Planned curriculum: sessions start when partners are confirmed. This is the curriculum we are designing. It will be adapted with each partner to suit their learners, and taught in person or online. There are no dates or places yet.
Track 01 · Planned
Inside a security operations centre
For learners curious about cyber security who want to see what the entry-level analyst’s job really involves.
Learners will be able to
- Explain what a security operations centre does and the roles in it
- Triage a sample alert and justify escalating it or closing it
- Investigate a reported phishing email safely
- Write a clear incident ticket and shift handover
What a security operations centre does
Who works there, how shifts and escalation work, and how an analyst’s day is spent. The difference between monitoring, investigation and response.
Logs, alerts and where they come from
What devices, accounts and applications record, how those records are collected in one place, and how a rule turns a pattern into an alert.
Triage
Deciding quickly whether an alert matters: what normal looks like, false positives, and the questions to ask before escalating.
Investigating a phishing report
A worked example from a reported email to a decision: checking the sender and links safely, finding who else received it, and what to do next.
How attackers work
Common techniques described in a shared vocabulary, using the MITRE ATT&CK knowledge base, so an alert can be placed in a bigger picture.
Incident response
The stages of handling an incident, from preparation to recovery and lessons learned, following NIST guidance, and the analyst’s part in each.
Writing it down
Tickets, shift handovers and incident notes that someone else can act on at three in the morning.
Track 02 · Planned
Service desk fundamentals
For learners who like solving problems for people, and want a first role in technology that leads to many others.
Learners will be able to
- Tell an incident from a request, a problem and a change
- Handle a ticket from first contact to closure
- Reset access safely after verifying identity
- Write a knowledge article a colleague can follow
How a service desk works
Incidents, service requests, problems and changes: what each one is, and why the difference matters. The shared language of IT service management.
The life of a ticket
Logging, categorizing, prioritizing, working and closing a ticket, and keeping the person informed all the way through.
Talking to people under pressure
Listening, asking the right questions, explaining without jargon, and writing replies that are kind and clear.
Troubleshooting
A repeatable method for faults with devices, accounts, email and networks: reproduce, isolate, fix, confirm.
Access requests and identity checks
Password resets and access requests done safely: verifying who is asking, and recognizing social engineering aimed at the help desk.
Knowledge and escalation
Writing knowledge articles others can follow, and knowing when and how to escalate.
Service levels and measures
What targets a service desk is held to, how they are measured, and how to work to them without cutting corners.
Track 03 · Planned
Compliance engineering basics
For learners who like structure, writing and detail, and want to work where technology meets regulation.
Learners will be able to
- Explain what a control is and what evidence shows it works
- Map a control across two frameworks
- Run and document a simple access review
- Prepare an evidence folder for an audit request
Why regulated technology is different
What banks, health systems and public agencies must be able to prove about their systems, and who asks: examiners, auditors and regulators.
Frameworks and how they relate
An overview of the NIST Cybersecurity Framework, ISO/IEC 27001, SOC 2, the HIPAA Security Rule and PCI DSS: what each is for and who uses it.
Controls and evidence
What a control is, how it is tested, and what counts as evidence that it works. Mapping one control across several frameworks.
Access reviews in practice
Running a user access review end to end: pulling the list, getting sign-off, removing access and keeping the record.
Change management
How changes to systems are requested, approved, tested and recorded, and what an auditor looks for.
Policies and procedures
The difference between a policy, a standard and a procedure, and how to write each so people can follow it.
Getting ready for an audit or exam
Requests lists, evidence folders, interviews and findings, and how a team prepares without panic.
How it will be taught
By practitioners, with partners.
- Who teaches
- People who staff Moraph’s security operations centres, service desks and compliance teams, alongside the partner’s own instructors.
- Where
- With workforce organizations and colleges near Moraph offices, in person or online, in the partner’s setting.
- Mentoring
- Moraph volunteers mentoring learners through a track and their first applications.
- Afterwards
- Learners are pointed to Moraph’s internships and open roles, which go through the same fair process as every other application. Pathways does not guarantee a job.
- Safeguarding
- Every session follows our safeguarding statement.
Run a workforce program?
Help us shape these tracks for your learners. Tell us about your organization and we will be in touch.