Blue Team Engineer Programme

What you will be able to do

• Engineer detection logic and data ingestion pipelines rather than tuning rules somebody else wrote.
• Design a Conditional Access policy set, a PIM model and a tiered admin structure – and run the break-glass path.
• Build a risk-based vulnerability programme with SLAs, exception handling and reporting that survives an executive audience.
• Harden a cloud estate with CSPM, Azure Policy and a landing zone that scales.
• Run a structured risk assessment using STRIDE and FAIR, and keep a risk register written properly.
• Secure an AI deployment: Copilot pre-flight hardening, agent identity and tool allow-lists, and AI telemetry routed into the SIEM.

The curriculum – 14 modules, 28 classes

1. 01Fundamentals – an Engineer’s Lens

   Frameworks as engineering blueprints: NIST CSF, MITRE ATT&CK, CIS Controls and Zero Trust, and where each control sits.

2. 02SIEM & SOAR Engineering

   Ingestion design, retention and cost, detection rules from threat hypotheses, KQL across every source, and SOAR playbook design.

3. 03Identity & Access Management Engineering

   Entra ID architecture, hybrid identity, Conditional Access engineering, PIM, identity threat detection, and AD tiering.

4. 04Threat Intelligence – Operational & Strategic

   CTI into detection engineering, ATT&CK coverage gaps, platform integration, and briefings in business-risk language.

5. 05Endpoint Security Engineering

   EDR architecture across Windows, Linux, macOS and mobile, ASR, policy design, advanced hunting and live response.

6. 06Vulnerability Management Engineering

   Scanner architecture, risk-based prioritisation with CVSS, EPSS and asset criticality, governance and reporting.

7. 07Compliance Management & Security Controls

   ISO 27001 Annex A, NIST CSF 2.0, CIS v8, Cyber Essentials Plus, Purview and Intune compliance design.

8. 08Email Security Engineering

   SPF, DKIM and DMARC architecture, Defender for Office 365 policy, BEC investigation, simulation and quarantine governance.

9. 09Incident Management & Response Engineering

   PICERL at depth, playbooks for ransomware, phishing, privilege escalation and insider threat, and evidence handling.

10. 10Network Security Engineering

    Segmentation and trust zones, ZTNA, firewall and cloud network policy, C2 detection and DNS security.

11. 11Cloud Security Engineering

    CSPM at scale, CIS hardening, cloud-native detection and response, and mapping Azure controls to AWS and GCP.

12. 12Risk Assessment & Recommendations Reporting

    FAIR, STRIDE and PASTA, the risk register, and the recommendations report and investment case.

13. 13AI Security Engineering

    The four-part AI attack surface – data, prompt, actions and identity – Copilot pre-flight hardening and agent security.

14. 14Configuration Practice Sessions

    Three build sessions: identity, detection and response, cloud, network and email – evidenced against CIS and NIST CSF.

Every module, class by class, on the programme page

What is included

• Live, tutor-led teaching
• Every session recorded
• Hands-on labs in your own tenant
• Six months’ lab access after you finish
• Assignments marked by your tutor
• CV rewrite and LinkedIn optimisation
• Mock interviews
• Job feed while you are registered
• Verifiable certification badge
• Support after you are placed

What is not included

• Microsoft licence or Azure consumption costs in your own tenant. The labs are designed to run on trial and free-tier services wherever possible.
• Third-party examination fees, such as Microsoft certification exams.
• Your own equipment and internet connection.

Certification

To earn the MCW Certified Blue Team Engineer badge you attend at least 80% of classes and pass every assignment, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not a Microsoft certification.

Paying

The price here is the full programme fee, paid in full at checkout. To spread the cost, choose PayPal at checkout: PayPal may offer Pay Later, subject to its own checks.

What happens after you buy

1. You get an order confirmation by emailStraight away.
2. We agree your start date and scheduleClasses run 2–3 times a week, arranged around your job.
3. Your learning portal opensSign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
4. Your tutor gets your labs ready with youSetup guidance for your Azure and Defender tenants comes before the modules that need them.

We do not guarantee employment, a particular salary, or a pass in any third-party exam. Outcomes depend on your own effort, your background and the job market – what we can promise is the teaching, the feedback and the support described above.