Select your current position
Pick a role and level — we'll show the growth path, skills and gap analysis.
Development path
Junior
0-2 years
Responsibility: Completing tasks under the guidance of senior colleagues. Learning the codebase, standards, and team processes. Writing code to spec, fixing simple bugs, writing tests.
Key skills:
Middle
2-5 years
Responsibility: Independently developing features from decomposition to deployment. Participating in code review. Optimizing performance. Mentoring junior developers. Taking part in architecture discussions.
Key skills:
Senior
5-8 years
Responsibility: Designing the architecture of components and services. Solving complex technical problems. Managing technical debt. Code review as a quality gatekeeper. Mentoring middle developers. Choosing technologies for new tasks.
Key skills:
Lead / Staff
7-12 years
Responsibility: Technical leadership of a team or area. Designing system architecture. Coordinating with other teams. Establishing standards and best practices. Participating in hiring. Planning the technical roadmap.
Key skills:
Principal
10+ years
Responsibility: Technical strategy at the company or domain level. Cross-organizational influence. Solving systemic business problems through technology. Mentoring lead engineers. Publicly representing the company.
Key skills:
Gap analysis: skills to develop
To reach the next level you'll need to develop:
Writes E2E security tests: login/logout flows, session hijacking prevention, CSRF protection, file upload security. Uses Selenium/Playwright with security focus.
Applies GDPR / 152-FZ Compliance in daily work. Conducts security code review. Uses scanning and analysis tools.
Applies PCI DSS in daily work. Conducts security code review. Uses scanning and analysis tools.
Applies property-based testing for security: random input generation for fuzzing, invariant checking for authorization rules. Uses Hypothesis/QuickCheck for security properties.
Conducts authorization testing: RBAC role matrix validation, ABAC policy testing, API endpoint authorization coverage. Automates authorization regression tests.
Configures SAST/DAST pipeline: Semgrep/SonarQube rules customization, ZAP automated scan profiles, IAST integration. Tunes rules to reduce false positives. Prioritizes findings.
Conducts security testing: OWASP Top 10 verification, vulnerability scanning (ZAP/Burp), dependency checking (Snyk). Documents findings with reproducible steps.
Applies BDD for security requirements: Gherkin scenarios for authentication, authorization rules, compliance requirements. TDD for security utility functions.
Writes unit tests for security code: input validation functions, encoding/escaping, cryptographic helpers. Tests edge cases and boundary values.
Conducts K8s security assessment: network policies audit, pod security standards compliance, secret management review. Tests with kube-hunter. Verifies admission controllers.
Writes integration tests for security: authentication flows, authorization checks across services, session management. Tests security middleware and filters.
Conducts security load testing: DDoS simulation, brute-force resistance testing, rate limiting verification. Uses k6/Locust for security load tests.
Manages security incidents: severity classification, containment actions, root cause analysis. Creates security incident runbooks. Documents lessons learned and improvement actions.
Conducts network security assessment: vulnerability scanning (Nessus), network architecture review, traffic analysis (Wireshark). Tests DNS security, DDoS resilience.
Configures dependency scanning pipeline: Snyk in CI, automated PRs for updates (Renovate/Dependabot), license compliance checking. Analyzes transitive dependencies.
Applies test pyramid for security: unit tests for validation functions, integration for auth flows, E2E for critical security paths. Balances coverage and speed.
Manages test data for security: sanitized production data, synthetic PII generation, credential management for test environments. Ensures compliance in test data.
Manages security test environments: isolated environments for penetration testing, sandboxed environments for malware analysis. Configures network isolation.
Manages vulnerability lifecycle: triage, prioritization (CVSS + context), SLA tracking, verification of fixes. Configures DefectDojo/vulnerability tracker. Generates reports.