Cybersecurity
Job Ready Program
Already working in IT? Build practical skills in threat detection, security investigations and incident response through hands-on labs and a realistic SOC simulation.
- 12 weeks · 16 modules
- 105 contact hours
- Onsite + online learning
- Week 1: free onsite trial
Is this program for you?
If you already work in IT and want to build your path into cybersecurity, this program is designed for you.
01
IT support professionals
You already solve IT problems. Build the investigation skills to understand security alerts and respond with confidence.
02
Systems administrators
Turn your experience with Windows, identity and cloud systems into practical defensive security skills.
03
Network professionals
Build on your understanding of networks with traffic analysis, vulnerability assessment and network defence.
04
IT professionals changing direction
You have an IT foundation and want a structured path into security operations, threat hunting and incident response.
Your 12 weeks,mapped out
Move from collecting evidence to making response decisions. Each stage builds towards a complete security investigation.
-
Weeks 1–2
Investigate systems. Identify exposure.
Use Linux logs and system activity to find evidence, then scan lab systems and prioritise vulnerabilities.
-
Weeks 3–4
Read the traffic. Strengthen the defences.
Investigate packet captures, recognise suspicious network activity and practise firewall and IDS/IPS controls.
-
Weeks 5–6
Protect identities and email.
Explore Windows and Active Directory security, cloud access controls, phishing and mailbox investigations.
-
Weeks 7–8
Work the SOC investigation.
Build a Sentinel environment, use KQL, map behaviour to MITRE ATT&CK and prepare clear incident notes.
-
Weeks 9–10
Respond, hunt and automate.
Investigate endpoint and data-loss alerts. Develop threat hunts, playbooks and automated analyst workflows.
-
Weeks 11–12
Assess risk. Bring the evidence together.
Connect controls to compliance frameworks, then complete an end-to-end SOC simulation and technical presentation.
What you'll learn
Sixteen modules. Twelve weeks of practical security training. Explore the full curriculum, the tools you will use and a proposed security lab for each module.
Module 1 of 16
Linux Fundamentals for Cybersecurity Analysts
- Investigate Linux systems using the command line, file permissions and ownership
- Identify suspicious users, processes, services and network connections
- Triage security events by searching and correlating Linux logs
- Access and administer Linux hosts remotely the way an analyst does on shift
- Navigation
- grep
- processes
- services
- chmod/chown
- SSH / remote Linux access
- Security lab: Investigate a simulated Linux security event using system activity, permissions and log evidence.
Module 02 of 16
Network Scanning & Vulnerability Assessment
- Discover hosts, ports, services and attack surface with professional reconnaissance techniques
- Identify vulnerabilities using Nmap, Nessus and OpenVAS
- Validate findings, remove false positives and prioritise remediation by real business risk
- Nmap (CLI)
- Nessus Essentials
- OpenVAS / Greenbone
- Metasploitable
- Security lab: Scan a deliberately vulnerable lab host, validate findings and produce a prioritised remediation summary.
Module 03 of 16
Network Traffic Analysis & PCAP Investigation
- Analyse packet captures to reconstruct suspicious network activity
- Use Wireshark and tcpdump to investigate live and historical traffic
- Detect scanning, command-and-control beaconing, DNS abuse and data exfiltration
- Wireshark
- tcpdump
- Security lab: Reconstruct suspicious activity from a training packet capture and document the supporting network evidence.
Module 04 of 16
Firewalls, IDS/IPS & Network Defense
- Configure firewall rules, NAT and segmentation to control attack paths
- Deploy Suricata IDS/IPS and investigate real network alerts
- Read web server and WAF logs to spot exploitation attempts and web shells
- pfSense
- Suricata
- web-attack log reading
- Security lab: Configure lab firewall rules and investigate a simulated Suricata alert alongside web-server logs.
Module 05 of 16
Windows & Active Directory Security
- Understand how attackers abuse Active Directory, Kerberos, NTLM and privileged identities
- Map identity attack paths using SharpHound, BloodHound and PingCastle
- Detect and investigate password spraying, Kerberoasting and suspicious authentication activity
- Deploy Sysmon and audit policy to improve Windows attack visibility
- PingCastle
- SharpHound/BloodHound
- SharpHound/BloodHound
- Group Policy audit policy
- Windows event logs
- Security lab: Investigate simulated identity abuse and identify improvements to Windows and Active Directory visibility.
Module 06 of 16
Cloud IAM Security
- Secure cloud identities using MFA, SSO, Conditional Access and passwordless authentication
- Apply least privilege using Entra roles, Azure RBAC and privileged access controls
- Configure and investigate PIM, risky sign-ins, Identity Protection and suspicious authentication
- Control access using device compliance, location, authentication strength and session policies
- Entra ID
- Conditional Access
- PIM
- MFA
- legacy auth
- Intune
- Defender for Office 365
- Attack Simulation Training
- SPF/DKIM/DMARC
- Security lab: Investigate a simulated phishing or cloud-identity incident and explain the controls that reduce the risk.
Module 07 of 16
Email Security, Phishing & DLP
- Analyse email headers, SPF, DKIM, DMARC and sender infrastructure to identify phishing
- Investigate malicious links, attachments, BEC, mailbox rules and account compromise
- Detect and respond to email threats using message trace and security investigation workflows
- Protect sensitive information using DLP policies, sensitivity controls and data-exfiltration monitoring
- Microsoft Sentinel workspace
- data connectors
- incident queue
- Security lab: Onboard lab security logs into Microsoft Sentinel and triage a simulated incident queue.
Module 08 of 16
SOC Operations & SIEM Setup
- Understand how a SOC detects, triages, escalates and responds to security incidents
- Build a SIEM environment and onboard endpoint, server, identity, network and cloud logs
- Turn raw security events into actionable alerts and incidents for analyst investigation
- Work an incident queue and hand over investigations clearly between shifts
- Microsoft Sentinel
- Log Analytics
- data connectors
- analytics rules
- incident queue
- Loan Default Prediction & Risk Analytics: An end-to-end ETL and analytics build from SQL Server to Snowflake to Power BI, with AI-assisted SQL, DAX and reporting.
Module 09 of 16
KQL, Detection Rules & Incident Response
- Use KQL to investigate authentication, endpoint, identity and network security events
- Build high-value detection rules and tune noisy alerts to reduce false positives
- Triage incidents, establish scope and impact, and document investigation findings
- Apply practical containment, escalation and incident-response decision making
- Microsoft Sentinel
- KQL
- Analytics Rules
- Workbooks
- incident investigation
- Job Application Kit: Build your data analytics resume and LinkedIn profile, tailor them to real job ads and complete mock interviews with feedback.
Module 10 of 16
EDR/XDR & Endpoint Protection
- Investigate endpoint alerts using process trees, timelines, telemetry and threat context
- Correlate endpoint, identity and email signals to uncover multi-stage attacker activity
- Hunt across endpoint telemetry and validate suspicious processes, persistence and lateral movement
- Contain compromised devices and perform practical endpoint response and remediation
- Microsoft Defender for Endpoint
- Microsoft Defender XDR
- Advanced Hunting
- Live Response
- Career Plan & Mentoring: Set your career roadmap with mentors, track progress and get support until you land your first data role.
Module 11 of 16
Threat Hunting & MITRE ATT&CK
- Build hypothesis-driven hunts from suspicious behaviours, intelligence and detection gaps
- Hunt across SIEM and XDR telemetry for attacker techniques that may not trigger alerts
- Map findings to MITRE ATT&CK tactics and techniques and identify coverage gaps
- Convert successful hunts into repeatable detection opportunities and investigation procedures
- Microsoft Sentinel
- Defender XDR Advanced Hunting
- MITRE ATT&CK Navigator
- KQL
- Analytics Portfolio: Package your projects into GitHub-ready case studies with dashboards, documentation and a presentation for interviews.
Module 12 of 16
Security Automation, SOAR & Playbooks
- Design repeatable analyst playbooks for common security incidents and escalation scenarios
- Automate enrichment, notification, ticketing and response actions using SOAR workflows
- Use automation rules to reduce repetitive analyst work while keeping human approval where required
- Test, troubleshoot and document automated response workflows safely
- Microsoft Sentinel Automation Rules
- Logic Apps
- Playbooks
- incident workflows
- Analytics Portfolio: Package your projects into GitHub-ready case studies with dashboards, documentation and a presentation for interviews.
Module 13 of 16
Web Server & Web Application Security
- Identify and reduce web server exposure through secure configuration and hardening
- Recognise OWASP Top 10 attack patterns and indicators of compromise
- Investigate web, WAF and server logs to detect exploitation, web shells and post-exploitation activity
- Burp Suite Community
- OWASP Juice Shop
- web server logs
- WAF logs
- Analytics Portfolio: Package your projects into GitHub-ready case studies with dashboards, documentation and a presentation for interviews.
Module 14 of 16
ASD Essential Eight, Governance & Compliance Frameworks
- Assess an organisation against the ASD Essential Eight maturity model
- Collect evidence, identify control gaps and produce actionable remediation findings
- Connect technical security controls to NIST CSF, ISO 27001, ISM and Australian compliance expectations
- ASD Essential Eight
- NIST CSF
- ISO 27001
- security baseline evidence
- ISM
- Analytics Portfolio: Package your projects into GitHub-ready case studies with dashboards, documentation and a presentation for interviews.
Module 15 of 16
Cybersecurity Risk Assessment, Reporting & Change Management
- Identify, score and prioritise cybersecurity risks using a practical risk register
- Translate technical findings into clear executive and client-ready security reports
- Apply change control, approval, testing and rollback planning to reduce operational security risk
- Risk register
- reporting templates
- change records
- remediation tracking
- Analytics Portfolio: Package your projects into GitHub-ready case studies with dashboards, documentation and a presentation for interviews.
Module 16 of 16
Capstone: End-to-End SOC Simulation & Career Launch
- Respond to a realistic multi-stage attack across identity, endpoint, email and network telemetry
- Detect, triage, investigate, contain and document the incident under analyst-style time pressure
- Produce an investigation report, remediation plan and executive-ready incident summary
- Defend investigation findings in a technical presentation and job-style interview scenario
- Microsoft Sentinel
- Defender XDR
- investigation notes
- incident report
- MITRE ATT&CK
- Analytics Portfolio: Package your projects into GitHub-ready case studies with dashboards, documentation and a presentation for interviews.
Why This Program
Built for beginners. Designed for real careers.
Beginner Friendly
No coding background needed
Build Real Projects
Ship 5 production-ready apps
Job-Ready Skills
In-demand stack. Real outcomes
Career Support
Resume, interview & placement help
Start Your Career in Cybersecurity
From 28th October
Wed & Thu 6:30 – 9:30 PM (SYD Time)
They started exactly where you are
500+ graduates, now working in IT.
I had a great experience with TechSkills. The trainers were knowledgeable, supportive, and focused on practical, real-world skills. Even though I completed the JRP over a year ago, the team still continues to support and encourage me to this day, which truly shows how much they care about their students' success.
500+
Graduates placed into help desk, IT support, network, cybersecurity and accounting roles across Australia.
Questions people ask before enrolling
Who is this program designed for?
The entry point is IT professionals. It is suited to people with an IT foundation, including support, systems and networking experience, who want to build practical cybersecurity skills. Discuss your background with a career counsellor before enrolling.
How long is the program, and how are classes delivered?
The program runs for 12 weeks with 105 contact hours. Week 1 is a six-hour onsite trial class. Weeks 2–12 each include six hours onsite and three hours online. Our team will confirm the campus, class days and exact times for your intake.
What happens in the free trial class?
Week 1 covers Linux Fundamentals for Cybersecurity Analysts. You explore the command line, file permissions, users, processes, services, network connections and log investigation during the six-hour onsite trial class.
Which security tools will I work with?
The curriculum includes Nmap, Nessus Essentials, OpenVAS/Greenbone, Wireshark, tcpdump, pfSense, Suricata, BloodHound, Sysmon and the Microsoft security stack. You also work with Entra ID, Microsoft Sentinel, KQL, Defender for Endpoint, Purview DLP and Logic Apps. Ask the team about lab access and any account or licence requirements.
What practical investigations will I complete?
Your modules cover Linux events, vulnerability findings, network traffic, identity abuse, phishing, SOC incidents, endpoint alerts, data-loss prevention and threat hunting. Week 12 brings these skills together in an end-to-end SOC simulation across identity, endpoint, email and network telemetry.
How does the program support career preparation?
Job applications begin in Week 8. The final capstone includes a technical presentation and a job-style interview scenario where you explain your evidence, investigation and response decisions. Speak with the career team about any additional application support included in your intake.
What cybersecurity roles could I work towards?
The curriculum targets Junior Cybersecurity Analyst, SOC Analyst, Security Operations Analyst, Microsoft Security Operations Analyst and MSP/MSSP Security Analyst pathways. SOC Level 1 or Level 2 suitability depends on your existing experience and demonstrated skills. Completing the program does not guarantee employment.
What if I miss an onsite or online class?
Contact the mentor or career team as early as possible. Confirm attendance requirements, lab access and the catch-up options available for your selected intake before enrolling.
12 weeks from now, you could be investigating a simulated security incident.
Follow the evidence, assess the impact and explain your response. Bring your IT experience into practical security investigations.
Speak with a career counsellor about the next intake, class options and your pathway into cybersecurity.
Book a one-to-one career session
Discuss your goals, the program and your next step. No obligation.
We never share your details.
