Certification guidance
Tell us where you are now and the job you want: see the certifications that add up, in order, and which we teach.
- Roles mapped11
- Microsoft exams taught9
- Our badges5
- AdviceFree to read
Your certification roadmap
Pick where you are now and the job you want, and tick what you hold. The line is your path, in order; the dashed branch is what else the job adverts ask for.
SOC analyst (Tier 1)
Works the alert queue: triages what comes in, investigates phishing and suspicious sign-ins, and escalates what matters with notes someone else can act on.
3 steps on this path
Start
SC-900
Security, Compliance and Identity Fundamentals. The vocabulary everything else uses.
Do the job
Blue Team Analyst26 live classes, your own lab tenant, and a MyCyberWay badge for the assessed work.
Prove it
SC-200
Security Operations Analyst Associate: Defender XDR, Sentinel, KQL and incident response.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Vendor-neutral
- CompTIA Security+, ISC2 Certified in Cybersecurity (CC)
- Hands-on SOC
- Blue Team Level 1, TryHackMe SAL1, HTB CDSA
Where it leads
Incident responder and threat hunter (Tier 2 to 3)
Owns the investigation: hunts without an alert to start from, builds the breach timeline, finds the root cause and writes it up for people who weren’t there.
2 steps on this path
Baseline
SC-200
If you don’t already hold it: the security operations exam on the Microsoft stack.
Go deeper
Blue Team Specialist30 live classes: investigations, an advanced threat hunting workshop, breach analysis, root cause analysis and reporting. Two master assignments before the badge.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Vendor-neutral
- CompTIA CySA+
- Specialist
- GIAC GCIH, GIAC GCFA, GIAC GCFE
- Hands-on
- Blue Team Level 2
- CREST
- CREST intrusion analysis exams
Where it leads
Security engineer
Builds and tunes the defences (detection rules, identity hardening, segmentation, endpoint and cloud controls), then explains the design to the people who have to live with it.
3 steps on this path
Start from your side
SC-200 or SC-300
SC-200 if you come from operations, SC-300 if you come from identity.
Build it
Blue Team Engineer28 live classes across 14 modules, configured in your own tenants, with a configuration pack for your portfolio.
Prove it
SC-500
Cloud and AI Security Engineer Associate: identity, networks, data, compute and AI workloads, with Defender for Cloud and Sentinel.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Vendor-neutral
- CompTIA SecurityX, ISC2 SSCP
- Later in your career
- ISC2 CISSP
Where it leads
Cloud security engineer
Secures the platform itself: identities and keys, networks and private endpoints, workloads and containers, and the security posture of the whole estate.
3 steps on this path
Start
AZ-900
Azure Fundamentals, if Azure is new to you.
Run it
AZ-104
Azure Administrator Associate. SC-500 expects you to administer Azure already.
Secure it
SC-500
Cloud and AI Security Engineer Associate, the exam that replaced AZ-500 in 2026.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Other clouds
- AWS Certified Security – Specialty, Google Professional Cloud Security Engineer
- Vendor-neutral
- ISC2 CCSP, CSA CCSK
- Containers
- CNCF CKS
Where it leads
Identity and access administrator
Decides who can sign in to what: authentication and MFA, Conditional Access, privileged roles, access reviews and application access.
3 steps on this path
Start
SC-900
Identity, security and compliance concepts across Microsoft 365 and Azure.
The role’s exam
SC-300
Identity and Access Administrator Associate: Entra ID, Conditional Access, Privileged Identity Management and governance.
Later
SC-100
SC-300 is one of the routes to Cybersecurity Architect Expert, if design is where you’re heading.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Identity platforms
- Okta certifications, CyberArk (privileged access), SailPoint (identity governance)
- Vendor-neutral
- IDPro CIDPRO
Where it leads
Endpoint security administrator
Keeps the devices in line: enrolment, compliance and configuration policies, updates, and the endpoint protection that sits on top. Often the shortest certified step out of a help desk.
3 steps on this path
Start
SC-900
The security context for every policy you’ll be asked to enforce.
The role’s exam
MD-102
Endpoint Administrator Associate: Windows, Intune, compliance policies, updates and endpoint protection.
Next
SC-200
When you want to move from managing endpoints to investigating what happens on them.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Vendor-neutral
- CompTIA A+, CompTIA Security+
- Other platforms
- Jamf (Apple devices), CrowdStrike CCFA
Where it leads
Data protection and compliance administrator
Turns data rules into working controls: classification and sensitivity labels, data loss prevention, retention and insider risk, and now what AI tools are allowed to see.
3 steps on this path
Start
SC-900
How Microsoft frames security, compliance and identity. Fast, and it makes the rest readable.
The role’s exam
SC-401
Information Security Administrator Associate: labels, DLP, retention and insider risk in Microsoft Purview.
Next
SC-300
Identity and access, because most data leaks are really access problems.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Privacy
- IAPP CIPP/E, IAPP CIPM, IAPP CIPT
- Governance
- ISACA CDPSE, ISO/IEC 27001 Lead Implementer
Where it leads
GRC, risk and audit
Sets and checks the rules: policies, risk registers, audits against standards such as ISO/IEC 27001, and the evidence that controls actually work.
3 steps on this path
Start the role
GRC Analyst16 live classes: risk registers, ISO 27001 and NIST, audit evidence, privacy and supplier risk, with a badge for the assessed work.
Go senior
GRC Specialist16 live classes for people already in GRC: governance and the board, FAIR risk in money, audits, consulting and GRC engineering.
If you run Microsoft controls
SC-401
Information Security Administrator: Microsoft Purview, data classification and loss prevention.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Foundation
- BCS CISMP
- Standards
- ISO/IEC 27001 Lead Implementer, ISO/IEC 27001 Lead Auditor
- Senior
- ISACA CISA, ISACA CRISC, ISACA CISM
- Professional registration (UK)
- UK Cyber Security Council, Governance and Risk Management
Where it leads
Security architect
Designs security for the whole organisation (Zero Trust, ransomware resilience, and the protection of identity, infrastructure, applications, data and AI) and justifies it to the people paying for it.
3 steps on this path
First
An associate certification
SC-200, SC-300 or SC-500, wherever your depth already is. SC-100 needs one behind it: check Microsoft’s current list before you book.
Build depth
Blue Team EngineerIf you’ve never built the controls you’d be designing. Architecture without build experience shows.
The role’s exam
SC-100
Cybersecurity Architect Expert: Zero Trust design, resilience, and security across operations, identity, infrastructure, apps, data and AI.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Vendor-neutral
- ISC2 CISSP, CompTIA SecurityX
- Architecture frameworks
- SABSA, TOGAF
- Professional registration (UK)
- UK Cyber Security Council, Secure System Architecture and Design
The senior end of this ladder
Application security and DevSecOps
Puts security into the way software is built: code scanning, secrets and dependency management, secure pipelines and hardened application platforms.
2 steps on this path
What we teach
SC-500
Its compute section covers securing App Service, containers, AKS, Functions and API Management.
On request
GH-500
GitHub Advanced Security: code scanning, secret protection and supply chain security. Delivered by Microsoft, maintained by GitHub.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Secure development
- ISC2 CSSLP, GIAC GWEB
- Containers
- CNCF CKS
- Testing web apps
- OffSec OSWE
Where it leads
Penetration tester (red team)
Attacks systems with permission to show where they break, then writes it up so the defenders can fix it.
Not taught yet: our red team programme is coming. The side branch shows what employers ask for today.
Side branch. Also in the job adverts we read for this role. Not taught by MyCyberWay.
- Entry
- CompTIA PenTest+, INE eJPT, TryHackMe PT1
- Practical
- OffSec OSCP+, HTB CPTS
- CREST
- CREST CPSA, CREST CRT
Where it leads
Every path at a glance
| Role | Who it suits | The path |
|---|---|---|
| SOC analyst (Tier 1) | Entry level | SC-900, then Blue Team Analyst, then SC-200 |
| Incident responder and threat hunter (Tier 2 to 3) | After 2 years or more in a SOC | SC-200, then Blue Team Specialist |
| Security engineer | After 3 years or more in security | SC-200 or SC-300, then Blue Team Engineer, then SC-500 |
| Cloud security engineer | After 2 years or more in cloud or infrastructure | AZ-900, then AZ-104, then SC-500 |
| Identity and access administrator | Entry to mid level | SC-900, then SC-300, then SC-100 |
| Endpoint security administrator | Entry to mid level | SC-900, then MD-102, then SC-200 |
| Data protection and compliance administrator | Entry to mid level | SC-900, then SC-401, then SC-300 |
| GRC, risk and audit | Any background | GRC Analyst, then GRC Specialist, then SC-401 |
| Security architect | Senior | An associate certification, then Blue Team Engineer, then SC-100 |
| Application security and DevSecOps | Developers moving into security | SC-500, then GH-500 |
| Penetration tester (red team) | Offensive security | Not taught yet |
Microsoft awards its certifications when you pass its exams, which you book and pay for separately. The side branches name other vendors’ certifications so you can see the whole market; we do not teach them. Your choices stay in this browser.
Why the main road is Microsoft
We don’t teach every certification, and we won’t pretend the ones we teach are the only ones that count.
The usual questions
Anything else, ask us. A person replies.
Why is the main path always Microsoft?
Because it’s what we teach, and because Microsoft 365 and Entra ID sit underneath a large share of employers worldwide, so the skills travel. It isn’t the only route: every role on the roadmap shows the other certifications employers ask for on its side branch.
Do you teach CompTIA, ISC2, GIAC or CREST certifications?
No. We name them because they’re on real adverts, not because we sell them. If one of them is the right next step for you, we’ll say so.
I hold AZ-500. Do I need SC-500?
AZ-500 retired on 31 August 2026. Your certification stays on your transcript, but it can no longer be renewed, and there is no transition exam. To hold the current security engineer certification you pass SC-500.
How many certifications do I actually need?
For a first role, two is normally enough: one fundamentals exam and one associate exam. After that, evidence of work beats a longer list every time. Collecting certificates instead of building something is the most expensive mistake in this industry.
Are the exam fees included?
No. You pay Microsoft directly for the exam, and you book it when you’re ready. We’ll tell you honestly when that is.
Is a MyCyberWay badge the same as a Microsoft certification?
No, and we never present it as one. A Microsoft certification comes from passing Microsoft’s exam. Our badge is our own record that you completed and passed the assessed work on our programme. How our badges work.
Do you teach red team certifications?
Not today. Red team and purple team programmes are in development. Everything we run now is blue team: defending, detecting and responding.
Want a path you can defend?
A 30-minute plan call goes through your background and ends with your plan in writing.