CYBERSQUAD AkademieAZAV-approved training provider

Planned start: 4 January 2027

Into IT security in nine months.

Live lessons with an instructor, every weekday, from home. No IT experience needed. With an approved Bildungsgutschein, it costs you nothing.

The course is called AI-Driven Security Operations Specialist.AZAV-approved — your Jobcenter or Agentur für Arbeit is allowed to pay for it.

Prefer to call: +49 211 81994488 · or use WhatsApp: write or send a voice message. Marsí, our AI, answers around the clock.

Free funding check

Question 1Takes about two minutes

Will the Jobcenter or Agentur für Arbeit pay for your training?

A few short questions, then your result and your documents for the office.

Your money keeps coming. If your training is funded through a Bildungsgutschein, the Agentur für Arbeit or Jobcenter keeps paying your Arbeitslosengeld (unemployment benefit) or Grundsicherung (basic income support). We only need your contact details at the end.

9months full-time

1,400teaching units (UE)

3certificates after passing the exams

0 €with an approved Bildungsgutschein

How you learn with us

Hands-on at the screen from day one

Your instructor explains the basics, and the German videos from simpleclub help. Then you practise yourself at the computer: in the TryHackMe practice system and in the SOC‑Simulator.

Videos only load when you click, and your IP address goes to US providers (Vimeo, Webflow). More: privacy policy.

The German explainer videos from simpleclub help you with the basics. The animation shows what the app looks like: here a network in which an attack is switched on and off.

The SEC0, SEC1 and SAL1 exams are run by TryHackMe, not by us. We cannot promise that you will pass.

Illustrative photo: woman with a headset on the phone

Your personal contact

We'll walk this path together.

A dedicated contact person calls you and goes through every step with you.

A dedicated person who knows your situation
A reminder before your appointment at the office
Help with documents and questions

After the funding check, we'll call you.

Start the funding check

Monday to Saturday, 9 am to 7 pm, until the course starts. You can opt out of the calls at any time.

The office decides whether you get an education voucher (Bildungsgutschein).

Before you read on

Four questions almost everyone asks us first

“I don’t have a German passport.”

Funding depends on having access to the German labour market — not on which passport you hold. Even a time-limited residence permit (Aufenthaltstitel) does not exclude you.

“My qualification isn’t recognised here.”

For this job you need no formal recognition. IT jobs are not regulated professions in Germany.

“Is my German good enough?”

You need to be able to follow the lessons. We do not require a particular level — if in doubt, talk to us before you decide it’s not for you.

The most common question on the phone

“What do I live on during these nine months?”

Your Arbeitslosengeld keeps coming. You no longer count as a jobseeker, but as taking part in a training programme (Maßnahme). Two days of benefit only use up one day of your entitlement (§ 148 SGB III), and at least 90 days remain at the end. Grundsicherung continues unchanged.

All answers in detail →

The path — four steps

How to get your Bildungsgutschein

From your click to the decision letter, it usually takes two to six weeks. Each step tells you what you do and what we do for you.

Man checking on a laptop whether funding is possible

You do a quick check

A short funding check on this page. You find out straight away whether funding is possible for you — no registration, no name and no phone call.

You · on your own · anonymous 2 minutes

We write your documents

Your papers for the office are in your own personal area, ready to print: approval number, costs and the written reasons. Plus interview practice for your appointment.

We · no password needed Usually within a few minutes

You go to your appointment

You present the papers in the meeting: at the Agentur für Arbeit or, if you receive Grundsicherung (basic income support), first at the Jobcenter. The three sentences you can say are included. You make the application yourself.

You · we get you ready One appointment

Man at a laptop after the training course has started

When the Bildungsgutschein arrives

You upload it in your area and send us the provider’s copy by post. Then we register you.

We · then we register you Then the course starts

Laptop showing a video call with several people in a grid

Planned start: 4 January 2027

AI-Driven Security Operations Specialist

This is the name of the programme as the training objective (Bildungsziel) on your Bildungsgutschein — with no additions. The job behind it: Junior SOC Analyst. AZAV-approved until 19 July 2029.

Duration 9 months, full-time Location virtual classroom Group fixed group Lessons Mon–Fri, live

Junior SOC Analyst — that’s the person who is the first to notice an attack on a company. You learn to spot it before any damage is done, on the same systems that real security teams use. Every weekday with an instructor, in a fixed group. No IT experience needed.

0 €for you, with an approved Bildungsgutschein

Check which rule applies to you

Start 4 January 2027 (planned)
Equipment laptop and headset
Approval AZAV · Kiwa

The curriculum

9 months in 6 phases

Full-time, Monday to Friday — including 4 weeks of holiday. Tap a phase to see what happens in it.

2 weeks holiday 2 weeks holiday

SEC0Week 14

SEC1Week 23

SAL1Week 30

Certificate from the AcademyWeek 39

Start · Week 1

IT basics and digital work Weeks 1–7 · 280 teaching units›

Person concentrating on work at a laptop

Hardware, Windows, Linux, files and permissions — plus first steps in Python. We start from zero.

simpleclub Live instructor

Networks and security basics Weeks 8–14 · 280 teaching units · ends with SEC0›

TCP/IP, routing, firewalls: how data travels through the internet and where an attacker looks for a way in.

simpleclub 🎖 SEC0 exam

Cyber Security 101 Weeks 17–23 · 280 teaching units · ends with SEC1›

The ten most common web vulnerabilities, understanding malware, reading log files, first steps with a SIEM.

TryHackMe 🎖 SEC1 exam

SOC Analyst Training Weeks 24–30 · 280 teaching units · ends with SAL1›

Assess alerts, separate real attacks from false alarms, document an incident properly. Every day in the simulator.

SOC‑Simulator 🎖 SAL1 exam

AI in everyday work, data protection, IT service Weeks 33–36 · 160 teaching units›

The AI tutor answers a learner's question

How you really use AI tools in a security team — and where the limits are. Plus the GDPR.

AI‑Tutor Live instructor

Job applications and starting your career Weeks 37–39 · 120 teaching units›

CV, LinkedIn profile, your portfolio — and practice interviews, one with HR, one with a technical expert.

Live instructor Practice interviews

Person wearing a headset at a workstation in a security team

What you'll hold in your hands at the end

SEC0 · Pre-SecurityVerifiable via CredlyWeek 14

SEC1 · Cyber Security 101Verifiable via CredlyWeek 23

SAL1 · Security Analyst L1the most important of the threeWeek 30

📜 Academy certificatefrom us, with our approval numberWeek 39

The three exams are run by TryHackMe, not by us — each one can be verified via Credly. The final certificate comes from us, with our approval number; it is the provider’s own certificate, not a qualification in a recognised training occupation such as those awarded by the IHK (chamber of industry and commerce) or the Handwerkskammer (chamber of skilled crafts). For your Jobcenter or Agentur für Arbeit: 1,400 teaching units, full-time, Monday to Friday from 9:00 to 16:40.

From Phase 4

Then you work in the security team

An alert comes in. You decide: real attack or false alarm? You see everything — sender, subject, history and the suspicious link. And the clock is running.

Scenarios based on real attack patterns — sorted by MITRE ATT&CK
The course content is in German — technical terms stay in English, your instructor explains them
You work in a squad — a fixed group, joint review, every day

tryhackme.com · SOC‑Simulator

Tour of the SOC simulator: choose a scenario, handle an alert, open the analysis machine

Tour in progress · 9 seconds

After the nine months

What your CV can look like after nine months

Five invented examples of people from completely different careers. This is how it can look when knowledge, certificates and portfolio come together. The CVs are in German, which is how people apply in Germany. The job titles appear exactly as they do in German job ads.

Matching jobs

Common titles you can search for:

(Junior) SOC Analyst (m/w/d)
Junior Security Analyst
Junior Cyber Security Analyst
IT Security Analyst
Security Operations Analyst
Incident Response Analyst (Junior)

Example with an invented personOpen as PDF

Portfolio projects on GitHub

Built, not just “Python skills”.

alert-triageSorts alerts by urgency
brute-force-watchDetects series of failed logins in log files
shift-handoverBuilds the handover to the next shift

Cases from the SOC simulator

Seven weeks of shifts, realistic alerts.

3 a.m., 14 forwarding rulesAccount taken over, escalated cleanly
True Positive
The maintenance job at 3:41No person behind it, still passed on
False alarm checked
The printer driverMalware, machine isolated
True PositivePlaybook

And then? In the last three weeks we build your application with you: CV, LinkedIn profile and two practice interviews, one with an HR person and one with a specialist from IT security.

We are a training provider, not a job placement service. We cannot promise a job, a particular salary or that you will pass the exams.