist classes only: 4 × £45 = £180.
After you enrol
- You get an order confirmation by emailStraight away.
- We agree your start date and scheduleClasses run 2–3 times a week, arranged around your job.
- Your learning portal opensSign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
- Your tutor gets your labs ready with youSetup guidance for your Azure and Defender tenants comes before the modules that need them.
We do not guarantee employment, a particular salary, or a pass in any third-party exam. Outcomes depend on your own effort, your background and the job market – what we can promise is the teaching, the feedback and the support described above.
What the fee includes
- Live, tutor-led teaching
- Every session recorded
- Hands-on labs in your own tenant
- Six months’ lab access after you finish
- Assignments marked by your tutor
- CV rewrite and LinkedIn optimisation
- Mock interviews
- Job feed while you are registered
- Verifiable certification badge
- Support after you are placed
Not included: Microsoft licence or Azure consumption costs in your own tenant; Third-party examination fees; Your own equipment and internet connection..
Questions people ask first
Anything else, ask us. A person replies.
How is this different from Blue Team Specialist?
Specialist is this programme plus four classes: Security Investigations, an Advanced Threat Hunting Workshop, Breach Analysis, and Root Cause Analysis & Reporting. The first 26 classes are identical. Those last four are the difference between working the queue and owning the investigation – between a Tier 1 or 2 analyst and the Tier 3 specialist the hard cases go to. Start here and you can add them later for £180.
Do I need security experience to start?
No. This is the entry point and it is built for people with none – students, graduates and career changers from outside IT. You need comfort using a computer, a willingness to learn and about 20 hours a week; networking and cloud basics are taught in the first two classes. Still unsure? Book the fit call and we will tell you straight.
Do I need a certification like Security+ first?
No. Many students arrive with one and no practical experience – exactly the gap this programme fills. Others arrive with neither. Both work.
What do I need for the labs?
A Microsoft Azure subscription and a Defender trial tenant – the free tiers are enough – and any machine that comfortably runs a browser. We send setup guidance before the modules that need them. Your lab stays open for six months after the programme ends, so you can keep practising while you job hunt.
What happens if I miss a class?
Every session is recorded and shared. Give 48 hours’ notice to reschedule and there is no charge. Attendance below 80% affects eligibility for the badge and for the Certificate of Course Completion.
Do you guarantee a job?
No, and be cautious of anyone who does. What is included is a rewritten CV, an optimised LinkedIn profile, mock interviews against real role specifications, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market – and we will be straight with you about all three.
Can I pause the programme?
Yes. Give a week’s notice before your next scheduled class. You are charged for classes delivered, pro rata at the per-class rate. The full terms are in the course handout, which you receive before paying anything.
How do I get into my course after I enrol?
Your MyCyberWay account is created when you check out, and it is also your sign-in to the learning portal. Once we have agreed your start date and schedule and placed you in your batch, your classes and their Join on Teams links, recordings, labs, quizzes and calendar are all there.
Can my employer pay?
Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure it is the right level?
Book a free 20-minute call. We will tell you honestly which programme fits, even if it is none of them yet.