Cyber Security — Program 02
Blue Team — Beginner to Advanced
A SOC hires juniors by design, because it runs shifts — which is why entry-level defensive jobs exist in a way that entry-level offensive jobs do not. Sixteen weeks on log sources, SIEM, detection engineering, hunting and forensics, ending in an intrusion you have to find, investigate and explain.
( Who it is for )
You need
- Foundations, or pass its entry test. You need networking, Linux, Windows and one scripting language.
It prepares you for
- SOC Analyst (Tier 1 → Tier 2), Security Analyst, Incident Responder
- CompTIA CySA+
- Microsoft SC-200
- Blue Team Level 1
( Curriculum — 16 weeks )
How a SOC works
The job before the tooling: queues, escalation, and getting data in.
- Tiers, shifts, SLAs and escalation
- Working a live alert queue
- Windows, Linux and network log sources
- Sysmon, tuned properly
- Splunk: ingest, search, alert
- Elastic and Wazuh, and when each is used
Detection engineering
Writing the rules, then proving they fire — and that they do not fire on everything.
- Mapping to MITRE ATT&CK
- Sigma rules and detection as code
- Validating with Atomic Red Team
- Tuning out false positives
- EDR and endpoint telemetry
- Network detection: Zeek and Suricata
Investigate
What to do once an alert turns out to be real.
- Phishing and malware triage
- Sandboxing and IOC extraction
- Threat intelligence that changes detections
- Hypothesis-driven threat hunting
- Disk forensics and timelines
- The artefacts that survive an attacker
Advanced and capstone
Memory, cloud, automation — and an incident nobody warned you about.
- Memory forensics and live response
- Ransomware: the first hour
- Cloud and identity detection
- SOAR and automation with Python
- Purple team with the Red Team cohort
- Capstone incident and debrief
The capstone.
A multi-stage intrusion is run against the class environment over 48 hours, without warning. You detect it, investigate it, contain it, write the incident report and defend it in a debrief. Reconstructing what you missed, honestly, scores higher than a lucky catch you cannot evidence.
You finish with: A detection repository under version control, mapped to ATT&CK · Twelve weeks of investigation write-ups · A full incident report and a recorded debrief · A home SOC you can demonstrate in an interview.
Next batch enrolling
Enroll ↗