IICTI Certified Cybersecurity Analyst

Holders demonstrate that they can apply and evaluate detection engineering and detection-as-code lifecycle, sIEM and XDR telemetry pipeline architecture, risk-based alerting, triage and contextual enrichment and hypothesis-driven threat hunting, plus 7 further areas, in realistic professional scenarios, as defined in the AQSCERT scheme for Cybersecurity Analyst.

Who it is for: Professionals working, or preparing to work, in security roles.

1. 01Detection engineering and detection-as-code lifecycle14% of the exam

   • Design and maintain a tested, version-controlled detection catalogue with measurable ATT&CK coverage and controlled false-positive rates.
   • Scope: Sigma, KQL, SPL and EQL rule authoring, MITRE ATT&CK v16 mapping, version-controlled rules with CI validation, detection unit testing with Atomic Red Team, precision/recall tuning and suppression strategy.
2. 02SIEM and XDR telemetry pipeline architecture5% of the exam

   • Architect a telemetry pipeline that balances detection fidelity, ingestion cost and retention obligations.
   • Scope: Log source onboarding and prioritisation, OCSF and ECS normalisation, Cribl and Vector pipelines, data tiering and retention, parsing quality, clock synchronisation, cost-versus-fidelity trade-offs.
3. 03Risk-based alerting, triage and contextual enrichment14% of the exam

   • Evaluate and prioritise complex alert streams using risk scoring and enrichment to reach defensible escalation decisions.
   • Scope: Risk-based alerting (RBA), entity risk scoring, UEBA baselines, asset and identity context, STIX/TAXII and MISP enrichment, alert fatigue metrics and triage decision models.
4. 04Hypothesis-driven threat hunting3% of the exam

   • Lead structured hunts that test explicit hypotheses and convert findings into durable detections.
   • Scope: PEAK and TaHiTI hunting frameworks, hypothesis formulation from intelligence, stack counting and long-tail analysis, behavioural analytics, Jupyter hunting notebooks, converting hunt findings into detections.
5. 05Endpoint and memory forensics for incident triage14% of the exam

   • Diagnose host compromise scope and attacker activity from endpoint and memory evidence.
   • Scope: EDR telemetry, Sysmon and ETW, Windows and Linux artefacts, Volatility 3 memory analysis, Velociraptor and KAPE collection, Plaso super-timelines, persistence and lateral movement indicators.
6. 06Network detection and encrypted traffic analysis7% of the exam

   • Analyse network telemetry to detect command-and-control and exfiltration without relying on payload inspection.
   • Scope: Zeek and Suricata, JA4+ fingerprinting, NetFlow/IPFIX analytics, DNS and TLS metadata analysis, C2 beaconing and exfiltration detection, PCAP analysis where visibility is limited by encryption.
7. 07Cloud, identity and SaaS threat detection6% of the exam

   • Design detections and investigations for identity-centric and cloud control-plane attacks across multi-cloud and SaaS estates.
   • Scope: Entra ID and Okta sign-in and audit logs, AiTM and token theft, OAuth consent abuse, AWS CloudTrail and GuardDuty, Azure and GCP activity logs, Kubernetes audit logs, cloud detection and response (CDR).
8. 08Incident response coordination and containment decisions15% of the exam

   • Lead incident response decisions that balance containment speed, evidence preservation and business impact.
   • Scope: NIST SP 800-61r3 and CSF 2.0 Respond/Recover, ransomware and BEC playbooks, containment and eradication trade-offs, ISO/IEC 27037 evidence handling and chain of custody, stakeholder communication.
9. 09Threat intelligence operationalisation9% of the exam

   • Evaluate and operationalise threat intelligence into prioritised detections, hunts and purple-team validation.
   • Scope: Priority intelligence requirements, Diamond Model and kill chain analysis, Pyramid of Pain, TTP-based detection, Admiralty source grading, intelligence sharing (ISACs, TLP 2.0), adversary emulation plans for detection validation.
10. 10SOAR automation and AI-assisted SOC operations4% of the exam

    • Architect automation that reduces analyst toil while keeping high-impact actions safe, auditable and reversible.
    • Scope: Playbook design, idempotent and reversible actions, approval gates and human-in-the-loop, case management, LLM copilots for triage and summarisation, validation of AI outputs and automation risk controls.
11. 11SOC performance, maturity and regulatory incident reporting9% of the exam

    • Lead SOC improvement with meaningful metrics and ensure incident reporting meets regulatory deadlines and content requirements.
    • Scope: SOC-CMM and MITRE ATT&CK coverage assessment, MTTD/MTTR and dwell-time metrics and their pitfalls, shift and escalation design, analyst QA, NIS2 24/72-hour reporting, DORA major ICT incident reporting, GDPR Art. 33.

Question types

Single choice 100%

Delivery

Online (remote proctored), Test centre, On-site (corporate)

Retakes

Up to three attempts within any 12-month period. A 14-day waiting period applies after a first unsuccessful attempt and 30 days after a second. Each retake requires a new booking and fee. Retakes draw a different randomised form from the question bank.

Provisional cut score — psychometric validation is required before live delivery. Blueprint v1.0.

1. 1

   Register

   Create a free account and start the programme.

2. 2

   Practice

   Online practice test (coming soon).

3. 3

   Training

   Optional

   Online course or classroom — or skip it.

4. 4

   Certification

   Independent exam and certification decision.

Training is optional and does not by itself confer certification. Find a training partner