IT security practitioner skills: Certification prep and security operations
A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 7 details that are specific to your organisation.
- Length
- 45 min
- Lessons
- 6 lessons
- Frequency
- At onboarding of security staff
- Last reviewed
- 21 Oct 2026
A site fails because a certificate expired
Try it: this is one of 15 interactive activities in the course.
What's included
Three pieces that work together
Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.
Self-paced course
Short lessons with real workplace scenarios, not walls of text.
- 6 lessons, about 45 minutes
- Process, scenario, timeline, sorting activity and quizzes
Live session deck
An AhaSlides presentation to run after the course, in person or online.
- 10 slides
- Quiz, poll, ranking, word cloud slides
- A closing slide for your contacts
Two surveys
Find out what landed, and whether people use it on the job.
- Post-course feedback, about 2 minutes
- 30-day check-in
- Anonymous by default
- Results feed your next refresher
Learning objectives
At the end of this course, learners can
Each objective and the lesson that covers it.
| ID | Objective | Source | Where it's covered |
|---|---|---|---|
| TO 238.0 | Achieve ≥ 80% on the final assessment | - | Whole course |
| SO 238.1 | Describe threats, vulnerabilities and attack stages | NIST NICE Workforce Framework (SP 800-181) [check before build] | Whole course |
| SO 238.2 | Explain identity, access and certificate management basics | ISO/IEC 27001:2022 Annex A [check before build] | Whole course |
| SO 238.3 | Triage an alert in a detection and response workflow | Best practice | Whole course |
| SO 238.4 | Secure cloud resources and apply hardening and DevSecOps habits | Best practice | Whole course |
| SO 238.5 | Write an incident note and evidence staff competence + your info | ISO/IEC 27001:2022 clause 7.2 (competence) [check before build] | Whole course |
Your part: what a template can't do for you
- Your workplace details: fill in the 7 highlighted fields so the course describes your own policies, contacts and locations.
- Records: record completion in your own LMS or record system.
Course outline
6 lessons, about 45 minutes
Minutes per lesson are an estimate, shared out by page count.
1The alert nobody opened
3 pages
9 min
The alert nobody opened
3 pages
2Threats, vulnerabilities and attack stages
3 pages
9 min
Threats, vulnerabilities and attack stages
3 pages
3Identity, access and certificate management
3 pages
9 min
Identity, access and certificate management
3 pages
4Detection and response: SIEM and XDR workflows
2 pages
6 min
Detection and response: SIEM and XDR workflows
2 pages
5Securing cloud resources, hardening and DevSecOps
2 pages
6 min
Securing cloud resources, hardening and DevSecOps
2 pages
6Exam practice and incident write-ups
2 pages
6 min
Exam practice and incident write-ups
2 pages
Live deck and surveys
10 slides to run live, two surveys to close the loop
Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.
Post-course feedback: 11 questions, about 2 min
- Overall rating 5 stars
- Relevant, realistic, right length, helpful activities agree/disagree grid
- What was most useful? multi-select
- Confidence before this course, and now 1-5 scale
- Confidence in attack stages · identity · triage · cloud security · write-ups grid
- How are alerts prioritised? multiple choice
- Which security task do you want covered? short text
- I can say ‘I am not sure how severe this is’ without feeling judged. 1-5 scale
- One thing we should change or add open text
- Would you recommend this course? NPS
30-day check-in
- Have you used what you learned since the course? multiple choice
- How confident are you today? Compare with day 1 1-5 scale
- Do you know where to find the incident route and security contact? yes / no / not sure
- A moment where the training helped, or where you weren't sure open text
- Which topics should the next refresher focus on? ranking
Results show whether people use the training on the job, not just whether they finished it.
Make it yours
7 fields to fill in, and you're ready
Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.
- Security team contact
{{SECURITY_CONTACT}} - How to report an incident or near miss
{{INCIDENT_ROUTE}} - Where completion is recorded
{{LMS_OR_RECORD_SYSTEM}} - Link to the post-course and 30-day survey
{{SURVEY_2_URL}} - Who to ask for help or to report a concern
{{HELP_CONTACT}} - Link to the self-paced course
{{COURSE_URL}}
Show all 7 fields
- Link to the baseline survey
{{SURVEY_1_URL}}
FAQ
Common questions
Can I run IT security practitioner skills: Certification prep and security operations training online?
Yes. The course is self-paced and online, and the live deck lets you add a live session in the room or online.
How often is this training needed?
At onboarding of security staff, and in the weeks before a security certification exam.
Who needs this training?
Security analysts, SOC staff, IT administrators and identity and certificate managers; run by security teams or managed-service providers with L&D.
What records should I keep?
Record completion in your own LMS or record system, so you can show who finished the course and when.
Can I edit the content?
Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply.
Related templates
Often taught together
Ready to run it?
Open the live deck to see how the session runs alongside the course and both surveys.