Blue Team Engineer
Stop running security controls and start building them: 28 live classes, configured hands-on in your own tenants.
- Level3
- Live classes28, two hours each
- Classroom time56 hours
- Modules14
- Before you startTechnical experience assumed
The roles it prepares you for
The engineering and consulting roles that design what the SOC runs on.
- Security EngineerBlue team and detection engineering
- Security Operations EngineerBuilding what the SOC runs on
- Cloud Security EngineerAzure-focused, multi-cloud aware
- Security ConsultantClient-facing design and assessment
- Information Security ConsultantRisk, compliance and architecture
- Detection EngineerBuilding what catches the attack
What you will be able to do
Build it, harden it, evidence it, explain it.
- Engineer detection logic and data ingestion pipelines rather than tuning rules somebody else wrote.
- Design a Conditional Access policy set, a PIM model and a tiered admin structure – and run the break-glass path.
- Build a risk-based vulnerability programme with SLAs, exception handling and reporting that survives an executive audience.
- Harden a cloud estate with CSPM, Azure Policy and a landing zone that scales.
- Run a structured risk assessment using STRIDE and FAIR, and keep a risk register written properly.
- Secure an AI deployment: Copilot pre-flight hardening, agent identity and tool allow-lists, and AI telemetry routed into the SIEM.
- Explain every configuration decision – what it blocks, what it breaks, and what it costs to run.
14 modules, 28 live classes
Open any module to see what it covers. The last module is three build sessions in your own tenants.
01Fundamentals – an Engineer’s Lens
Frameworks as engineering blueprints: NIST CSF, MITRE ATT&CK, CIS Controls and Zero Trust, and where each control sits.
02SIEM & SOAR Engineering
Ingestion design, retention and cost, detection rules from threat hypotheses, KQL across every source, and SOAR playbook design.
03Identity & Access Management Engineering
Entra ID architecture, hybrid identity, Conditional Access engineering, PIM, identity threat detection, and AD tiering.
04Threat Intelligence – Operational & Strategic
CTI into detection engineering, ATT&CK coverage gaps, platform integration, and briefings in business-risk language.
05Endpoint Security Engineering
EDR architecture across Windows, Linux, macOS and mobile, ASR, policy design, advanced hunting and live response.
06Vulnerability Management Engineering
Scanner architecture, risk-based prioritisation with CVSS, EPSS and asset criticality, governance and reporting.
07Compliance Management & Security Controls
ISO 27001 Annex A, NIST CSF 2.0, CIS v8, Cyber Essentials Plus, Purview and Intune compliance design.
08Email Security Engineering
SPF, DKIM and DMARC architecture, Defender for Office 365 policy, BEC investigation, simulation and quarantine governance.
09Incident Management & Response Engineering
PICERL at depth, playbooks for ransomware, phishing, privilege escalation and insider threat, and evidence handling.
10Network Security Engineering
Segmentation and trust zones, ZTNA, firewall and cloud network policy, C2 detection and DNS security.
11Cloud Security Engineering
CSPM at scale, CIS hardening, cloud-native detection and response, and mapping Azure controls to AWS and GCP.
12Risk Assessment & Recommendations Reporting
FAIR, STRIDE and PASTA, the risk register, and the recommendations report and investment case.
13AI Security Engineering
The four-part AI attack surface – data, prompt, actions and identity – Copilot pre-flight hardening and agent security.
14Configuration Practice Sessions
Three build sessions: identity, detection and response, cloud, network and email – evidenced against CIS and NIST CSF.
It ends with a working build
Three build sessions in your own Azure and Defender tenants. You get the requirement as a ticket, configure it, evidence it against CIS and NIST CSF, and walk it through.
- A Conditional Access policy set, with break-glass
- PIM roles
- A tiered admin model
- Connectors and ingestion
- Analytics rules and watchlists
- A SOAR playbook
- Defender policies and attack surface reduction
- Defender for Cloud and Azure Policy
- Segmentation and firewall rules
- SPF, DKIM and DMARC
How the classes run
Built for people with a full-time job.
- Live, two-hour classes1 hour 45 of teaching, then 15 minutes for your questions.
- When2–3 live classes a week, arranged around your job
- Time each weekAround 20 hours a week in total, including the classes
- Labs in your own tenantsYour own Azure and Defender tenants, where you configure every control yourself.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
How you earn the badge
To earn the MCW Certified Blue Team Engineer badge you attend at least 80% of classes and pass every assignment, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not a Microsoft certification.
Priced by the class
The class rate times the classes, plus your CV rewrite and LinkedIn optimisation, paid in full when you enrol.
£1,660in total
- 28 classes × £55
- £1,540
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,660
Paid in full at checkout. To spread the cost, choose PayPal there: PayPal may offer Pay Later, subject to its own checks.
After you enrol
- You get an order confirmation by emailStraight away.
- We agree your start date and scheduleClasses run 2–3 times a week, arranged around your job.
- Your learning portal opensSign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
- Your tutor gets your labs ready with youSetup guidance for your Azure and Defender tenants comes before the modules that need them.
We do not guarantee employment, a particular salary, or a pass in any third-party exam. Outcomes depend on your own effort, your background and the job market – what we can promise is the teaching, the feedback and the support described above.
What the fee includes
- Live, tutor-led teaching
- Every session recorded
- Hands-on labs in your own tenant
- Six months’ lab access after you finish
- Assignments marked by your tutor
- CV rewrite and LinkedIn optimisation
- Mock interviews
- Job feed while you are registered
- Verifiable certification badge
- Support after you are placed
Not included: Microsoft licence or Azure consumption costs in your own tenant; Third-party examination fees; Your own equipment and internet connection..
Optional add-on: Security Architecture Design
Three classes at £165, taken after the programme, for people heading for consultancy or an architect title. You design the target-state security architecture for a realistic client and present it to a simulated board. It is priced separately because most engineering roles will not call for it in the first two years.
Questions people ask first
Anything else, ask us. A person replies.
How is this different from Blue Team Specialist?
Specialist teaches you to investigate – to take one incident and own it end to end. Engineer teaches you to build – to configure the controls, engineer the detections and stand behind the settings you chose. A Specialist answers “what happened?”. An Engineer answers “what should be switched on, configured how, and how do we prove it works?”.
Do I need to have done Analyst or Specialist first?
No. This programme assumes technical competence, not prior MyCyberWay study – plenty of students come straight in from infrastructure, cloud or network engineering. If you have done one of the others, nothing is repeated, and some modules may be shortened, which we agree with you beforehand.
Is this an introductory course?
No, and it will be uncomfortable if you treat it as one. It assumes you are already technically capable and focuses on building, configuring, detecting and designing at enterprise level from the first class.
What are the configuration practice sessions, exactly?
Three build sessions at the end of the programme, in your own Azure and Defender tenants. You are given a requirement – the way it would arrive as a ticket – and you configure it yourself: identity in the first, detection and response in the second, and cloud, network and email in the third. Each ends with you evidencing the build against CIS and NIST CSF and walking your tutor through every decision. The resulting configuration pack is required for the badge.
Is the security architecture workshop included?
It is a separate two-day add-on – 3 classes, £165 – rather than part of the core price. The programme trains security engineers, and most engineering roles do not ask for a board-level architecture in the first couple of years. Heading towards consultancy or an architect title? Take it: you design a full target-state architecture for a realistic client and defend it to a simulated board. Say so on the fit call and we will plan it in.
Will this prepare me for SC-500 or SC-200?
It covers most of the ground for both, and for SC-300. It teaches the job rather than the exam syllabus, so you would want some focused revision before sitting them. SC-100, the architect exam, goes further than this programme deliberately – the architecture add-on is the bridge if that is where you are heading. Ask on the fit call and we will tell you which is worth your time.
What do I need for the labs?
An Azure subscription, a Sentinel workspace and a Defender for Endpoint trial tenant. Free tiers are enough for most modules. Setup guidance comes before the modules that need it, and you are expected to have the environment ready in advance. Your lab stays open for six months after the programme ends.
How much independent work is expected?
Around 20 hours a week, including the classes. This is an engineering-level programme with a high expectation of independent practice: the classes give the instruction and the guidance, and the capability comes from the hours you spend in the lab between them.
Can I pause the programme?
Yes. Give a week’s notice before your next scheduled class. You are charged for classes delivered, pro rata at the per-class rate. The full terms are in the course handout, which you receive before paying anything.
Can my employer pay?
Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure it is the right level?
Book a free 20-minute call. We will tell you honestly which programme fits, even if it is none of them yet.