Blue Team Specialist Programme
Thirty live, tutor-led classes for people who will be the escalation point rather than the first responder.
- Level2 to 3
- Live classes30, two hours each
- Classroom time60 hours
- Modules16
- Before you startNo qualification needed
Learn, practise, prove
- LearnLive classes with your tutor: 1 hour 45 minutes of teaching, then your questions. Every class is recorded.
- PractiseHands-on labs in your own tenant, with setup guidance from your tutor.
- ProveAssignments marked by your tutor, with written feedback. Pass them for your verifiable badge.
What you will be able to do
- Work a live alert queue in Microsoft Sentinel and escalate with documented case notes.
- Write KQL to search and correlate events across identity, endpoint, email and network telemetry.
- Own a security investigation end to end, produce one timeline correlated across five telemetry sources, and know when it is actually closed.
- Run a hypothesis-led hunt against MITRE ATT&CK: form the hypothesis, choose the data, write the KQL, and find what no detection rule caught.
- Reconstruct a breach after the fact – scope, attacker path and dwell time – and express it as business impact.
- Run a post-incident review and write the root cause analysis for a non-technical audience without losing the technical truth.
The specialist block – 4 classes
13Security Investigations
One incident owned end to end: SIEM, endpoint, identity, email and network telemetry correlated into a single defensible timeline.
14Advanced Threat Hunting Workshop
Hypothesis-led hunting with MITRE ATT&CK and KQL.
15Breach Analysis
Scope, attacker path and dwell time – translated into business impact rather than a list of alerts.
16Root Cause Analysis & Reporting
RCA method, the post-incident review, agreeing remediation, and writing the report for people who are not technical.
Every module, class by class, on the programme page
The first 26 classes are the Blue Team Analyst curriculum: security fundamentals, SOC structure, Sentinel and SOAR, identity, endpoint, network, email, vulnerability management, threat intelligence, compliance, incident management and AI security monitoring.
What is included
- Live, tutor-led teaching
- Every session recorded
- Hands-on labs in your own tenant
- Six months’ lab access after you finish
- Assignments marked by your tutor
- CV rewrite and LinkedIn optimisation
- Mock interviews
- Job feed while you are registered
- Verifiable certification badge
- Support after you are placed
What is not included
- Microsoft licence or Azure consumption costs in your own tenant. The labs are designed to run on trial and free-tier services wherever possible.
- Third-party examination fees, such as Microsoft certification exams.
- Your own equipment and internet connection.
Certification
To earn the MCW Certified Blue Team Specialist badge you attend at least 80% of classes and pass every assignment, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not a Microsoft certification.
Paying
The price here is the full programme fee, paid in full at checkout. To spread the cost, choose PayPal at checkout: PayPal may offer Pay Later, subject to its own checks.
What happens after you buy
- You get an order confirmation by emailStraight away.
- We agree your start date and scheduleClasses run 2–3 times a week, arranged around your job.
- Your learning portal opensSign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
- Your tutor gets your labs ready with youSetup guidance for your Azure and Defender tenants comes before the modules that need them.
We do not guarantee employment, a particular salary, or a pass in any third-party exam. Outcomes depend on your own effort, your background and the job market – what we can promise is the teaching, the feedback and the support described above.
Free learning resources
A few free, official links to start on now. Links to other sites open in a new tab.
A feel for the job
- MITRE ATT&CK (opens in a new tab)attack.mitre.orgThe shared map of attacker tactics and techniques used in every SOC.
- NCSC incident management (opens in a new tab)ncsc.gov.ukThe UK guidance on planning for and handling an incident.
- Advanced hunting in Defender XDR (opens in a new tab)learn.microsoft.comHunting across endpoints, identities, email and apps with KQL.
When you enrol
The full library for this programme, section by section and chosen by your tutors, is waiting in the learning portal, alongside your classes.
Questions people ask first
Anything else, ask us. A person replies.
Aren’t the Analyst and Specialist programmes the same thing?
The first 26 classes are the same, deliberately – both teach you to operate the security stack and work a live alert queue. Specialist then adds four classes Analyst does not have: Security Investigations, an Advanced Threat Hunting Workshop, Breach Analysis, and Root Cause Analysis & Reporting. Those four are the difference between a Tier 1 or 2 analyst and the Tier 3 specialist the hard cases go to. We would rather tell you exactly what the extra £310 buys than be vague about it.
Should I do the Analyst programme first?
You do not need to. Start here if you already know you want Tier 3, threat hunting and breach investigation work. Start on Blue Team Analyst if you only need a first SOC role, or if the fee matters more than the timeline – you can add the four specialist classes later for £180, and you are never charged for the same class twice.
Do I need security experience to start?
No. The foundation begins at the beginning, exactly as the Analyst programme does – networking and cloud basics are taught in the first two classes. You need comfort using a computer, a willingness to learn and about 20 hours a week. The specialist block comes after 26 classes of groundwork, not before it.
I already hold the Blue Team Analyst certification. What do I pay?
£180 – four classes at the Specialist rate of £45. You do not repeat the first 26 classes and you are not charged for them again. You join the four specialist classes with the next group running them, and the Specialist badge criteria then apply in full, including both master assignments.
What are the two master assignments?
Master Assignment 1 is a multiple-choice check across the whole programme. Master Assignment 2 is a practical investigation in the lab, from first alert to root cause, written up as a findings report. Your tutor marks both, and both are needed for the badge, so everyone holding it has done the same assessed work.
