Rocheston Certified Cybersecurity Engineer (RCCE) Level 2
Course Overview
Attack and defence are usually taught separately, but real incidents involve both at once. RCCE Level 2 training puts them in the same room. In the Rocheston Certified Cybersecurity Engineer (RCCE) Level 2 course, learners take turns probing systems and protecting them. In the process, they learn how an intrusion unfolds from each side, and why detection and response depend on understanding the attacker.
The centrepiece for defenders is ZombieCop.Run, a Red Team vs Blue Team exercise across a large lab range. The Red Team follows a structured, authorised attack plan, while the Blue Team watches for signs of compromise, contains the activity and restores affected systems. Afterwards, both teams compare notes on which actions were spotted, which were missed, and which controls would have stopped the attack sooner. That review is where much of the learning happens.
The rest of the five-day programme supports this. Cyber Range Sphere builds penetration testing skills through capture-the-flag challenges across more than 100 machines. Vulnerability Vines covers VAPT work, including vulnerability scanning, DevSecOps, identity and access management, zero trust, and VPN security. The JuggyBank capstone then tests everything against a simulated banking environment that learners must assess and defend. Throughout, the Rocheston Certified Penetration Tester (RCPT) framework keeps the work methodical.
Every exercise takes place in authorised, simulated Rocheston environments.
For security operations, the result is teams that respond with more confidence. Analysts recognise attacker patterns sooner, incident responders scope breaches faster, and engineers know which controls to strengthen first.
Course Objectives
- Detect simulated intrusions as a Blue Team member and contain them using structured response steps.
- Apply authorised offensive techniques as a Red Team member within an agreed scope.
- Analyse an attack after the exercise to identify missed signals and control gaps.
- Assess systems across a large lab range using the RCPT penetration testing framework.
- Identify and validate vulnerabilities through capture-the-flag challenges.
- Evaluate IAM, zero trust, VPN, and DevSecOps controls during VAPT exercises.
- Defend a simulated banking environment after completing a full assessment of it.
- Communicate findings clearly to technical teams and management.
Built on Trust, Driven by Excellence
ANAB ISO/IEC 17024 Accredited
- RCCE is accredited by the ANSI National Accreditation Board to the global personnel-certification standard, listed in the official ANAB directory.
U.S. DoD 8140 Approved
- Officially approved under the Department of Defense 8140 DCWF framework, mapped to cyber workforce job roles.
Verifiable Credentials
- Every RCCE certificate can be independently verified by employers in seconds through Rocheston Roxy.
Target Audience
- Penetration testers and ethical hackers who want structured, full-engagement practice.
- Red Team members refining coordinated offensive operations in a safe range.
- Blue Team, SOC and security operations staff who want live defensive experience.
- Incident responders and threat intelligence staff who need a deeper view of attacker behaviour.
- Cybersecurity engineers and analysts testing their own control designs.
- Vulnerability management teams moving from scanning to validated, risk-based findings.
- Security consultants and auditors who produce assessment reports for clients.
- RCCE Level 1 holders ready for the advanced stage of the Rocheston track.
Course Content
4 modules · 45 topics01Module 1: Cyber Range Sphere, Capture-the-flag-style exercises across 100+ lab machines with different vulnerabilities, operating systems, and defensive conditions11 topics
- You will learn
- Target analysis
- Vulnerability discovery
- Evidence collection
- Risk prioritization
- Remediation thinking
- You will produce
- Vulnerability notes
- Findings summary
- Technical evidence
- Remediation recommendations
02Module 2: ZombieCop.Run — Red Team vs Blue Team, Team-based exercises where Red Teams simulate adversary behavior and Blue Teams investigate, defend, and respond.11 topics
- You will learn
- Red Team planning
- Blue Team detection
- Incident response thinking
- Team communication
- Adversary simulation strategy
- You will produce
- Attack/defense timeline
- Detection notes
- Lessons-learned report
- Response summary
03Module 3: Vulnerability Vines, Train on Rocheston's VAPT platform for vulnerability scanning, assessment, reporting, and remediation workflows.10 topics
- You will learn
- The VAPT lifecycle
- Vulnerability scanning
- Cloud firewall concepts
- DevSecOps basics
- IAM & zero-trust alignment
- You will produce
- VAPT report
- Risk ranking
- Remediation plan
04Module 4: JuggyBank — The Capstone, Step into a simulated banking environment with realistic systems, exposed services, user workflows, business risk, and security weaknesses. Assess, validate, document, recommend, and present — like a working penetration tester.13 topics
- You will learn
- Full-cycle engagement workflow
- Technical validation
- Business-risk communication
- Professional reporting
- Final presentation
- You will produce
- Scope summary & target inventory
- Vulnerability findings + severity ratings
- Evidence screenshots & business impact notes
- Remediation recommendations
- Executive summary + technical appendix
- Final presentation
Schedule Dates
4 upcoming batches| Batch Dates | Duration | Batch Options | Language | Action |
|---|---|---|---|---|
| 15 February 2027 - 19 February 2027 | 5 Days | 4 hours & 8 hours | English / Arabic | |
| 17 May 2027 - 21 May 2027 | 5 Days | 4 hours & 8 hours | English / Arabic | |
| 23 August 2027 - 27 August 2027 | 5 Days | 4 hours & 8 hours | English / Arabic | |
| 29 November 2027 - 03 December 2027 | 5 Days | 4 hours & 8 hours | English / Arabic |
Can’t find a suitable date? Request a schedule that fits your team.
Request More InformationRed Team and Blue Team Training in Doha and Lusail for Qatar National Vision 2030
Qatar National Vision 2030 sets out a knowledge-based economy, and the energy, finance, and government institutions behind it hold systems and data that attract capable adversaries. The National Cyber Security Agency coordinates national cyber defence and issues standards that organisations are expected to follow. RCCE Level 2 training in Qatar helps security teams in Doha, Lusail and Ras Laffan practise defending against realistic, coordinated attacks in an authorised range before they face one in production. Energy operators protecting industrial and corporate networks, and banks running digital channels, both gain from analysts and responders who have defended under pressure. The Red vs Blue format also builds the teamwork that real incidents demand. Individuals can choose a date from our Doha training calendar, while security managers can arrange a private team session at your premises. Contact us for the detailed outline and timing.
FAQs
What is ZombieCop.Run in RCCE Level 2?
ZombieCop.Run is the Red Team vs. Blue Team component of RCCE Level 2. One team carries out authorised attacks against lab systems while the other detects, contains, and recovers. Rocheston runs it across a range of more than 100 targets, so both sides face varied, realistic scenarios that build teamwork, communication, and tactical judgement.
Is RCCE Level 2 suitable for SOC analysts in Doha?
Yes, SOC analysts benefit strongly, provided they have the Level 1 foundation or equivalent experience. The Blue Team role gives them direct practice against an active adversary rather than recorded alerts. They learn which signals matter most early in an attack and how to coordinate containment quickly with engineers and responders.
How does penetration testing improve incident response?
Penetration testing teaches responders how attackers move through a network, so they can trace an intrusion backwards with more confidence. A responder who has used a technique in an authorised lab recognises its traces, such as unusual accounts or outbound connections. That recognition speeds up scoping, the stage where teams decide which systems are affected.
What does an advanced cybersecurity engineer do differently from an entry-level one?
An advanced engineer moves from applying individual controls to assessing whole environments. That includes scoping authorised tests, chaining findings to show real business impact, and deciding which fixes matter most. Advanced engineers also guide others, review designs, and explain risk to leadership. RCCE Level 2 is designed to build these broader responsibilities.
What topics does Vulnerability Vines cover?
Vulnerability Vines is the VAPT component of RCCE Level 2. It covers vulnerability scanning, assessment, and reporting, along with DevSecOps, identity and access management, zero trust, and VPN security. The aim is to assess how modern controls perform in practice, not just whether they are configured, and to report weaknesses in a form teams can fix.
Does passing the RCCE Level 2 exam give me a certificate?
Yes, Rocheston issues a certificate to candidates who pass the RCCE Level 2 exam. Attending the five-day course alone does not grant it. The exam, held on the final day, has 100 questions and a 70% pass mark, and is proctored online through Ramsys. Our team can confirm exam arrangements for your batch before you enrol.
Can a whole security team attend RCCE Level 2 together?
Training a team together works well, particularly for the Red vs Blue exercises, which rely on coordination and shared terminology. Teams that train together often find their real incident handling becomes faster and calmer. Each member should still meet the Level 1 or equivalent prerequisite, so no one spends range time catching up on basics.
What is a sensible next step after RCCE Level 2?
Apply the skills in authorised internal assessments and purple team exercises at work, where real systems test what the range taught. Learners who want to add AI expertise to their security skills can explore our Rocheston Certified AI Engineer course. Career outcomes depend on experience and employer needs, so no course can promise a specific role.
Flexible Training Options to Meet Your Needs
Choose how you learn — live online, in-classroom, at your workplace, or internationally. CounselTrain delivers certified IT training in the format that fits your team.
Select the method that best suits your needs.
Online Instructor-Led Training
Learn from the comfort of your workplace or at home through live virtual sessions led by expert trainers.
Learn moreHighlights
Classroom Training
Participate in interactive, face-to-face training in our top 5-star training facilities in Dubai.
Learn moreHighlights
Onsite Training
Learn a customised curriculum in your workplace to ensure the most impact and team participation.
Learn moreHighlights
Overseas Training
Participate in our international training sessions and improve your abilities with world-class instructors.
Learn moreHighlights
Related Courses
Other courses in the same category that might interest you.
