Blue Team Specialist
Own the investigation from first alert to root cause: the Analyst foundation plus the four classes that lead to Tier 3.
- Level2 to 3
- Live classes30, two hours each
- Classroom time60 hours
- Modules16
- Before you startNo qualification needed
The roles it prepares you for
The roles the hard cases go to: Tier 3, incident response and threat hunting.
- SOC AnalystTier 3
- Incident Response AnalystIn-house or MSSP
- Threat Hunting SpecialistHypothesis-led hunting
- Cyber Security AnalystA generalist, at depth
- Security Investigations AnalystAn investigation-led role
- Microsoft Security AnalystSentinel and Defender estates
What you will be able to do
Everything the Analyst can do, plus what matters at Tier 3.
- Work a live alert queue in Microsoft Sentinel and escalate with documented case notes.
- Write KQL to search and correlate events across identity, endpoint, email and network telemetry.
- Own a security investigation end to end, produce one timeline correlated across five telemetry sources, and know when it is actually closed.
- Run a hypothesis-led hunt against MITRE ATT&CK: form the hypothesis, choose the data, write the KQL, and find what no detection rule caught.
- Reconstruct a breach after the fact – scope, attacker path and dwell time – and express it as business impact.
- Run a post-incident review and write the root cause analysis for a non-technical audience without losing the technical truth.
The four classes that change the job
Classes 1 to 26 are the Blue Team Analyst programme, taken in full. These four make the difference.
13Security Investigations
One incident owned end to end: SIEM, endpoint, identity, email and network telemetry correlated into a single defensible timeline.
14Advanced Threat Hunting Workshop
Hypothesis-led hunting with MITRE ATT&CK and KQL.
15Breach Analysis
Scope, attacker path and dwell time – translated into business impact rather than a list of alerts.
16Root Cause Analysis & Reporting
RCA method, the post-incident review, agreeing remediation, and writing the report for people who are not technical.
How the classes run
Built for people with a full-time job.
- Live, two-hour classes1 hour 45 of teaching, then 15 minutes for your questions.
- When2–3 live classes a week, arranged around your job
- Time each weekAround 20 hours a week in total, including the classes
- Labs in your own tenantsYour own Sentinel and Defender tenants, open for six months after you finish.
- Every session recordedA missed class, or a second pass over a hard topic, is never a problem.
How you earn the badge
To earn the MCW Certified Blue Team Specialist badge you attend at least 80% of classes and pass every assignment, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not a Microsoft certification.
Priced by the class
The class rate times the classes, plus your CV rewrite and LinkedIn optimisation, paid in full when you enrol.
£1,470in total
- 30 classes × £45
- £1,350
- CV rewrite
- £60
- LinkedIn optimisation
- £60
- Total
- £1,470
Paid in full at checkout. To spread the cost, choose PayPal there: PayPal may offer Pay Later, subject to its own checks.
Already completed Blue Team Analyst? You add the four specialist classes only: 4 × £45 = £180.
After you enrol
- You get an order confirmation by emailStraight away.
- We agree your start date and scheduleClasses run 2–3 times a week, arranged around your job.
- Your learning portal opensSign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
- Your tutor gets your labs ready with youSetup guidance for your Azure and Defender tenants comes before the modules that need them.
We do not guarantee employment, a particular salary, or a pass in any third-party exam. Outcomes depend on your own effort, your background and the job market – what we can promise is the teaching, the feedback and the support described above.
What the fee includes
- Live, tutor-led teaching
- Every session recorded
- Hands-on labs in your own tenant
- Six months’ lab access after you finish
- Assignments marked by your tutor
- CV rewrite and LinkedIn optimisation
- Mock interviews
- Job feed while you are registered
- Verifiable certification badge
- Support after you are placed
Not included: Microsoft licence or Azure consumption costs in your own tenant; Third-party examination fees; Your own equipment and internet connection..
Questions people ask first
Anything else, ask us. A person replies.
Aren’t the Analyst and Specialist programmes the same thing?
The first 26 classes are the same, deliberately – both teach you to operate the security stack and work a live alert queue. Specialist then adds four classes Analyst does not have: Security Investigations, an Advanced Threat Hunting Workshop, Breach Analysis, and Root Cause Analysis & Reporting. Those four are the difference between a Tier 1 or 2 analyst and the Tier 3 specialist the hard cases go to. We would rather tell you exactly what the extra £310 buys than be vague about it.
Should I do the Analyst programme first?
You do not need to. Start here if you already know you want Tier 3, threat hunting and breach investigation work. Start on Blue Team Analyst if you only need a first SOC role, or if the fee matters more than the timeline – you can add the four specialist classes later for £180, and you are never charged for the same class twice.
Do I need security experience to start?
No. The foundation begins at the beginning, exactly as the Analyst programme does – networking and cloud basics are taught in the first two classes. You need comfort using a computer, a willingness to learn and about 20 hours a week. The specialist block comes after 26 classes of groundwork, not before it.
I already hold the Blue Team Analyst certification. What do I pay?
£180 – four classes at the Specialist rate of £45. You do not repeat the first 26 classes and you are not charged for them again. You join the four specialist classes with the next group running them, and the Specialist badge criteria then apply in full, including both master assignments.
What are the two master assignments?
Master Assignment 1 is a multiple-choice check across the whole programme. Master Assignment 2 is a practical investigation in the lab, from first alert to root cause, written up as a findings report. Your tutor marks both, and both are needed for the badge, so everyone holding it has done the same assessed work.
What do I need for the labs?
A Microsoft Azure subscription and a Defender trial tenant – the free tiers are enough – and any machine that comfortably runs a browser. We send setup guidance before the modules that need them. Your lab stays open for six months after the programme ends.
What happens if I miss a class?
Every session is recorded and shared. Give 48 hours’ notice to reschedule and there is no charge. Attendance below 80% affects eligibility for the badge, though not the course completion certificate.
Do you guarantee a job?
No, and be cautious of anyone who does. What is included is a rewritten CV, an optimised LinkedIn profile, mock interviews against real role specifications, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market – and we will be straight with you about all three.
Can I pause the programme?
Yes. Give a week’s notice before your next scheduled class. You are charged for classes delivered, pro rata at the per-class rate. The full terms are in the course handout, which you receive before paying anything.
Can my employer pay?
Yes. If you are buying for a business, tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure it is the right level?
Book a free 20-minute call. We will tell you honestly which programme fits, even if it is none of them yet.