Grade Calculator — DevLevelUp

Select a role to assess

Rate your skill proficiency — the system will calculate your recommended grade

Role

Skills Self-Assessment

Role: Application Security Engineer

Assessed: 0 Total: 0

API Gateway & Service Communication 1

▼

Knows fundamental webhook security risks including replay attacks and payload tampering. Can verify HMAC signatures on incoming webhook payloads using standard libraries. Understands the importance of HTTPS-only endpoints and basic input validation for webhook receivers. Identifies common SSRF vectors in webhook configurations.

Implements comprehensive webhook security controls including timestamp-based replay protection, constant-time HMAC comparison, and IP allowlisting. Conducts security reviews of webhook endpoint implementations to identify SSRF vulnerabilities and injection risks. Designs payload verification schemes with rotating secrets and versioned signature algorithms.

Drives webhook security policy across the engineering organization, integrating security requirements into CI/CD pipelines and API governance frameworks. Evaluates emerging threats to webhook infrastructure and updates security controls proactively. Builds security champion programs focused on secure webhook implementation patterns and conducts cross-team training on SSRF prevention and payload integrity.

Defines the organization's API strategy. Designs platform APIs. Shapes enterprise API governance and standards.

Application Security 3

▼

Understands basic Dependency Vulnerability Scanning concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Independently configures and maintains SCA tools (Snyk, Dependabot, Trivy) across multiple repositories. Analyzes transitive dependency trees to assess real exploitability of reported CVEs. Understands trade-offs between auto-merge policies for patch updates and manual review for major version bumps. Integrates dependency scanning into CI/CD pipelines with appropriate break-build thresholds.

Defines the team-wide dependency scanning strategy, selecting and standardizing SCA tools (Snyk, Dependabot, Trivy) across all product lines. Establishes vulnerability remediation SLA policies with escalation paths based on CVSS, EPSS, and business impact. Coordinates incident response for zero-day dependency vulnerabilities such as Log4Shell-class events. Trains engineering teams on secure dependency management, license compliance, and SBOM adoption.

Defines the enterprise-wide software supply chain security strategy, shaping dependency scanning architecture across all business units. Drives adoption of SBOM standards (CycloneDX, SPDX) and integrates SCA programs with GRC frameworks for regulatory compliance (FedRAMP, SOC 2, EU CRA). Coordinates cross-organizational vulnerability disclosure and remediation processes for critical supply chain incidents. Represents the organization in industry groups (OpenSSF, OWASP) and contributes to evolving SCA standards and best practices.

Understands basic SAST/DAST concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Configures and runs SAST/DAST tools to identify vulnerabilities in application code and running services. Conducts security code reviews using static analysis findings as input. Triages scanner results, eliminates false positives, and tracks confirmed issues to resolution.

Defines organization-wide SAST/DAST strategy and tool selection standards. Establishes security scanning policies, quality gates, and remediation SLAs for development teams. Coordinates vulnerability response across products when critical scanner findings arise. Trains engineers on effective SAST/DAST adoption.

Defines enterprise SAST/DAST security testing architecture spanning all development platforms. Shapes scanning strategy for multi-cloud and microservice environments at scale. Coordinates with vendors on tool capabilities and compliance requirements. Drives SAST/DAST best practices adoption across the industry.

Understands basic Threat Modeling concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Independently conducts threat modeling sessions for application components using STRIDE methodology. Builds data flow diagrams and identifies trust boundaries. Prioritizes threats using DREAD or risk matrices. Integrates threat modeling into SDLC gates and tracks remediation of identified risks.

Defines threat modeling strategy at team and product level. Establishes mandatory threat modeling gates in the development lifecycle. Coordinates cross-team threat assessments for shared infrastructure and API boundaries. Builds a threat modeling culture by training product teams and integrating threat analysis into sprint planning and architecture reviews.

Defines enterprise-wide threat modeling strategy and governance framework. Shapes organizational security architecture through systematic threat analysis across all product lines. Establishes threat modeling maturity benchmarks and drives continuous improvement. Represents the organization in industry threat modeling communities and contributes to evolving standards (OWASP, NIST).

Authentication & Authorization 2

▼

Understands basic JWT / OAuth2 / OIDC concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Validates JWT/OAuth2 implementations in applications: reviews token validation logic, audits OAuth2 flow configurations for security weaknesses, and tests for common JWT attacks (algorithm confusion, claim injection). Conducts security code reviews focusing on authentication middleware. Uses tools like jwt.io and Burp Suite for token analysis.

Defines application security standards for authentication across the organization. Establishes JWT/OAuth2 security review checklists, secure coding guidelines for token handling, and authentication architecture review processes. Drives adoption of centralized identity management. Trains security champions on authentication vulnerability detection.

Defines enterprise identity and authentication security strategy. Shapes zero-trust architecture with JWT/OAuth2/OIDC as foundational components. Drives adoption of modern authentication standards (FIDO2/WebAuthn, Passkeys) across the organization. Coordinates compliance frameworks for identity management. Represents the organization in identity security community.

Understands basic RBAC / ABAC authorization concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Implements RBAC and ABAC authorization models in application security reviews. Conducts code reviews focused on access control logic and permission enforcement. Uses static analysis tools to detect authorization bypass vulnerabilities in application code.

Defines organization-wide RBAC/ABAC authorization strategy and access control standards. Establishes security policies for role hierarchies and attribute-based access decisions. Coordinates authorization incident response across products. Trains teams on secure authorization design patterns.

Defines enterprise authorization architecture spanning RBAC and ABAC across all systems. Shapes access control strategy for zero-trust environments and microservice ecosystems. Coordinates compliance with regulatory access control requirements. Drives industry adoption of authorization best practices.

Compliance 3

▼

Understands basic GDPR / 152-FZ Compliance concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Applies GDPR/152-FZ compliance in application security: conducts privacy-focused code reviews, implements data minimization checks, and validates consent management flows. Uses SAST tools to detect PII exposure and logging violations.

Defines GDPR/152-FZ compliance strategy for application security: establishes privacy review processes, data processing agreement templates, and breach notification procedures. Coordinates DPO collaboration and cross-team privacy training.

Defines enterprise privacy and GDPR/152-FZ compliance strategy. Shapes organizational privacy architecture spanning data governance, consent management, and cross-border transfer frameworks. Represents company in regulatory discussions and industry privacy initiatives.

Understands core PCI DSS requirements for cardholder data protection. Follows secure coding guidelines aligned with PCI standards. Recognizes common application vulnerabilities that may lead to PCI compliance violations in codebases.

Applies PCI DSS requirements when reviewing application security architecture. Conducts security code reviews focused on cardholder data handling and encryption. Uses vulnerability scanning tools to verify PCI compliance across services.

Defines organizational PCI DSS compliance strategy for application security. Establishes security policies and standards for cardholder data environments. Coordinates incident response for PCI-related breaches. Trains engineering teams on PCI requirements and secure development.

Defines enterprise-wide PCI DSS security strategy spanning all applications and services. Shapes security architecture ensuring compliance at scale across payment ecosystems. Coordinates with QSA auditors and regulatory bodies. Represents the organization in PCI security community.

Understands basic SOC2 Compliance concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Implements SOC 2 security controls in application architecture: access logging, encryption at rest/in transit, and vulnerability management. Conducts security code reviews aligned with Trust Services Criteria.

Defines SOC 2 compliance strategy for application security: establishes secure SDLC policies, incident response procedures, and continuous monitoring requirements. Coordinates with auditors on technical control validation.

Defines enterprise application security strategy aligned with SOC 2 Type II requirements. Shapes security architecture for continuous compliance, designs automated evidence collection systems, and represents the organization in auditor engagements.

Container Security 1

▼

Understands basic container security scanning concepts: image vulnerability scanning with Trivy/Grype, base image selection. Uses pre-configured scanning pipelines and follows team guidelines for addressing critical CVEs in container images.

Independently configures and manages Container Security Scanning. Writes IaC for typical tasks. Understands networking and security basics.

Defines container security scanning strategy and governance framework. Establishes vulnerability management SLAs, scanning coverage requirements, and exception handling processes. Coordinates container security standards across development and platform teams.

Defines enterprise container security strategy spanning build, deploy, and runtime phases. Evaluates scanning platforms and shapes supply chain security architecture. Establishes organizational container security governance aligned with compliance frameworks.

Incident Response 3

▼

Understands basic Digital Forensics concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Applies digital forensics techniques to investigate application security incidents. Collects and preserves application logs, memory dumps, and network captures maintaining chain of custody. Uses forensic tools (Volatility, Autopsy) to analyze artifacts from compromised web applications.

Defines forensic readiness strategy for application security ensuring logging, monitoring, and evidence collection capabilities are built into systems by design. Establishes forensic investigation playbooks and trains teams on evidence handling procedures for application-layer incidents.

Shapes enterprise forensic architecture ensuring all application platforms maintain forensic readiness across cloud and on-premise environments. Drives industry standards for application-layer forensics and evidence handling. Advises executive leadership on forensic capability investments and regulatory compliance.

Understands basic Incident Response Process concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Participates in application security incident response following established playbooks. Triages security alerts related to application vulnerabilities (SQLi, XSS, SSRF). Collects application logs and artifacts for investigation and communicates findings to the incident commander clearly.

Defines application-specific incident response strategy including detection rules, response playbooks, and communication protocols. Establishes application security monitoring standards to reduce mean time to detection. Coordinates cross-team incident response drills focused on application-layer attack scenarios.

Shapes enterprise incident response strategy with deep focus on application-layer threats and supply chain attacks. Drives integration of application security telemetry into organization-wide incident detection platforms. Advises C-level on application security incident readiness and regulatory breach notification compliance.

Understands basic Vulnerability Management concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Manages vulnerability lifecycle from discovery to remediation in application environments. Conducts security code reviews to validate and classify identified vulnerabilities. Uses vulnerability scanners and tracking tools to maintain accurate inventory of application security issues.

Defines organization-wide vulnerability management strategy for application security. Establishes remediation policies, SLAs, and escalation procedures for critical vulnerabilities. Coordinates cross-team vulnerability response and drives adoption of shift-left practices. Trains engineering teams on vulnerability lifecycle management.

Defines enterprise vulnerability management architecture spanning all application platforms and cloud environments. Shapes vulnerability remediation strategy aligned with business risk appetite and regulatory requirements. Coordinates with vendors and industry bodies on vulnerability disclosure. Drives vulnerability management standards adoption.

Infrastructure Security 4

▼

Understands basic Cloud Infrastructure Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Applies cloud security principles to application workloads. Conducts security reviews of cloud-native apps using CSPM tools. Performs container image scanning and serverless function analysis to identify misconfigurations and vulnerabilities in deployment pipelines.

Defines cloud application security strategy incorporating CSPM, container security, and serverless protection standards. Establishes security policies for cloud-native development workflows. Coordinates incident response for application-layer cloud breaches and trains teams on secure cloud coding practices.

Defines enterprise cloud application security strategy spanning CSPM, container orchestration, and serverless platforms. Shapes security architecture standards for cloud-native ecosystems. Coordinates compliance with SOC 2, ISO 27001 for cloud workloads and represents the organization at cloud security conferences and working groups.

Understands basic Kubernetes Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Applies Kubernetes security practices to containerized applications including pod security standards, network policies, and RBAC configurations. Scans container images for vulnerabilities using Trivy or Snyk. Reviews Kubernetes manifests for security misconfigurations and hardening compliance.

Defines Kubernetes security standards for the organization including admission control policies, image signing requirements, and supply chain security. Establishes OPA/Gatekeeper policy libraries for application workloads. Coordinates security reviews of cluster architectures and trains development teams on secure Kubernetes patterns.

Shapes enterprise Kubernetes security architecture spanning multi-cluster, multi-cloud environments with zero-trust networking principles. Drives adoption of supply chain security standards (SLSA, Sigstore) for container workloads. Advises leadership on emerging container security threats and investment priorities for cloud-native security tooling.

Understands basic Network Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Independently configures and audits network security controls protecting application infrastructure: WAF rules, reverse proxy hardening, TLS certificate management. Analyzes network traffic for signs of application-layer attacks (SQLi over HTTP, SSRF, DNS exfiltration). Integrates IDS/IPS alerts with application security monitoring workflows.

Defines team-level network security strategy for application environments: standardizes WAF policies, establishes network segmentation requirements for microservice deployments, and drives adoption of zero-trust network access for internal services. Coordinates with infrastructure teams on IDS/IPS tuning and ensures network security controls are integrated into CI/CD pipelines and deployment workflows.

Shapes organization-wide network security architecture for application ecosystems: defines zero-trust network policies across all business units, establishes enterprise WAF and DDoS mitigation standards, and drives convergence of network and application security monitoring into unified platforms. Influences industry practices through publications on network-layer application protection and evaluates emerging technologies like SASE and SD-WAN security frameworks.

Understands basic Secrets Management concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Integrates secrets management into application security workflows: scans codebases for hardcoded secrets (TruffleHog, git-secrets), reviews Vault policies for least-privilege access, and validates secret rotation procedures. Conducts security code reviews focusing on credential handling patterns.

Defines application security standards for secrets management across the organization. Establishes secret scanning policies, credential handling guidelines, and incident response procedures for secret compromise. Drives adoption of centralized secrets management and zero-trust credential patterns. Trains security champions on secrets-related threat modeling.

Defines enterprise application security strategy for secrets and credential management. Shapes organizational zero-trust architecture incorporating secrets management as a core pillar. Drives industry compliance frameworks integration (SOC2, PCI-DSS, HIPAA) for credential handling. Represents the organization in security community on secrets management practices.

Supply Chain Security 1

▼

Understands basic Supply Chain Security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Applies SBOM and supply chain security practices in CI/CD pipelines: integrates SCA tools (Snyk, Grype, Trivy), enforces license policies, and automates vulnerability patching workflows. Conducts security reviews of dependency trees and evaluates third-party component risks for production applications.

Defines supply chain security strategy: establishes SBOM generation standards, SCA tool governance, and dependency management policies across the organization. Coordinates incident response for supply chain compromises. Trains development teams on secure dependency practices and SLSA framework adoption.

Defines enterprise supply chain security architecture: shapes SBOM standardization across business units, evaluates emerging provenance technologies (SLSA, VEX, SCITT), and drives regulatory compliance strategy. Represents the organization in industry security groups and influences supply chain security standards.

Technical Documentation 1

▼

Understands the purpose of runbooks and playbooks for security incident response. Follows existing runbooks during incidents, documenting steps taken. Assists in maintaining runbook repositories and updating known procedure changes.

Independently writes runbooks for application security incident response: vulnerability disclosure handling, SAST/DAST alert triage, dependency vulnerability remediation. Understands trade-offs between automation and manual steps in security playbooks.

Defines runbook strategy for the application security program: standardizes playbook templates across security teams, establishes runbook review and update cadences, integrates runbook metrics into security KPIs. Drives adoption of executable runbooks with SOAR platform integration.

Defines Runbook and Playbook Writing strategy at the organizational level. Shapes enterprise approaches. Mentors leads and architects.

Additional skills (optional) 35

These skills do not affect the main grade but show the breadth of your profile.

AI Coding Assistants

▼

Understands basic GitHub Copilot usage for security work: leveraging suggestions for security scanner scripts, using Copilot Chat for secure coding pattern questions, critically reviewing completions for security-sensitive code. Follows team guidelines for evaluating AI-generated code for vulnerability risks.

Independently configures GitHub Copilot for security workflows: crafts prompts for security scanning scripts, evaluates completions for vulnerability patterns and false positives, uses Copilot Chat for threat modeling assistance. Understands trade-offs between AI-assisted coding speed and security review thoroughness.

Defines GitHub Copilot security strategy at the product level: establishes security review requirements for AI-generated code, designs vulnerability scanning integration for Copilot outputs, drives adoption of secure AI-assisted development practices across engineering teams.

Algorithms & Data Structures

▼

Understands basic algorithmic concepts for AppSec: simple pattern matching for vulnerability detection, basic hash comparison for integrity checks, sorting findings by risk level. Follows team guidance on algorithm selection for security scanning scripts.

Independently applies algorithmic thinking in security: evaluates pattern matching algorithm efficiency for scanners, understands graph traversal for permission analysis, selects appropriate hashing algorithms for integrity checks. Analyzes computational complexity of security scanning operations.

Defines standards for Algorithms and Complexity usage at the team/product level. Conducts architectural reviews. Creates best practices and training materials for the entire team.

Understands basic data structures for application security: vulnerability record formats, finding lists, configuration structures for SAST/DAST tools. Follows team conventions for organizing security scan configurations and vulnerability tracking data.

Independently selects appropriate data structures for security tools: hash sets for IP/domain blocklists, lookup tables for vulnerability signatures, tree structures for permission hierarchies. Understands trade-offs between data structure choices for scan performance vs memory usage.

Defines Data Structures usage standards at the team/product level. Conducts architectural reviews. Creates best practices and training materials for the entire team.

API Management

▼

Uses Postman and curl to send basic API requests and verify security headers (CORS, CSP, X-Frame-Options). Understands REST API structure and can identify missing authentication on endpoints. Follows checklists to test common API vulnerabilities from OWASP API Top 10.

Conducts systematic API security testing using Burp Suite and custom Postman scripts. Tests for BOLA/IDOR, mass assignment, rate limiting bypass, and JWT manipulation. Analyzes OpenAPI specs to map attack surface and identify unprotected or overly permissive endpoints. Automates repetitive security checks with collection runners.

Defines API strategy at the product level. Establishes design standards. Conducts API design reviews. Coordinates cross-team API interactions.

Defines the organization's API strategy. Designs platform APIs. Shapes enterprise API governance and standards.

Understands rate limiting fundamentals from security perspective: token bucket and sliding window algorithms, HTTP 429 responses, and retry-after headers. Follows team patterns for testing rate limiting configurations and identifying bypass vulnerabilities.

Independently designs rate limiting security controls: distributed rate limiting with Redis/Memcached, API key-based quotas, and adaptive throttling based on threat signals. Implements rate limiting bypass detection and abuse pattern monitoring.

Defines API strategy at the product level. Establishes design standards. Conducts API design reviews. Coordinates cross-team API interactions.

Defines the organization's API strategy. Designs platform APIs. Shapes enterprise API governance and standards.

Application Security

▼

Understands basic OWASP and application security concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Applies OWASP Top 10 and application security practices to secure development workflows. Conducts security-focused code reviews identifying injection, authentication, and access control vulnerabilities. Uses SAST/DAST tools (SonarQube, Burp Suite, OWASP ZAP) for automated vulnerability scanning and triage.

Defines application security strategy aligned with OWASP frameworks across product portfolios. Establishes security policies for secure SDLC, vulnerability management SLAs, and security training programs. Coordinates cross-team incident response for application security breaches and trains development teams on threat modeling.

Defines enterprise application security strategy shaping security architecture across all product domains. Coordinates organizational compliance programs (SOC2, ISO 27001, PCI DSS) integrating OWASP frameworks. Represents the organization in security communities and drives industry-level security standards adoption.

Understands basic Secure Coding Practices concepts. Follows security guidelines. Recognizes typical code vulnerabilities.

Applies secure coding practices in application security workflows — conducts in-depth security code reviews identifying injection, authentication, and cryptographic weaknesses. Uses SAST tools (Semgrep, CodeQL) for automated vulnerability detection and develops custom security rules for organization-specific risk patterns.

Defines enterprise secure coding strategy across all development teams. Establishes security policies for SDLC integration, secure coding standards adoption, and automated security gate enforcement. Coordinates cross-team incident response for code-level security vulnerabilities and trains development teams on security-first coding culture.

Defines enterprise secure coding strategy shaping security architecture and development practices across all technology platforms. Coordinates organizational compliance programs integrating secure coding standards with SOC2, ISO 27001, and PCI DSS requirements. Represents the organization in security standards bodies and industry security communities.

Caching

▼

Understands basics of Redis from a security perspective — authentication mechanisms, data encryption at rest, and network exposure risks. Reviews Redis configurations for common security misconfigurations. Follows team guidelines for security assessment of Redis deployments.

Conducts security audits of Redis configuration: ACL verification, TLS encryption, network isolation. Identifies vulnerabilities in application Redis usage: session fixation, cache poisoning, data leakage.

Defines Redis security standards for the organization, including hardening guides and compliance requirements. Implements automated Redis configuration checks in the deployment process.

CI/CD

▼

Understands basic GitHub Actions for security work: running SAST/DAST scans in CI pipelines, reading security scan results from workflow outputs, understanding action configurations for security tools. Follows team conventions for security scanning pipeline integration.

Independently creates GitHub Actions workflows for security: configures SAST/DAST/SCA scanning pipelines, implements secret detection and dependency audit steps, automates security compliance checks in CI. Manages security-focused CI/CD configurations.

Defines DevSecOps strategy with GitHub Actions: establishes CI/CD security standards across teams, implements platform-level security scanning integration, drives adoption of supply chain security controls in all deployment pipelines.

Clean Code & Refactoring

▼

Understands basic code quality principles with security awareness. Follows team secure coding guidelines and SAST tool recommendations. Writes simple, readable security validation code. Accepts code review feedback on input handling and authentication patterns.

Independently applies code quality practices with security focus. Identifies insecure patterns during code review: injection risks, improper input validation, broken auth flows. Understands trade-offs between security hardening and developer experience. Refactors security-sensitive modules for auditability.

Defines Code Quality and Refactoring usage standards at the team/product level. Conducts architectural reviews. Creates best practices and training materials for the entire team.

Cloud Providers

▼

Code Review

▼

Understands basic security-focused code review: identifying common vulnerabilities (XSS, SQLi, IDOR), checking authentication/authorization patterns, reviewing input validation. Follows OWASP-based security review checklists.

Independently conducts security-focused code reviews: evaluates authentication/authorization implementations, reviews cryptographic usage patterns, checks input validation and output encoding. Provides constructive feedback on security patterns and vulnerability mitigation.

Defines security code review strategy: security review standards integration into development workflow, vulnerability detection review governance, secure coding review practices. Establishes security review culture across engineering teams.

Concurrency & Parallelism

▼

Containerization

▼

Understands basic Docker concepts for security work: containerized security scanning tools, Docker images for vulnerability assessment environments, basic docker-compose for isolated testing labs. Uses ready-made configurations for security tooling containers.

Independently configures Docker for security work: containerized SAST/DAST scanning environments, docker-compose for isolated vulnerability testing labs, Dockerfile hardening practices. Understands container security scanning, image vulnerability assessment, and network isolation for security tooling.

Defines Docker security strategy: container image supply chain governance, runtime security monitoring standards, container hardening and compliance frameworks. Conducts architecture reviews for container security posture and establishes vulnerability scanning SLAs.

Distributed Tracing

▼

Understands basics of OpenTelemetry from a security observability perspective. Follows team guidelines for analyzing distributed traces to detect anomalous request patterns and unauthorized access attempts. Reads telemetry data to support security event investigation and incident correlation.

Configures OpenTelemetry for collecting security telemetry: authentication tracing, rejected request metrics, security event logs. Creates custom spans for monitoring security-critical operations.

Defines security observability standards based on OpenTelemetry for the organization. Implements mandatory security event instrumentation and coordinates integration with SOC and incident response.

Git & Workflows

▼

Understands basic Git advanced features for security work: bisect for finding vulnerability-introducing commits, blame for tracing security-sensitive code changes, signed commits for audit trails. Follows team conventions for security-related branching and tagging.

Independently uses Git advanced features for security workflows: automated security checks via Git hooks (pre-commit secret scanning), bisect for efficient vulnerability root cause analysis, reflog for incident investigation and recovery. Understands trade-offs between different branching models for secure SDLC compliance.

Defines Git security strategy for the product: establishes commit signing policies and verification workflows, designs repository security scanning pipelines, drives adoption of secure branching and access control patterns across development teams.

GraphQL

▼

Understands basics of GraphQL from a security perspective — query depth limits, introspection risks, and authorization patterns. Reviews simple GraphQL schemas for common vulnerabilities. Follows team guidelines for security testing of GraphQL endpoints.

Conducts security audits of GraphQL APIs: checks depth limiting, query complexity, field-level and resolver authorization. Identifies vulnerabilities in GraphQL service schemas and implementations.

Defines security standards for the organization's GraphQL APIs: mandatory protective mechanisms, audit logging, schema validation. Coordinates implementation of security best practices in GraphQL development.

Integration Testing

▼

Kubernetes & Orchestration

▼

Understands basic Kubernetes security concepts — pod security standards, RBAC, and network policies. Reviews existing cluster configurations for common security misconfigurations. Performs basic security assessments of container images and deployment manifests under guidance.

Independently configures Kubernetes security controls — pod security policies, OPA/Gatekeeper constraints, and network segmentation. Writes IaC for security-hardened cluster configurations and admission controllers. Understands Kubernetes networking for zero-trust service mesh and workload identity management.

Defines Kubernetes security strategy across the organization's cluster fleet. Establishes IaC standards for pod security, network segmentation, and runtime protection. Conducts architecture reviews of cluster configurations and drives adoption of zero-trust security patterns across engineering teams.

Logging

▼

Understands the fundamentals of ELK Stack (Elasticsearch, Logstash, Kibana). Reads security-related logs in Kibana, applies basic KQL queries to filter events. Follows team guidelines for log ingestion pipelines and index naming conventions.

Configures ELK Stack pipelines for application security monitoring. Builds Logstash filters to parse WAF, RASP, and DAST tool outputs. Creates Kibana dashboards for vulnerability trend analysis and OWASP Top 10 coverage. Sets up Elasticsearch alerts for suspicious patterns such as injection attempts and privilege escalation.

Defines product observability strategy. Establishes SLO-based approach. Coordinates incident management. Optimizes MTTD/MTTR.

Defines the organization's observability strategy. Implements platform solutions. Shapes reliability culture. Defines enterprise SLO framework.

Understands basic structured logging for security work: security event logging formats and standards, audit trail logging requirements, reading structured logs for security incident detection. Follows team conventions for security-relevant logging patterns and compliance requirements.

Configures structured logging for security monitoring: implements security event logging pipelines, creates SIEM dashboards for threat detection, sets up alerts for suspicious activity patterns. Participates in security incident response using log-based forensics.

Defines security observability strategy at the product level: establishes SLO-based approach for security monitoring coverage, coordinates security incident management and response processes, optimizes MTTD/MTTR for security events through improved detection pipelines.

Metrics & Monitoring

▼

Understands basic Prometheus & Grafana for security monitoring: reading security-relevant dashboards (auth failures, rate limiting), understanding metric types for security event tracking, navigating Grafana panels for security alerting. Follows team conventions for security metric monitoring.

Configures Prometheus and Grafana for security monitoring: implements custom metrics for security event tracking, creates security-focused dashboards with anomaly detection panels, sets up alerts for authentication failures and rate limit violations. Analyzes security incidents using metric correlation.

Defines security observability strategy at the product level with Prometheus & Grafana: establishes SLO-based approach for security monitoring, coordinates security incident management, optimizes MTTD/MTTR for security events through improved detection and alerting pipelines.

Networking

▼

Understands HTTP/HTTPS, DNS basics, TCP vs UDP. Knows what ports, IP addresses, and localhost are. Can use curl for API testing.

Understands the TCP/IP stack. Configures TLS/SSL. Works with load balancers and reverse proxies (nginx). Understands DNS resolution and TTL. Debugs network issues (tcpdump, wireshark basics).

Designs network security architecture for production application environments — VPC network segmentation, zero-trust micro-segmentation, and WAF rule engineering. Configures service mesh security policies with mTLS and authorization rules. Understands gRPC/HTTP2/HTTP3 security implications and designs DNS security strategies including DNSSEC. Optimizes network-level security controls for application performance.

OOP & Design Patterns

▼

Understands basic OOP concepts in Python/Go: classes, interfaces, encapsulation. Applies simple SOLID principles when writing security scanning tools. Follows team patterns for vulnerability scanner module structure and report generator class design.

Independently applies OOP/SOLID in security tooling development: encapsulated scanner modules, interface-based vulnerability detector plugins, single responsibility in security rule engines. Understands trade-offs between OOP patterns for extensible security frameworks.

Defines OOP and SOLID Principles usage standards at the team/product level. Conducts architectural reviews. Creates best practices and training materials for the entire team.

Prompt Engineering

▼

Uses AI tools to assist with security code analysis and vulnerability detection. Formulates prompts to generate security test cases and review configurations. Understands limitations of AI-generated security recommendations.

Creates advanced prompts for security tasks: code vulnerability analysis, SAST/DAST rule generation, threat model composition. Applies few-shot and chain-of-thought for complex security analyses.

Defines AI-assisted security review strategy for the organization with a library of validated prompts. Trains the security team on effective LLM usage considering code confidentiality.

Relational Databases

▼

Understands basic PostgreSQL security concepts: SQL injection detection and prevention, database access control basics (roles, privileges), connection security (SSL/TLS). Follows team conventions for security assessment of PostgreSQL configurations.

Implements PostgreSQL security hardening: row-level security, data encryption at rest, audit logging configuration. Reviews SQL queries for SQL injection and data leakage vulnerabilities.

Defines database security standards for the organization: encryption policies, credential rotation, backup security. Establishes compliance requirements for storing sensitive data in PostgreSQL.

REST API

▼

Understands basic REST API concepts from security perspective: common API vulnerabilities (IDOR, broken auth), API authentication mechanisms, OWASP API Security Top 10 basics. Follows team conventions for security testing of API endpoints.

Independently reviews REST API security: authentication/authorization implementation review, input validation for API endpoints, rate limiting and abuse prevention patterns. Understands best practices for API security testing and OWASP API Security Top 10 mitigation.

Defines API security strategy at product level: API security standards and compliance requirements, API threat modeling governance, security testing integration for API CI/CD. Conducts API security architecture reviews and establishes vulnerability management for APIs.

Specialized Testing

▼

Understands security testing fundamentals: OWASP Top 10 vulnerabilities, basic SAST/DAST tool usage (SonarQube, OWASP ZAP), and security test case design. Runs automated security scans and reports findings. Follows team guidelines for secure coding verification and vulnerability triage.

Independently conducts application security testing: custom SAST rule creation, DAST scan configuration for complex applications, and interactive security testing (IAST). Performs manual code review for security-critical components. Creates security test automation for CI/CD pipelines. Covers edge cases in authentication, authorization, and data validation.

Defines security testing strategy across the organization. Establishes SAST/DAST/IAST standards, security testing quality gates, and DevSecOps practices. Drives adoption of shift-left security testing culture. Creates security testing COE and trains security champions across engineering teams.

Defines the organization's QA strategy. Shapes quality engineering culture. Implements platform testing solutions.

System Design

▼

Unit Testing

▼

Understands basic unit testing for security tools: pytest/unittest for scanner modules, test fixtures for vulnerability detection rules, assertion patterns for security findings. Follows team practices for testing security tooling code.

Develops unit tests for security components: authentication, authorization, data encryption. Applies mocks and stubs for testing integrations with identity providers and secret stores.

Defines unit testing standards for security code across the entire organization, including coverage and quality metrics. Implements mandatory security functionality testing in the code review process.