)
The Cyber Security Online Bootcamp is one enrolment that takes you through four stacked TechDX certifications, in order, from your first day in security to specialist threat intelligence work. You start as a Certified Cybersecurity Associate, then move through the Certified Cybersecurity Analyst, Certified SOC Analyst, and Certified CTI Analyst roles. Together, that is 400 hours of learning and 12 units, weighted 60% towards hands-on labs. No prior cyber security or IT experience is required, so this cyber security bootcamp suits people starting from scratch as well as IT workers moving across. Study is fully online and self-paced on the browser-based TDX Arena platform, so you fit it around work rather than the other way around.
Why a stacked pathway rather than one course
A single standalone course leaves you with one credential and no evidence of range. Here each stage gates the next, so you build in the right order without skipping fundamentals. Credentials also accrue as you go: finishing Stage 1 already gives you three units and a TechDX certification, so you have proof to show employers long before the final stage. The order mirrors how security teams are structured, from generalist to analyst to SOC and intelligence specialist.
The bootcamp stacks four TechDX certifications in sequence. Each one gates the next, so you are never dropped into material you have no grounding for, and you finish each stage with a credential you can show an employer before the whole bootcamp is done. Complete in order and each stage unlocks the next.
Recommended pacing is 10 hours per week for 10 weeks per certification. Platform access is granted per certification, 75 days each.
The labs put you in front of real industry tooling, not screenshots of it. Instead of naming products, the list below sets out the kind of work you do and the frameworks that shape it.
Twelve units across four certifications, taken in order. Each stage ends in a hands-on applied exam before the next one opens.
Stage 1 builds the technical foundation that every security role assumes you already have: how networks work, how systems are hardened, and how a security team runs. Roughly 60 per cent is lab time. Built for career changers, self-taught IT staff and early-career security workers; needs only basic computer literacy and reliable internet.
Foundations: Command line work across file systems, permissions, processes and logs, then the OSI and TCP/IP models, subnetting, routing and protocols like DNS and HTTPS. Packet captures trace a session layer by layer; hashing and encryption protect data.
Systems: You administer operating systems: users, groups, least-privilege access, services, logging and auditing. You then harden a build to a baseline, patch, test backup and restore, and snapshot virtual machines, all mapped to the ASD Essential Eight and NIST Cybersecurity Framework.
Operations: You triage alerts in a SIEM-style console, pull suspicious emails apart header by header, read sandbox detonation and scanner findings ranked by CVSS, review cloud identity and storage exposure, then label behaviour using MITRE ATT&CK and the cyber kill chain.
By the end of Stage 1 you can:
Stage 2 puts you on the analyst side of a security operations centre: working a live queue, deciding what is real, escalating with evidence. It suits help desk, network and IT staff aiming at detection or incident response roles, and assumes you already read logs and traffic confidently, as Stage 1 teaches.
Fundamentals: The baseline before you touch a live queue: pulling authentication, endpoint, DNS and proxy logs, mapping a host and its services, normalising timestamps across time zones, querying a log analysis interface, and what a Tier 1 analyst owns versus escalates.
Essentials: Monitoring and escalation day to day: working a SIEM alert queue, tuning out false positives, turning a detection into a written finding, triaging phishing attachments in a sandbox, ranking findings by CVSS, and escalating through NIST SP 800-61 stages.
Analysis: Investigation, not just alerts. You correlate endpoint, network and identity events into one timeline, reconstruct the intrusion against the cyber kill chain, use packet capture, trace lateral movement and persistence, validate indicators with OSINT, then report scope, impact and containment.
By the end of Stage 2 you can:
Stage 3 moves you from watching alerts to owning investigations. Where Tier 1 confirms, Tier 2 decides: you pivot across log sources, rebuild attack timelines and drive containment. Built for IT professionals moving into security operations and anyone who has finished Stage 2, it assumes hands-on log analysis and incident response.
SOC Operations and Threat Monitoring: Labs put you in a monitoring queue built from endpoint, network, identity and cloud telemetry. You tune noisy detection rules and justify them, run structured shift handover, write case notes, and map coverage against MITRE ATT&CK to name visibility gaps.
Threat Detection and Log Analysis: Detection engine room. You query and correlate authentication, operating system, DNS, proxy and endpoint logs in a SIEM, baseline normal, then find the deviation: credential abuse, lateral movement, persistence, command and control beaconing, staged data. Confirmed techniques become detection rules.
Incident Response and Vulnerability Management: You run an incident through the NIST SP 800-61 lifecycle: scope it, decide whether to isolate or keep watching, preserve volatile evidence, contain, verify eradication, then report. Vulnerabilities are prioritised by CVSS, exploitability and asset criticality, with Essential Eight controls.
By the end of Stage 3 you can:
Stage 4 moves you from reacting to alerts to tracking the groups behind them, mapping their infrastructure and writing intelligence a SOC lead or a board can act on. It suits learners who finished Stage 3 and detection or response staff who like research and writing, with triage, escalation and log analysis experience.
Threat Intelligence Foundations: You run the intelligence cycle, from a stakeholder requirement through collection to dissemination. You grade source reliability, map adversary behaviour to MITRE ATT&CK, apply analysis of competing hypotheses, write with estimative language, and package findings in STIX for TAXII exchange.
Infrastructure Threat Hunting: You expand one observable, a domain, hash or certificate, into an infrastructure cluster using passive DNS, registration records and certificate reuse, confirm sandbox-derived command and control destinations and beaconing intervals, then convert it into a hunting hypothesis and detection logic.
Strategic Threat Hunting and AI Automation: You produce a sector threat assessment, turn executive questions into priority intelligence requirements, prioritise recommendations against the NIST Cybersecurity Framework and Essential Eight, automate feed ingestion, indicator scoring and ageing, verify AI-drafted analysis, then write executive, operational and tactical products.
By the end of Stage 4 you can:
Everything runs on TDX Arena, the platform built for these certifications. It is browser based, so there is nothing to install and no special equipment to buy. Lessons, labs, exams, support and progress tracking sit in one place across all four certifications, and you set the pace: the recommended rhythm is 10 hours a week for 10 weeks per certification.
TDX Arena runs in your browser. There is no software to set up, no virtual machine to configure and no special equipment to buy, so you need only basic computer literacy and reliable internet.
Labs use real tools and real-world workflows, and they adapt as you work. The AI adjusts what comes next based on how you are performing, so time goes into the skills you have not yet secured.
Each of the four certifications is 100 hours, split 60% hands-on labs and 40% lessons. Most of your time is spent doing the work, not watching someone else describe it.
Each certification ends in an applied, scenario-based exam. You are placed in a situation and assessed on what you do in it, rather than on recall from a bank of multiple choice questions.
Ember is available 24 hours a day through an avatar, by voice or by text. In-platform AI hints sit alongside it, so a lab you are stuck in at 11pm does not stall until morning.
Learner support is unified: one form, one email address and one phone number, whatever your question is about. Progress across all four certifications tracks in the same place, so you always know where you sit in the pathway.
Cyber security is judged on what you can do under pressure. Reading about triage does not build the reflexes an alert queue demands. Spending 60% of your hours in labs means the first time you investigate an incident is not on your first day at work.
Graduates of the Cyber Security Online Bootcamp will be well-prepared for entry-level positions in the cybersecurity field. The comprehensive training and hands-on experience gained through this program equip participants with the necessary skills to excel in various cyber security roles. Career opportunities for bootcamp graduates include:
With the knowledge and skills acquired in this bootcamp, graduates can confidently enter the cyber security job market and contribute to safeguarding organisations against cyber threats.
Your cyber security bootcamp is just the start. Our internship program can help you turn study into real work, real contacts and real outcomes.
Turn your qualification into real Australian work experience. Complete 80% of your course and apply for a 12-week internship with a top host company, delivered with Career Success Australia. Past placements include NAB, BHP, PwC, Telstra and IBM.
Get in touch to know more.*
*Terms and conditions apply.
Students who successfully complete this qualification may be able to pursue a rewarding career in Cyber security.
No. This bootcamp is non-accredited training. It delivers four TechDX certifications and twelve units. It is not an AQF qualification, not a Statement of Attainment and not nationally recognised training, and it does not licence you to perform a regulated role. If you need a nationally recognised credential instead, Upskilled also delivers nationally recognised IT qualifications, including certificate and diploma level programs with a cyber security focus.
No. There is no prior cyber security or IT experience requirement. You need basic computer literacy and a reliable internet connection. Stage 1, the Certified Cybersecurity Associate, starts at foundations and builds from there, so complete beginners and people making a cyber security career change begin in the same place. Everything runs in your browser, with no installs, no lab hardware and no special equipment to buy.
The full stacked pathway is 400 hours, made up of four certifications of 100 hours each. At the recommended pace of 10 hours a week, each certification takes about 10 weeks and the whole bootcamp about 40 weeks. Every certification includes 75 days of platform access. Learning is online and self-paced, so most students fit it around full-time work by choosing their own hours and study nights or weekends.
The four TechDX certifications are Certified Cybersecurity Associate, Certified Cybersecurity Analyst, Certified SOC Analyst and Certified CTI Analyst. Yes, they are completed in order. The pathway is gated, so each stage unlocks once you finish the one before it. Each certification carries three units and ends in a hands-on applied exam, so your skills build in sequence from security foundations, into security operations, then into threat intelligence.
A SOC analyst works inside a security operations centre, monitoring alerts, triaging and investigating incidents and containing or escalating threats as they happen, guided by frameworks such as MITRE ATT&CK and NIST SP 800-61. Tier 1 handles first-line monitoring, alert triage and basic checks against known playbooks. Tier 2 investigates deeper, correlating log and network evidence, confirming scope and impact, then driving containment and remediation. A CTI analyst works ahead of the incident, researching adversaries, analysing intelligence and sharing it in formats such as STIX and TAXII. In short, SOC work is reactive and operational, CTI work is proactive and analytical.
Graduates will be well-prepared for entry-level positions in the cyber security field, including roles such as Cyber Defense Analyst, Forensic Cyber Investigator, Network Operations Specialist, Cyber Defense Infrastructure Support Specialist, Cyber Defence Incident Responder, Information Security Analyst, and more. It targets entry-level defensive security work: security operations centre analyst, cyber security analyst and threat intelligence analyst roles. There is no job guarantee, and hiring depends on the employer, your background and how you interview. For context, Jobs and Skills Australia reports 13,300 ICT Security Specialists employed in Australia, drawing on the ABS Labour Force Survey Detailed, February 2026, and 92% work full-time hours against 64% across all occupations (ABS 2021 Census).
The bootcamp provides comprehensive support services, including access to a pre-configured Virtual Machine in the cloud, quizzes, teacher guides, solutions for each lab, and a dedicated support team to assist with any questions or issues that may arise during your learning journey.
Support is unified: one form, one email address and one phone number, so you never have to work out who to ask. In the platform, Ember the AI teaching assistant answers questions 24 hours a day by avatar, voice or text, and AI-powered hints help when a lab stalls. Progress tracking shows where you sit against the pathway, and the Upskilled team handles enrolment, payment and access questions.
You get a Cyber Security Bootcamp completion Certificate from TechDX & Upskilled. Which is highly valuable in the industry. Finish all four stages and you hold four TechDX certifications and twelve units, three per certification. Each certification also comes with a completion package: a Skills List setting out what you can do, Case Studies from the work you completed, and an Achievement Report. These are TechDX industry certifications and units, not nationally recognised qualifications, and they exist to give employers evidence of hands-on capability.
Yes, you can apply for one. Upskilled offers a 12-week internship delivered with Career Success Australia, open to students who have completed 80% of their course. Places are applied for rather than guaranteed, and the host company makes the final choice. Past host companies include NAB, BHP, PwC, Telstra and IBM. An internship gives you Australian workplace experience to sit alongside your TechDX certifications when you start applying for roles.