SOC & Incident Response Training · Canada & GCC
Practical SOC and incident response training, taught by practitioners who previously worked at Mandiant, Accenture, PwC and Deloitte. Live online, or in person in Canada and the Gulf.
Next cohort: registration of interest is open
Our instructors previously worked at
and other leading security and advisory firms
20
years of combined frontline experience
250+
incidents investigated and responded to
11
countries our instructors have worked in
4
hands-on courses, from SOC foundations to threat hunting
Why CyberCanada
Most security courses teach tools. We teach how real incidents unfold: the first alert, the hard calls under pressure, and the report the board reads afterwards.
Every instructor has worked frontline incident response or SOC operations at a global firm.
Work through realistic attack scenarios with real logs, endpoints and evidence, not just slides.
Examples and reporting practice shaped by the frameworks you work under, such as NIST in North America and the NCA controls in Saudi Arabia.
Leave with the workflows, playbooks and reporting habits that hiring managers look for in SOC and IR roles.
Courses
Every course runs as an intensive week or a part-time track, live online or in person.
Foundation to intermediateBuild the daily skills of a SOC analyst: triaging alerts, investigating with a SIEM and escalating with confidence.
PricePrice on request
Register interest
IntermediateRun an incident end to end: scoping, containment, eradication, recovery and the report leadership needs.
PricePrice on request
Register interest
AdvancedFind out what really happened: collect and analyse evidence from disk, memory and the cloud, and build a timeline that holds up.
PricePrice on request
Register interest
AdvancedStop waiting for alerts. Hunt for attackers from a hypothesis and turn threat intelligence into detections.
PricePrice on request
Register interestInstructors
Our instructors built their careers inside global incident response and cyber advisory teams. Full profiles are available on request.
Previously at Mandiant
Breach investigations · Ransomware response
Previously at Accenture
SOC operations · Detection engineering
Previously at PwC
Forensics · Investigations · Expert reporting
Previously at Deloitte
Threat intelligence · Tabletop exercises
Formats
Instructor-led virtual classes with live labs. Join from anywhere in Canada or the Gulf.
Classroom cohorts in Canada. The venue is confirmed when each cohort opens.
Classroom and on-site delivery across the Gulf, including private sessions at your offices.
5 days, 40 hours. Ideal for teams, and for anyone who can step away from work for a week.
6–8 weeks of evening and weekend sessions, built around a full-time job.
For organisations
We train security teams as private cohorts and run tabletop exercises that test your people, your plan and your leadership.
Certificates
Every learner who completes a course receives a CyberCanada certificate of completion.
Course content is mapped to the skills tested in widely recognised certifications, including CompTIA CySA+, GIAC GCIH and Security Blue Team BTL1.
CyberCanada is not an official training partner of these certification bodies, and exam fees are separate.
FAQ
IT and security professionals moving into SOC or incident response roles, analysts who want to step up, and organisations building their in-house teams.
For the SOC Analyst course, a working knowledge of networking and operating systems is enough. Incident Response, Digital Forensics and Threat Hunting assume SOC experience or our SOC course.
Register your interest and we will send you the dates, venue and pricing as soon as the next cohort is confirmed.
Yes. We run private cohorts online or on-site in Canada and the GCC, and can add tabletop exercises for your leadership team.
Next cohort
Tell us which course and format you prefer. We will contact you with dates and pricing, with no commitment.