Cybersecurity Analyst Professional Programme

Give learners a strong understanding of computers, networks, operating systems, cybersecurity principles, threats, and security terminology.

Module 1: Introduction to Cybersecurity

• 1.1 what is cybersecurity, information security vs cybersecurity, the CIA Triad (confidentiality, integrity, availability), authentication, authorization, accountability, non-repudiation, security controls (physical, technical, administrative), cybersecurity career paths: Analyst, SOC Analyst, Security Engineer, Threat Intelligence Analyst, Incident Response Analyst, Vulnerability Analyst, Digital Forensics Analyst, Penetration Tester, Cloud Security Analyst, GRC Analyst

Module 2: Computer & Operating System Fundamentals

• 2.1 Windows: architecture, users and groups, file systems, processes, services, Event Viewer, Registry, PowerShell fundamentals, Linux: architecture, file system, users and permissions, processes, services, SSH, logs, Bash fundamentals

Module 3: Networking Fundamentals

• 3.1 network architecture, LAN/WAN, the OSI model, TCP/IP, IPv4, IPv6 introduction, MAC addresses, ARP, DNS, DHCP, HTTP/HTTPS, FTP, SSH, SMTP, TCP vs UDP, ports, firewalls, routers, switches, VPNs

Module 4: Cyber Threat Landscape

• 4.1 malware: viruses, worms, trojans, ransomware, spyware, phishing and social engineering, credential attacks, insider threats, botnets, denial-of-service attacks, web attacks, supply-chain threats

Module 5: Security Fundamentals

• 5.1 password security, MFA, access control, least privilege, secure configuration, patch management, backups, encryption, hashing, digital certificates, security policies

Capstone: Cybersecurity Home Lab

• 6.1 Learners build their own isolated cybersecurity laboratory (Windows VM, Linux VM, security testing VM, virtual network, basic firewall configuration) and deliver a network diagram, security configuration, user accounts, firewall rules, security checklist, and lab documentation.

Move from understanding cybersecurity to actually monitoring and analysing security events.

Module 1: Security Monitoring

• 1.1 security events and logs: event, authentication, network, application, and system logs, log collection, log analysis

Module 2: Identity & Access Security

• 2.1 authentication, authorization, MFA, RBAC, privileged accounts, account lifecycle, password policies, Active Directory and Group Policy fundamentals

Module 3: Network Security

• 3.1 firewalls, IDS/IPS, network segmentation, VPN, proxy, secure DNS, network monitoring

Module 4: Vulnerability Management

• 4.1 vulnerability vs threat vs risk, CVE, CVSS, vulnerability scanning, asset discovery, patch management, risk prioritisation, remediation, practical tools: Nmap, OpenVAS/Greenbone, Wireshark

Module 5: Cryptography

• 5.1 symmetric and asymmetric encryption, hashing, digital signatures, PKI, TLS/SSL, certificates

Module 6: Security Frameworks

• 6.1 NIST Cybersecurity Framework, CIS Controls, ISO 27001 concepts, MITRE ATT&CK, the Cyber Kill Chain

Capstone: Vulnerability Assessment & Security Hardening Project

• 7.1 Learners receive an intentionally vulnerable lab environment and must discover assets, identify and classify vulnerabilities, assess risk, recommend remediation, apply security hardening, re-test the environment, and produce a professional security report.

Teach learners how analysts identify, understand, investigate, and contextualise threats.

Module 1: Threat Intelligence

• 1.1 strategic, tactical, operational, and technical intelligence, indicators of compromise and indicators of attack, TTPs, threat actors, campaigns

Module 2: MITRE ATT&CK

• 2.1 tactics, techniques, sub-techniques, procedures, attack mapping, detection mapping

Module 3: Malware Analysis Fundamentals

• 3.1 malware lifecycle, static and dynamic analysis, file hashes, strings, metadata, PE files, sandbox and behavioural analysis (safe lab environments only)

Module 4: Network Traffic Analysis

• 4.1 using Wireshark for packet capture, TCP streams, DNS/HTTP/TLS traffic analysis, suspicious connections, beaconing, network anomalies

Module 5: Phishing Analysis

• 5.1 email headers, sender authentication (SPF, DKIM, DMARC), URLs and attachments, phishing indicators, business email compromise

Module 6: Threat Intelligence Platforms

• 6.1 STIX, TAXII, OpenCTI, MISP, open-source intelligence, threat feeds

Capstone: Threat Intelligence Investigation

• 7.1 Learners receive a simulated threat campaign and must analyse indicators, investigate domains/IPs/hashes, identify TTPs, map activity to MITRE ATT&CK, create an intelligence report and IOCs, develop detection recommendations, and produce a threat intelligence briefing.

This is the first major professional practical project month. Teach learners how a Security Operations Centre operates and how analysts investigate alerts.

Module 1: SOC Fundamentals

• 1.1 SOC structure and roles: Tier 1, Tier 2, Tier 3 analyst, SOC workflows: alert triage, escalation, case management, security metrics

Module 2: SIEM

• 2.1 SIEM concepts and platforms: Microsoft Sentinel, Splunk, Elastic Security, Wazuh, log ingestion, parsing, searching, dashboards, alerts, detection rules, correlation, investigations

Module 3: Detection Engineering

• 3.1 detection logic, rule creation, false positives, alert tuning, IOC and behavioural detection, MITRE ATT&CK mapping

Module 4: Security Alert Investigation

• 4.1 investigation scenarios: brute-force login, impossible travel, suspicious PowerShell, malware execution, privilege escalation, suspicious DNS activity, data exfiltration indicators

Capstone: SOC Monitoring & Security Operations Centre

• 5.1 Learners build a small SOC (endpoints, log collection, SIEM, detection rules, security alerts, analyst investigation, and incident response) and deliver SOC architecture, SIEM deployment, log sources, detection rules, an alert dashboard, incident tickets, investigation reports, MITRE ATT&CK mapping, and a SOC analyst report. Final scenario: detect, triage, investigate, classify, escalate, and document a series of simulated security alerts.

Teach learners how to investigate cybersecurity incidents and preserve evidence.

Module 1: Incident Response

• 1.1 the incident response lifecycle: preparation, detection, analysis, containment, eradication, recovery, lessons learned

Module 2: Incident Classification

• 2.1 security event vs security alert vs security incident vs major incident, severity classification, incident prioritisation

Module 3: Digital Forensics

• 3.1 digital evidence, evidence handling, chain of custody, disk imaging, file systems, memory analysis, timeline analysis, browser artefacts, event logs

Module 4: Forensic Tools

• 4.1 Autopsy, Volatility, FTK Imager, KAPE, Windows Event Viewer, Linux forensic utilities

Module 5: Malware Incident Investigation

• 5.1 initial compromise, persistence, execution, command and control, lateral movement, data collection, exfiltration

Capstone: Cybersecurity Incident Response Investigation

• 6.1 A company reports suspicious activity on several endpoints. Learners receive and triage the incident, identify affected systems, analyse logs, examine forensic artefacts, determine the attack timeline, identify IOCs, map activity to MITRE ATT&CK, contain the incident, recommend remediation, and produce a final incident report with an incident timeline, evidence register, IOC list, ATT&CK mapping, root-cause analysis, executive summary, and remediation plan.

Prepare learners to analyse security in modern cloud and enterprise environments.

Module 1: Cloud Fundamentals

• 1.1 cloud computing, IaaS, PaaS, SaaS, the shared responsibility model, cloud identity, storage, networking

Module 2: Cloud Security

• 2.1 introduction to Microsoft Azure security and AWS security concepts, cloud IAM, security groups, cloud logging and monitoring, cloud configuration security

Module 3: Identity Security

• 3.1 IAM, RBAC, privileged access, MFA, conditional access, service accounts, identity lifecycle, Zero Trust

Module 4: Endpoint Security

• 4.1 EDR, antivirus, endpoint monitoring, application control, device management, endpoint hardening

Module 5: Security Architecture

• 5.1 defence in depth, Zero Trust, network segmentation, secure architecture, security controls, risk-based security

Module 6: Security Automation

• 6.1 using Python and scripting for log processing, IOC extraction, automated enrichment, alert processing, report generation, API integration

Capstone: Enterprise Security Architecture & Automation

• 7.1 Learners design a secure environment for a fictional organisation covering employees, servers, endpoints, cloud resources, applications, databases, and remote workers, including network architecture, IAM, MFA, firewall, EDR, SIEM, vulnerability management, backup, incident response, and security monitoring, plus a Python security automation tool that collects, analyses, enriches, alerts, and reports.

This becomes the final graduation project, bringing the entire programme together into a realistic enterprise cyber-defence operation.

Module 1: Advanced Threat Hunting

• 1.1 threat hunting methodology, hypothesis-driven hunting, IOC, behavioural, endpoint, network, and identity hunting

Module 2: Advanced Detection

• 2.1 detection engineering, Sigma rules, YARA fundamentals, SIEM queries, correlation rules, detection validation

Module 3: Threat Intelligence Operations

• 3.1 intelligence requirements, collection, processing, analysis, dissemination, the intelligence lifecycle, STIX/TAXII, IOC management, threat reports

Module 4: Security Automation

• 4.1 Python-based IOC extraction, threat feed ingestion, API integration, log analysis, automated enrichment, alert generation, security reporting

Module 5: Security Governance

• 5.1 risk management, security policies, asset management, business continuity, disaster recovery, security awareness, compliance concepts

Capstone: Enterprise Cyber Defence & Threat Intelligence Platform

• 6.1 The programme's flagship project: learners create an integrated security operations environment for a fictional organisation: asset monitoring, SIEM, threat intelligence (import/enrich IOCs, track threats, map TTPs), threat hunting, incident response, Python-based security automation, and reporting (SOC, incident, threat intelligence, vulnerability, and executive security reports).