Turn a queue of alerts
into verdicts you can prove.

It is Monday morning at Greyfern Security Operations, and the queue has forty-one alerts in it. One of them is a sign-in from an unfamiliar country against a Tamarind Pay account, and the analyst on shift opens it, reads the log line by line, checks the runbook, and decides. That decision, made calmly and written down so the next person can follow it, is the work this course teaches. I am a Tier One analyst, and I am talking to one person: someone in West Africa, or a West African abroad, who wants a desk like this one and does not yet know how to earn it. Tier One is the first seat in a security operations centre. You watch the queue. You triage what arrives. You investigate inside the runbook, you escalate with the evidence attached, and you write the ticket someone else can act on without asking you a question. You do not attack anything. You do not configure the SIEM. You read, you decide, you record. Over ten weeks you will sit at a real SIEM inside Greyfern, a fictional managed SOC with two clients, Tamarind Pay in West Africa and Brasswick Manufacturing in Denver, and you will work the same queue you just watched. Every lesson maps to CompTIA Security+ SY0-701 objectives. Training and certification do not guarantee employment. What they give you is a shift you can already work. Let me give you the size of this thing, and I will name where every number comes from. The US Bureau of Labor Statistics, in its Occupational Outlook Handbook, puts the median pay for information security analysts at one hundred and twenty nine thousand, one hundred and eighty dollars a year. The same handbook counts about fourteen thousand, one hundred openings a year on average across the decade. That is the United States, and it is the figure people quote, so I want you to hear it properly: it is a median, it is one country, and it is not a starting salary for a Tier One seat. Now the demand closer to home. Before this track was built, a DataForSEO demand check found nine thousand nine hundred monthly searches in the United States for cyber security courses, and four thousand four hundred in West Africa. Those are searches, not jobs, and I will not dress them up as anything else. What they tell you is that a lot of people are looking for a way in, and the way in is a shift you can work. Training and certification do not guarantee employment. Nobody can promise you a job, an income, a placement or a visa, and I will not. What the numbers describe is a market with openings and a market with interest. What this course gives you is the skill those openings ask for, practised on a real SIEM until the queue feels ordinary. The job has three parts, and they run in a fixed order. First, triage: an alert lands in the queue, you open it, and you decide what it is. Second, investigation: you follow the runbook, pull the log lines that matter, and build the evidence chain. Third, escalation: if it is real, you write the ticket, attach what you found, and hand it to Tier Two. That is the whole seat. You are the first pair of eyes, and the value you add is a decision someone else can trust. Now the line, and I want you to hear it clearly. You never exploit anything. You do not run a payload, you do not test a credential, you do not touch the attacker's infrastructure. Defence and detection only. You also do not configure the SIEM, change a detection rule, or contain a host yourself. Containment is requested, never executed. When a client's telemetry is restricted, you work inside the access you have been given and no further. In the US lane, clients restrict telemetry access to US-resident, background-checked staff under rules such as CMMC, NIST SP 800-171 and SOC 2. In the West African lane, you train for banks, fintechs, telecoms and managed SOCs. The line is not a limitation on the job. It is the job. An analyst who stays inside it is trusted with more, and an analyst who crosses it is a liability on the shift. This course is for one kind of person, and I want to be honest about who that is. You are starting out, or you are changing careers, and you want to work a security operations shift. You do not need a degree. You do not need to have touched a SIEM before. You need to read carefully, decide calmly, and write down what you did so the next person can follow it. That is the whole entry requirement, and it is the whole job. You will choose a lane at enrolment. The West African lane trains you for banks, fintechs, telecoms and managed SOCs in the West African market. The US lane is for work-authorised residents, because US clients restrict telemetry access to US-resident, background-checked staff under rules such as CMMC, NIST SP 800-171 and SOC 2. Now who this is not for. If you want to break into systems, this is not your course. We are defence and detection only, and we never run an exploitation step. If you want to configure the SIEM, tune the rules and own the platform, that is a different seat and a different track. If you want a promise of a job at the end, I cannot give you one, and I will not pretend otherwise. Training and certification do not guarantee employment. What I can give you is ten weeks of shifts on a real SIEM, and a queue that stops feeling strange. The ten weeks run in four phases, and I will walk you through them in order. The first phase is eight weeks of lessons and quizzes. Each week opens with a set of short video lessons, about eleven minutes each, and every lesson maps to CompTIA Security+ SY0-701 objectives. You finish a week with a quiz and a written assignment, and you bring your questions to the live class. The live class is where we work through the week's alerts together, on the Greyfern desk. The second phase is the fictional workplace itself. From the first week you are inside Greyfern Security Operations, a managed SOC with two clients, Tamarind Pay in West Africa and Brasswick Manufacturing in Denver. You work the queue, you read the logs, you write the ticket. The third phase is the two-week practicu