Curated by role · designed for cohorts
Don't pick courses.
Pick a role.
We build full learning paths for the four roles we see most. Each is a multi-month cohort with hands-on labs, mentor hours, and a final engagement-style assessment.
Path · SOC analyst
Junior analyst to confident first-responder, in 12 weeks.
Built with two CISA-trained leads. Live labs every Thursday, mentor hours on Tuesdays, and a final tabletop exercise scored by a senior operator.
$2,800
per seat · 5+ unlocks team pricing
WEEK 1–3
Module 01 · Foundations
Logs, network basics, alert triage. Lab: 200-event triage drill.
8 hrs lab
Triage runbook
WEEK 4–6
Module 02 · Detection engineering
Sigma + KQL + Splunk. Lab: building a detection from a real CVE.
Detection portfolio
Code review
WEEK 7–9
Module 03 · Incident response
IR playbooks, tabletop drills, comms drafting under pressure.
Live tabletop
Comms kit
WEEK 10–12
Module 04 · Cap-and-graduate
A 36-hour scored incident with mentor shadow. Cyb5r-SOC certification.
Scored incident
Certification
Upcoming cohorts
MAX 14 PER COHORT · SENIOR OPERATOR-LEDJun 03 · 2026
OPEN · 11 SEATS
Sep 09 · 2026
OPEN · 14 SEATS
Nov 04 · 2026
WAITLIST
Taught by people who still ship
Every instructor is an active operator.
Marta K.
Marta K.
Red team lead
ex-CISA · 12 yrs
Daniel O.
Daniel O.
AI assurance
ex-Anthropic · 8 yrs
Aiya R.
Aiya R.
Cloud + IR
ex-AWS sec · 10 yrs
Tom V.
Tom V.
Training lead
ex-SANS · 11 yrs
Lior B.
Lior B.
vCISO · advisory
ex-CISO finance · 14 yrs