Information processing
- Word processing: basic functions
- Spreadsheets: the basics
- Word, Excel, PowerPoint and Microsoft Teams
Home › Course & curriculum
The curriculum: nine months, week by week
The programme is called “AI-Driven Security Operations Specialist”. That is exactly how the title appears on the licence, with nothing added. It runs for nine months full-time, and four weeks of holiday are included.
Teaching is completely live: Monday to Friday, with a teacher, in a virtual classroom. This page shows you how a teaching day runs, what happens in each of the six stages, where the holiday weeks are and what equipment you get.
How you learn with us
Hands-on at the screen from day one
Your instructor explains the basics, and the German videos from simpleclub help. Then you practise yourself at the computer: in the TryHackMe practice system and in the SOC‑Simulator.
Videos only load when you click, and your IP address goes to US providers (Vimeo, Webflow). More: privacy policy.
The German explainer videos from simpleclub help you with the basics. The animation shows what the app looks like: here a network in which an attack is switched on and off.
Every topic comes with tasks you solve yourself. You don't just read about attacks: you replay them in the practice system and so learn to recognise them.
You start with the basics: explainer videos in German, then you practise yourself. Every lesson is live with an instructor, and the AI‑Tutor is also available for follow-up questions.
For the TryHackMe exercises, the practice machine with the tools runs in your browser. You don't need to install anything for it.
In the SOC‑Simulator you are given an incident: shift handover, prioritisation, escalation, report. You keep your case reports. The animation recreates the process in simplified form, in our design.
The SEC0, SEC1 and SAL1 exams are run by TryHackMe, not by us. We cannot promise that you will pass.
Try it out
This email is an attack. Can you find it?
Three details give the scam away. Tap them. After that you will know whether this job suits you.
Inbox 1 suspicious message
From DHL Paketdienst <>
Subject
Date
Your parcel could not be delivered. Please pay the outstanding amount of €2.99 so that we can try to deliver it again.
Confirm delivery:
0 of 3 Where would you look first? Look at the addresses, not at the text.
All three found.
That was not luck — you checked exactly the signs that a security team looks for too. If this suits you, the rest can be learned.
Check in 2 minutes whether your office will payNine months, six stages, three ranks
Your route from the first day to the certificate
You start from zero and work your way forward, stage by stage. Along the way you earn three ranks at TryHackMe — the same exams that security people take all over the world. You can fail — if you do not pass the first time, you get a second attempt, free of charge. We prepare you for them; even so, we cannot promise that you will pass.
The exams are run by TryHackMe, not by us. If you fail the first time, a second attempt is free. Exams you have passed can be checked by anyone through Credly.
The curriculum in detail
All topics, stage by stage
45 modules in 6 stages, 1,400 teaching units. Choose a stage and see what you learn there.
IT fundamentals and digital skills
You understand how computers, hardware and software work together.
Weeks
1–7
UE
280
Learning with
simpleclub and teacher
Components of a computer
- Computer science, information and data
- Hardware components at a glance
- Von Neumann architecture
- Monitor, mainboard, BIOS and UEFI
- Processor, memory, power supply
- Bus system, scanners, internal and external interfaces
Logic components and combinational circuits
- Boolean logic and logic gates
- Decoders, encoders, multiplexers
- Combinational circuits, Karnaugh map
IT workstation and safety
- Screen workstations under the ArbStättV (German workplace ordinance)
- Thin client, thick client, accessibility
- Software and hardware requirements
- Occupational safety, ergonomics, health protection
- First aid at work
Green IT and sustainability
- Green IT basics
- Saving energy at the workplace
Operating systems
- Linux-based operating systems
- Types of operating systems and their features
Data representation and number systems
- Bits and bytes
- Binary, hexadecimal and octal systems
- Positional number systems and integers
- Ones’ and two’s complement
Power supply and sensors
- UPS: basics, selection and operation
- Digital and analogue position sensors
- Infrared and temperature sensors, input devices
Introduction to AI tools
- ChatGPT, Claude and Gemini as learning aids
- Prompt engineering basics
Networks, IT security and SEC0
You understand networks and protocols and recognise security risks.
Weeks
8–14
UE
280
Learning with
simpleclub and TryHackMe Pre-Security
Exam
SEC0
DoD and OSI layer models
- DoD layer model
- OSI model: all seven layers in detail
- Physical, data link, network and transport layers
- Session, presentation and application layers
Network fundamentals
- Client-server model
- Connecting clients to the network and testing them
- Network components and topologies
- Structured cabling
- Router and switch
- Data transmission in networks
Network communication and IP
- Ethernet and IP addresses
- IPv4 addressing and subnetting
- IPv6 and subnetting with IPv6
- Network access methods
- Routing and routing tables
Protocols
- Fundamentals of network protocols
- ARP, NAT, ICMP, IPsec
- TCP and UDP
- Transport and network protocols
- Routing and application protocols
- DHCP
Remote data transmission and network types
- Mobile networks and telecommunications
- WLAN and VLAN
- Network diagrams and planning
Storage solutions
- NAS and SAN
- Data compression basics
- Blockchain basics
IT security fundamentals
- Information security objectives
- Data and network security
- Social engineering and malware
- Laws and standards for IT security
- Data protection and data security
Data and network security
- RAID and backup strategies
- Firewalls and packet filters
- Demilitarised zone (DMZ)
- Technical and organisational measures (TOMs)
TryHackMe: Pre-Security
- Introduction to Cyber Security
- Network Fundamentals
- How the Web Works
- Linux and Windows Fundamentals
SEC0: preparation and exam
- Review of all exam areas
- SEC0 exam at TryHackMe
Cyber Security 101 and SEC1
You work hands-on with IT security tools and prepare for SEC1.
Weeks
17–23
UE
280
Learning with
TryHackMe, Cyber Security 101 path
Exam
SEC1
Operating Systems Fundamentals
- Windows and Linux in detail
- File systems, users and permissions
- Command line: Bash and PowerShell
- Hardening systems
Network Traffic Analysis
- Analysing network traffic
- Recognising suspicious traffic
- Wireshark and tcpdump in practice
- Understanding data flow in the network
Web Application Security
- OWASP Top 10
- How web applications work
- Recognising SQL injection, XSS and CSRF
- Pentesting methods for web applications
Security Operations
- Log analysis and threat detection
- SOC tools and processes
- Detecting incidents, first response
- SIEM basics with Splunk and ELK
Password Attacks and Credential Security
- Brute-force and dictionary attacks
- Password cracking
- Authentication and its weaknesses
- Multi-factor authentication
Malware Analysis Fundamentals
- Recognising types of malware
- Static and dynamic analysis
- How malware behaves
- Sandboxing
IT-Grundschutz under BSI (German Federal Office for Information Security)
- Modelling and structure analysis
- Key terms and determining protection requirements
- Risk analysis under the BSI standard
- Project management with SMART
SEC1: preparation and exam
- Review of all exam areas
- Practice exams
- Exam strategy and time management
- SEC1 exam at TryHackMe
SOC analyst training and SAL1
You learn to detect, prioritise and document security incidents.
Weeks
24–30
UE
280
Learning with
TryHackMe SOC Level 1 and SOC‑Simulator
Exam
SAL1
Computing Foundations (in depth)
- In-depth system knowledge
- Network forensics: the basics
- Virtualisation and cloud
- Active Directory and authentication
Cyber Defence Frameworks
- MITRE ATT&CK
- Cyber Kill Chain
- Diamond Model
- NIST Cybersecurity Framework
Detecting Threats
- Setting up and using a SIEM
- Log correlation and alert rules
- Threat intelligence and IoCs
- Recognising attack patterns
Alert Triage
- Prioritising alerts
- Recognising false positives
- Investigating and escalating
- Playbooks
Case Report Writing
- Documenting incidents
- Preserving evidence and chain of custody
- Report templates
- Management summaries
Analyst Mindset
- Critical thinking
- Testing hypotheses
- Making decisions under time pressure
- Continuous improvement in the SOC
SOC‑Simulator: hands-on practice
- Simulated SOC environment
- Real-time alert queue
- Prioritising, investigating, triage
- Graded reports with feedback
SAL1: preparation and exam
- Review of all exam areas
- Practical exam in the simulated SOC
- Exam strategy and reports under time pressure
- SAL1 exam at TryHackMe
Vibe coding, AI skills and data protection
You use AI tools in line with data protection rules and build a portfolio on GitHub.
Weeks
33–36
UE
160
Learning with
Teacher and practical projects
Programming basics
- Reading and understanding code
- HTML and CSS
- Simple scripts for automation
- Version control with Git
Vibe coding with AI assistants
- Cursor
- GitHub Copilot
- Claude and ChatGPT for coding and debugging
- Your own projects, for example security tools
AI tools at work
- ChatGPT, Claude and Gemini in everyday work
- Prompt engineering
- Research, summaries, documentation
- Limits and risks of AI
Data protection and GDPR
- GDPR basics
- Data protection in IT security
- Handling personal data
- Record of processing activities
- Data subject rights and data protection officers
Support and IT service management
- IT services and support levels
- Remote maintenance and software maintenance
- Service contracts, SLM and SLA
- ITSM basics
- CRM and complaint management
- Communication and de-escalation
Job applications and starting your career
You prepare your job application and practise job interviews. We cannot promise you a job.
Weeks
37–39
UE
120
Learning with
Teacher and AI tools
Application documents with AI
- CV with AI tools
- Cover letter
- Portfolio and project folder
- Showing TryHackMe certificates and badges
Online presence and networking
- LinkedIn profile
- Xing profile
- Profiles on job portals: Arbeitsagentur, StepStone, Indeed
- Cybersecurity community
Job interview
- Practising interviews
- Technical questions in the interview
- Preparing for salary talks and explaining your value
- Assessment centre exercises with AI simulation
Job search in cybersecurity
- Career fields: Junior SOC Analyst, Security Admin, Incident Responder, IT support
- Finding employers
- Speculative applications and job fairs
Soft skills
- Communication in everyday working life
- De-escalation in IT support
- Professional manner
- Customer retention
UE = teaching unit (45 minutes). Every unit takes place live with a teacher.
Monday to Friday, always live
What a day on the route looks like
9:00Start of the day in the group
9:15The teacher explains the new topica real person, live, and you can ask questions
11:00You practise yourself, the teacher helpsyou are never alone with a task
13:00Practice on the training platformTryHackMe
15:00Case work and review
16:40End of the working day
What “online” often means
- Recorded videos that count as teaching
- One contact person, by ticket
- Every teacher brings their own materials
What it means here
- Every lesson with a teacher. The licence states: asynchronous share 0.
- From 9:00 to 16:40 there is a real person you can ask.
- Content from simpleclub and TryHackMe — the same quality in every lesson, no matter who teaches.
On 4 October 2027
What you take away
01 Your certificateFrom the CYBERSQUAD Akademie, with the approval number of the programme. Not a vocational qualification like the ones from the IHK (Chamber of Industry and Commerce).
02 Up to three ranksSEC0, SEC1, SAL1 — through Credly anyone can check that you passed
03 A portfolio on GitHubThe programs from stage 5. Anyone interested can take a look
04 Your case reportsFrom the SOC‑Simulator: how you handle and document an incident
And what we do not promise. We are a training provider, not a job placement service. We cannot promise you a job. What we do: teach you the craft and practise job applications with you.
From the licence
The key facts
Programme
AI-Driven Security Operations SpecialistThis is exactly how the title appears on the approval, with nothing added. The job behind it is called Junior SOC Analyst.
Start
Monday, 4 January 2027 plannedFor that we need a minimum number of registrations. If too few people sign up, we move the start by two to four weeks and tell you straight away.
Duration
9 months full time 39 weeks until 4 October 2027, including four weeks of holiday: weeks 15–16 and 31–32.
Location
Online, from home We provide the laptop and the headset. Virtual classroom, one fixed group.
Costs
0 € with an approved BildungsgutscheinYour Jobcenter or Agentur für Arbeit decides whether you get one.
Before the first day
Equipment: what we provide, what you need
You do not have to buy anything. The devices and all the accounts come from us. What you bring yourself is an internet connection, a quiet place and the time.
| Laptop | We provideBefore the start you get a laptop with a camera from us, on loan for the duration of the further training. All the programs you work with run on it or in the browser. You do not need a computer of your own. |
|---|---|
| Headset | We provideHeadphones with a microphone. You get this from us too. That way the group understands you, and you understand the group. |
| Access to the learning platforms | We provideThe virtual classroom runs on Microsoft Teams. There is also the practice platform TryHackMe with the SOC‑Simulator. The explainer videos from simpleclub are in German. On top of that, there is an AI tutor to help you learn. We set up all the accounts for you. |
| AI tools for Stage 5 | We provideWe also provide access to the AI tools that are used in the lessons. You do not have to take out any subscription and you pay nothing. |
| Internet at home | You needA stable internet connection of at least 10 Mbit/s. The lessons run all day with video and sound. A normal home connection is enough for that. |
| A quiet place to work | You needA table, a chair and a place where you can speak and listen without being disturbed. |
| Time | You needMonday to Friday from 9:00 to 16:40, for nine months. That is full time. Check honestly beforehand whether it fits into your daily life. We talk about it in the preliminary conversation. |
In brief
Dictionary: the technical terms from the curriculum
These words appear in the curriculum. Almost all of them are English. Nobody has to know them beforehand. They are explained in the lessons, and you can always ask questions.
Open the dictionary
- SOC — Security Operations Center. The department in a company that looks at the alerts from the security systems and decides which of them is serious.
- SIEM — Security Information and Event Management. A program that collects the log files from the whole company in one place. It raises an alarm when something does not match.
- Log / log file — A file in which a system writes down what has happened: who logged in and when, which program was started, which connection was made.
- Alarm and false alarm — An alarm is a message from the system. A false alarm looks dangerous but is harmless. Telling the two apart is the daily work in a SOC.
- MITRE ATT&CK — A public collection in which experts around the world have gathered the steps that attackers use. You sort an incident into it, so that everyone in the team means the same thing.
- Phishing — Fake messages that look like real post from a bank, a parcel service or your own employer. The goal is a password, a payment or a click on a dangerous link.
- Malware / malicious software — A program that is meant to cause damage or steal data. This also includes ransomware, which encrypts all the files in a company.
- Firewall — A protective system in the network. Like a guard at the door, it checks which data may come in and go out.
- Linux — An operating system like Windows, just used differently. In companies it runs on almost all servers. That is why you learn it from Stage 1 onwards.
- Virtual machine — A second computer that runs as a program on your laptop. You can try out anything in it. If something breaks, you delete it and start again.
- Lab — A ready-made practice environment in the browser, in which you solve a task hands-on. On TryHackMe you work in labs almost every day.
- OWASP Top 10 — A list of the ten most common weak points in web applications. It is maintained by a non-profit organisation and is widely used across the industry.
- Vibe Coding — You describe in German what a program should do. The AI writes the code. You check it, test it and improve it.
- Teaching unit (UE) — The unit of measurement for lessons: 45 minutes. Our further training has 1,400 of them, 8 on every teaching day.
Two minutes. Then you know which rule applies to you.
A short funding check, with no sign-up and no obligation.