For learners building practical security and security-operations skills.
Career and certification direction
Security operations and junior cybersecurity roles; requirements vary by employer.
This training develops skills; it does not guarantee employment or award a vendor certification. Ask Crossworld which current certification exams align with the programme, how exam preparation is provided and whether any exam fees are included.
Build practical security skills, from foundations to identity protection and security operations.
More than 50 lab exercises are listed in the published programme.
Who this course is for
For learners who want to develop practical security skills across security foundations, identity protection and security operations. The published entry requirements are basic computer knowledge and familiarity with Windows or Linux; prior security employment is not listed as a requirement.
What you will learn
Apply cybersecurity fundamentals, risk management and Zero Trust concepts to common security scenarios.
Strengthen identity and endpoint protections with Microsoft Entra, Intune and Microsoft Defender.
Investigate and correlate security events across identity, endpoint, email and cloud environments.
Use KQL, Microsoft Sentinel, threat hunting and automation to support security operations.
Apply data, application, Azure, multicloud and AI security practices, then communicate an architecture and incident-response approach.
Course curriculum: Corporate Cybersecurity Engineer Training Structure
The 46-class curriculum progresses through eight phases, from core security foundations to architecture, incident response and a capstone.
Phase 1: Cybersecurity Foundations
Classes 1 to 8
Students will build a strong understanding of:
Cybersecurity fundamentals
Cybersecurity careers
Risk management
Zero Trust
Networking
Windows and Linux security
Cyberattacks
Vulnerability management
Cryptography
Active Directory
Phase 2: Microsoft Entra Identity Security
Classes 9 to 14
Students will learn how to:
Manage users, groups and roles
Configure multifactor authentication
Introduce passwordless authentication
Create Conditional Access policies
Use Microsoft Entra Identity Protection
Manage privileged access
Perform access reviews
Understand hybrid identity
Secure applications and workload identities
Phase 3: Microsoft Intune and Endpoint Security
Classes 15 to 20
Students will learn how to:
Enrol and manage devices
Configure device compliance
Apply Windows security baselines
Use Microsoft Autopilot
Manage Windows updates
Protect mobile applications
Deploy Microsoft Defender for Endpoint
Investigate and respond to endpoint incidents
Phase 4: Microsoft Defender XDR
Classes 21 to 26
Students will learn how to:
Investigate incidents in Microsoft Defender XDR
Correlate alerts across identities, devices and email
Use Advanced Hunting
Write Kusto Query Language queries
Investigate identity threats
Investigate phishing and email attacks
Govern cloud applications
Use threat intelligence
Review external attack-surface exposure
Phase 5: Azure and Multicloud Security
Classes 27 to 30
Students will learn how to:
Secure Azure subscriptions and resources
Apply Azure role-based access control
Use Azure Policy
Configure Microsoft Defender for Cloud
Secure Azure networks
Protect servers, storage, containers and databases
Understand hybrid and multicloud security
Phase 6: Microsoft Sentinel SIEM and SOAR
Classes 31 to 38
Students will learn how to:
Deploy Microsoft Sentinel
Connect security data sources
Configure Azure Monitor Agent
Create Data Collection Rules
Write KQL queries
Build analytics rules
Investigate incidents
Perform threat hunting
Use watchlists and threat intelligence
Create automation rules
Build Logic Apps playbooks
Develop workbooks and dashboards
Manage detections through version control
Phase 7: Data Security, Application Security and AI
Classes 39 to 42
Students will learn how to:
Use Microsoft Purview
Create sensitivity labels
Configure Data Loss Prevention
Investigate insider-risk scenarios
Use Microsoft Audit and eDiscovery
Understand application and API security
Introduce DevSecOps practices
Use GitHub security tools
Use Microsoft Security Copilot responsibly
Understand the security risks associated with AI
Phase 8: Architecture, Incident Response and Capstone
Classes 43 to 46
Students will learn how to:
Design a Zero Trust architecture
Create a professional security design
Manage a cybersecurity incident
Understand digital evidence
Respond to ransomware
Work as part of a SOC team
Present findings to management
Prepare for certifications and interviews
Microsoft lab environment
The practical environment will include the following Microsoft security, cloud, endpoint and collaboration tools:
Microsoft Entra training tenant
Microsoft 365 security tenant
Azure subscription
Microsoft Defender portal
Microsoft Defender XDR
Microsoft Sentinel
Log Analytics workspace
Microsoft Intune
Microsoft Defender for Endpoint
Microsoft Defender for Identity
Microsoft Defender for Office 365
Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud
Microsoft Purview
Microsoft Security Copilot
Windows 11 virtual machines
Windows Server domain controller
Linux virtual machine
Azure Virtual Network
Microsoft Teams
SharePoint
GitHub training repositories
Entry requirements
Basic computer knowledge, familiarity with Windows or Linux and an interest in security. A computer, reliable internet and access to Azure lab services are recommended.
Learning support
Tutors, mentors and recruitment consultants support your studies and career preparation. Ask the course team about the current teaching schedule, lab access and any assessment or certification arrangements before you enroll.
Questions before you apply?
Ask about prerequisites, lab access or course availability with a short enquiry. You can complete full registration when you are ready for an available intake.
Book a free consultation