From £3,250 + VAT
To book this course, call us on 0113 382 6296 or get in touch via the form.
Overview
ISACA’s Certified Cybersecurity Operations Analyst (CCOA™) certification equips learners with the technical skills to evaluate threats, identify vulnerabilities, and design countermeasures to protect digital ecosystems. As emerging technologies such as AI-enabled automation continue to evolve, the demand for skilled cyber analysts is critical to safeguarding organisations.
This practical hands-on training develops the analytical and investigative expertise required to detect, respond to, and mitigate cybersecurity incidents. Learners will explore technology essentials, adversarial tactics and procedures, incident detection and response, and asset security through practical scenarios and applied learning. By building the ability to identify patterns, anomalies, and indicators of compromise, participants will strengthen their role as a vital component of their organisation’s cybersecurity defence.
Prerequisites
The CCOA certification is recommended for cybersecurity professionals with 2–3 years of practical experience who wish to expand their technical capabilities and respond more effectively to evolving cyber threats. A useful pre-requisite for this course is the OffSec SEC-100 Security Essentials.
Target audience
This course is designed for:
- Cybersecurity analysts and operations professionals
- SOC analysts and incident responders
- IT and network administrators seeking to build security expertise
- Professionals responsible for cybersecurity governance, compliance, and risk management
- Early to mid-career practitioners aiming to enhance technical and operational skills
Learning Objectives
By the end of this course, learners will be able to:
- Identify the key components of computer and cloud networking, databases, and virtualised environments
- Understand cybersecurity governance and align security strategy with enterprise objectives
- Analyse adversarial tactics, techniques, and procedures to detect and respond to threats effectively
- Apply incident detection and response techniques, including forensic and malware analysis
- Recognise the significance of proactive incident preparedness and planning
- Design and recommend countermeasures to secure digital assets across industries
- Implement identity, access, and vulnerability management practices
- Apply best practices, frameworks, and standards to strengthen cybersecurity operations
Course Outline
Domain 1: Technology essentials
- Computer and cloud networking fundamentals
- Databases, virtualisation, and containerisation
- Command line interfaces
- APIs: purpose, benefits, and usage
- Principles of DevOps, SecDevOps, and CI/CD pipelines
- Fundamentals of programming and scripting
Domain 2: Cybersecurity principles
- Cybersecurity governance and alignment with business drivers
- Defining strategy based on enterprise objectives
- Cross-organisational communication for cybersecurity
- Roles and responsibilities for initiatives
- Metrics for evaluating programme performance
- Stakeholder engagement and investment planning
- Risk management processes and compliance requirements
- Documenting risk in enterprise operations
Domain 3: Adversarial tactics, techniques, and procedures (TTPs)
- Common adversarial tactics, techniques, and procedures
- Developing critical and creative thinking for threat detection
- Differentiating dashboard events vs attacker insights
- Baseline detections for anomalous behaviours
- Reactive and proactive threat detection capabilities
- Threat hunting and intelligence source utilisation
- Attack vectors, threat actors, and motivations
- Analysis of exploit techniques and attack stages
- Role of security testing in detection and resilience
Domain 4: Incident detection and response
- Incident preparedness and significance of early detection
- Components and techniques of detection (analytics, logs, alerts)
- Developing detection use cases and recognising indicators of compromise
- Tools and technologies for effective monitoring
- Fundamentals of incident response: containment and handling
- Forensic, malware, network traffic, and packet analysis techniques
- Threat analysis and structured response processes
Domain 5: Securing assets
- Designing countermeasures for digital asset protection
- Iterative and holistic approaches to system security
- Industry-specific asset protection needs and risk tolerance
- Influence of business goals and risk assessments on security controls
- Contingency planning and business continuity
- Control techniques for securing assets
- Identity and access management principles and practices
- Best practices, frameworks, and standards for asset security
- Vulnerability assessment, remediation, and risk mitigation
Exams and assessments
The CCOA certification exam voucher is included in this course, taken post course directly with ISACA, validates knowledge and applied skills across all domains. Successful learners receive the Certified Cybersecurity Operations Analyst (CCOA™) credential.
Hands-on learning
This course includes:
- Scenario-driven labs to apply incident detection and response techniques
- Practical exercises in network, forensic, and malware analysis
- Threat modelling and intelligence activities
- Applied learning focused on asset security and vulnerability management
- Guided practice using common security tools and monitoring platforms
QA is proud to be an official ISACA partner.
Cyber Security learning paths
Want to boost your career in cyber security? Click on the roles below to see QA's learning pathways, specially designed to give you the skills to succeed.
Cyber Defensive Operations learning paths
Want to boost your career in Cyber Defensive Operations? View QA's learning pathways below, specially designed to give you the skills to succeed.
Frequently asked questions
How can I create an account on myQA.com?
There are a number of ways to create an account. If you are a self-funder, simply select the "Create account" option on the login page.
If you have been booked onto a course by your company, you will receive a confirmation email. From this email, select "Sign into myQA" and you will be taken to the "Create account" page. Complete all of the details and select "Create account".
If you have the booking number you can also go here and select the "I have a booking number" option. Enter the booking reference and your surname. If the details match, you will be taken to the "Create account" page from where you can enter your details and confirm your account.
Find more answers to frequently asked questions in our FAQs: Bookings & Cancellations page.
How do QA’s virtual classroom courses work?
Our virtual classroom courses allow you to access award-winning classroom training, without leaving your home or office. Our learning professionals are specially trained on how to interact with remote attendees and our remote labs ensure all participants can take part in hands-on exercises wherever they are.
We use the WebEx video conferencing platform by Cisco. Before you book, check that you meet the WebEx system requirements and run a test meeting to ensure the software is compatible with your firewall settings. If it doesn’t work, try adjusting your settings or contact your IT department about permitting the website.
How do QA’s online courses work?
QA online courses, also commonly known as distance learning courses or elearning courses, take the form of interactive software designed for individual learning, but you will also have access to full support from our subject-matter experts for the duration of your course.
Once you have purchased the Online course and have completed your registration, you will receive the necessary details to enable you to immediately access it through our e-learning platform and you can start to learn straight away, from any compatible device. Access to the online learning platform is valid for one year from the booking date.
All courses are built around case studies and presented in an engaging format, which includes storytelling elements, video, audio and humour. Every case study is supported by sample documents and a collection of Knowledge Nuggets that provide more in-depth detail on the wider processes.
When will I receive my joining instructions?
Joining instructions for QA courses are sent two weeks prior to the course start date, or immediately if the booking is confirmed within this timeframe. For course bookings made via QA but delivered by a third-party supplier, joining instructions are sent to attendees prior to the training course, but timescales vary depending on each supplier’s terms. Read more FAQs.
When will I receive my certificate?
Certificates of Achievement are issued at the end the course, either as a hard copy or via email. Read more here.
Let's talk
A member of the team will contact you within 4 working hours after submitting the form.