Application Security 5
▼
Configures Snyk and Dependabot for automated project dependency scanning. Studies CVE reports, understands CVSS vulnerability scoring. Updates vulnerable dependencies through Dependabot auto-merge for patch versions. Uses npm audit and pip audit for local checks.
Integrates Snyk into CI/CD with build-blocking policy for critical CVEs (CVSS 9+). Configures Dependabot with update grouping and scheduled runs. Manages .snyk policy files for justified exceptions. Analyzes transitive dependencies and license compliance through FOSSA.
Defines corporate Software Composition Analysis (SCA) policy. Manages Snyk at organizational level with management reporting. Builds metrics: average CVE patching time, vulnerable dependency count, compliance score. Integrates SCA into software procurement processes.
Designs third-party component risk management strategy at enterprise scale. Introduces Supply Chain Security: SLSA framework, artifact provenance, policy-as-code for dependencies. Defines architectural principles for minimizing dependency surface area.
Studies OWASP Top 10 vulnerabilities: SQL injections, XSS, CSRF, SSRF. Completes OWASP WebGoat and Juice Shop labs. Uses OWASP Cheat Sheets for understanding basic web application threats. Configures OWASP Dependency-Check locally for dependency analysis.
Introduces OWASP ASVS as application security verification standard. Conducts code review against OWASP Top 10. Configures OWASP ZAP for automated DAST scanning in CI/CD. Applies OWASP Testing Guide for systematic web application vulnerability testing.
Defines application security strategy based on OWASP SAMM with maturity metrics per domain. Integrates OWASP ASVS Level 2-3 into SDLC. Manages Bug Bounty program with OWASP classification. Builds Security Champions culture in development teams.
Architecturally defines organizational application security approach through OWASP SAMM Level 3. Influences OWASP tool roadmap. Develops AppSec maturity assessment framework integrating ASVS, SAMM and OWASP Top 10 into unified risk management system.
Runs SonarQube and Semgrep locally for static code analysis. Studies SAST reports, classifies vulnerabilities by severity. Configures basic DAST scan with OWASP ZAP against test application. Understands difference between SAST, DAST and IAST approaches to security testing.
Integrates SonarQube and Semgrep into CI/CD pipelines with quality gates blocking merge on critical vulnerabilities. Configures OWASP ZAP in API scanning mode with OpenAPI specification. Writes custom Semgrep rules for project-specific vulnerability patterns.
Defines AST (Application Security Testing) strategy with SonarQube Enterprise, Semgrep Pro, OWASP ZAP and Burp Suite. Manages AppSec engineering team. Builds SAST/DAST effectiveness metrics: detection time, false positive rate, coverage. Integrates results into Defect Dojo.
Designs corporate security testing architecture unifying SAST, DAST, IAST, SCA and fuzzing into a single pipeline. Defines standards for dozens of teams. Evaluates and introduces innovative approaches: AI-driven SAST, semantic code analysis, runtime protection.
Studies secure coding principles: input validation, parameterized queries, proper password hashing (bcrypt/Argon2). Applies encoding for XSS prevention. Uses OWASP Secure Coding Practices Quick Reference Guide in daily development.
Introduces secure coding practices in the team: Content Security Policy, CORS configuration, secure session handling. Configures pre-commit hooks with Semgrep for blocking insecure patterns. Conducts security review of pull requests. Implements SSRF and path traversal protection.
Defines secure development standards at the organizational level. Manages Security Champions program, training team leads to conduct security reviews. Integrates secure coding guidelines into IDE through SonarLint. Builds code security quality metrics by teams and projects.
Shapes secure development culture at organizational scale. Designs Secure-by-Default framework architecture minimizing the possibility of creating vulnerable code. Defines Shift Left Security strategy. Integrates secure coding into hiring and engineer evaluation processes.
Studies STRIDE and DREAD threat modeling methodologies. Participates in threat modeling sessions under senior engineer guidance. Documents identified threats in standard format. Uses OWASP Threat Dragon for visualizing DFD data flow diagrams.
Independently conducts threat modeling for microservices using STRIDE. Builds Data Flow Diagrams, identifies trust boundaries and attack surfaces. Applies Microsoft Threat Modeling Tool for systematic analysis. Prioritizes threats by DREAD model and creates mitigation plans.
Defines organizational threat modeling strategy with integration into architectural reviews. Manages threat model library for common architectural patterns. Introduces threat modeling as code with threatspec. Builds metrics: system coverage, time to mitigation, threat recurrence.
Designs scalable threat modeling framework for the entire organization, including automation, threat libraries and risk management integration. Develops threat intelligence program. Influences architectural decisions based on systematic threat landscape analysis.
Authentication & Authorization 2
▼
Studies JWT basics: token structure (header, payload, signature), signing algorithms (HS256, RS256). Configures OAuth 2.0 Authorization Code flow for web application. Understands difference between access token and refresh token. Uses jwt.io for token debugging and validation.
Implements OAuth 2.0 with PKCE for SPA and mobile applications. Configures Keycloak/Auth0 as Identity Provider with OIDC support. Introduces secure token storage (HttpOnly cookies, token rotation). Implements rate limiting and token revocation. Configures scope-based authorization.
Defines Identity Management strategy for the organization. Manages IAM platform with SSO for all corporate applications. Builds Zero Trust authentication with continuous verification. Integrates IdP with HR systems for automated provisioning/deprovisioning. Defines token standards.
Architecturally designs corporate Identity platform for multi-cloud environment. Develops Decentralized Identity strategy. Defines cryptographic standards for tokens and certificates. Influences industry authentication standards through working group participation and publications.
Studies access control models: RBAC (Role-Based), ABAC (Attribute-Based), DAC and MAC. Configures basic RBAC in application with admin, editor, viewer roles. Applies Kubernetes RBAC with Roles and ClusterRoles. Understands least privilege and separation of duties principles.
Implements hierarchical RBAC with role inheritance and permission boundaries. Introduces ABAC with Open Policy Agent (OPA) for context-dependent access decisions. Configures AWS IAM policies with conditions for ABAC. Creates access change audit system. Implements just-in-time access.
Defines access management strategy for the organization. Introduces Identity Governance and Administration (IGA). Builds periodic access review and certification processes. Manages centralized policy engine with self-service for teams. Integrates RBAC/ABAC with SOC 2 and GDPR compliance requirements.
Architecturally defines Zero Trust Access model for the enterprise. Designs Policy Decision Point (PDP) architecture for microservices platform. Develops access management maturity assessment framework. Defines RBAC/ABAC integration standards with data classification and DLP systems.
CI/CD 1
▼
Creates .gitlab-ci.yml with basic stages: build, test, deploy. Configures GitLab SAST and Dependency Scanning in pipeline. Uses GitLab Container Registry for image storage. Applies protected branches and merge request approvals. Understands GitLab runners and pipeline triggers.
Develops multi-stage GitLab CI pipelines with security scanning: SAST, DAST, Container Scanning, License Compliance. Configures GitLab Auto DevOps with review apps. Introduces parent-child pipelines for complex deployments. Manages GitLab runners with Docker executor and security isolation.
Defines CI/CD strategy on GitLab for the organization. Manages GitLab Premium/Ultimate with SAML SSO and audit events. Builds GitOps workflow with GitLab Agent for Kubernetes. Introduces compliance framework with mandatory pipeline stages. Optimizes pipeline performance and runner fleet management.
Architecturally defines DevSecOps platform based on GitLab. Designs multi-tenant CI/CD architecture. Defines GitLab migration strategy or integration with existing tools. Develops enterprise-wide CI/CD standards. Influences GitLab roadmap through customer advisory board.
Container Security 1
▼
Runs Trivy for scanning Docker images for vulnerabilities in dependencies and OS packages. Studies reports: CVE severity, fix availability, affected packages. Configures Trivy in CI/CD for automated scanning on each build. Uses Docker Scout for base image recommendation analysis.
Integrates Trivy and Grype into CI/CD pipeline with policy gates: blocking Critical/High CVE. Configures scanning in container registry (Harbor) on push. Introduces Falco for runtime anomaly detection in containers. Implements image signing with Cosign and attestation through in-toto.
Defines container security strategy for multi-cluster platform. Manages container security team. Builds metrics: vulnerability density by teams, time-to-fix, coverage. Integrates container security with compliance framework (CIS Benchmark). Introduces container forensics capability.
Architecturally designs enterprise container security platform covering the entire lifecycle: source, build, registry, deploy, runtime. Defines standards for confidential containers. Develops Zero Trust strategy for container workloads. Influences container security tool roadmap.
Deployment Strategies 2
▼
Studies blue-green deployment concept: two identical environments, instant traffic switching. Configures blue-green through AWS ALB target groups. Understands benefits: zero downtime, instant rollback. Practices switching between blue and green environments in staging.
Implements blue-green deployment in Kubernetes with ArgoCD Rollouts. Configures health checks and automated rollback on metric degradation. Introduces database migration strategy for both-version compatibility. Automates smoke tests during switching. Configures monitoring of both environments for comparison.
Defines zero-downtime deployment strategy for the organization. Manages deployment platform supporting blue-green, canary and rolling updates. Builds deployment safety metrics: change failure rate, rollback frequency, MTTR. Introduces deployment windows and change management for regulated environments.
Architecturally defines enterprise deployment strategy. Designs multi-regional blue-green deployment for mission-critical systems. Defines deployment safety standards for dozens of teams. Develops deployment practices maturity assessment framework. Influences organizational SRE culture.
Studies canary deployment concept: gradual rollout to a percentage of traffic with monitoring. Configures simple canary through Kubernetes with two Deployments and weighted routing. Monitors metrics (error rate, latency) during canary phase. Understands promote or rollback criteria.
Implements canary deployment with ArgoCD Rollouts and Istio/Nginx for traffic splitting. Configures analysis templates: Prometheus queries for automated canary evaluation (error rate < 1%, p99 < 500ms). Introduces progressive delivery: 5% → 25% → 50% → 100% with automated analysis at each step.
Defines Progressive Delivery strategy with canary as primary deployment pattern. Manages canary deployment platform for all teams. Builds effectiveness metrics: canary duration, auto-rollback rate, detection accuracy. Introduces canary for infrastructure changes, not just application deployments.
Architecturally defines Progressive Delivery approach for multi-service platform. Designs unified deployment pipeline: build → canary → promote → full rollout with automated quality gates. Defines SLO-based deployment decision standards. Develops continuous verification framework for production.
Incident Management 1
▼
Participates in on-call rotation: responds to PagerDuty/OpsGenie alerts, follows runbooks for typical incidents. Documents actions and results. Understands escalation procedures. Studies basic security incidents: compromised credentials, suspicious login, certificate expiration. Maintains incident log.
Configures on-call processes for security incidents: escalation policies, severity classification, notification channels. Creates runbooks for security on-call: credential compromise, DDoS, data breach, ransomware. Integrates PagerDuty with SIEM alerts. Conducts weekly on-call review and trend analysis.
Defines incident management strategy for the security organization. Manages SOC team with 24/7 coverage. Builds metrics: MTTA, MTTD, MTTR, false positive rate. Introduces post-incident review processes with actionable improvements. Coordinates with legal, PR, management during major incidents.
Architecturally designs enterprise Incident Response and Cyber Resilience program. Defines SOC strategy: automation level, staffing model, tooling. Develops Business Continuity Plan considering cyber threats. Builds IR maturity metrics for board-level reporting. Influences security budget.
Incident Response 2
▼
Studies incident response fundamentals: NIST phases (Preparation, Detection, Containment, Eradication, Recovery). Participates in on-call rotation under senior engineer mentorship. Documents incidents in tracking system. Masters basic tools: PagerDuty, OpsGenie, Slack incident bot.
Independently manages incidents as Incident Commander for P2/P3 incidents. Conducts security incident investigation with log analysis (ELK). Creates runbooks for common incidents: compromised credentials, DDoS, data breach. Configures automated alerts and escalation policies in PagerDuty.
Defines Incident Response strategy for the organization. Manages IR team and SOC. Builds processes for interaction with regulators and law enforcement during breach. Introduces IR metrics: MTTD, MTTR, incident count by severity. Conducts regular Red Team / Blue Team exercises.
Designs corporate Incident Response and Cyber Resilience program. Defines SOC strategy: in-house vs MSSP, automation through SOAR, threat intelligence integration. Develops Business Continuity Plan considering cyber risks. Influences organizational security budget and roadmap.
Studies vulnerability management process: scanning, prioritization, patching. Runs Nessus/OpenVAS for basic infrastructure scanning. Understands CVSS scoring and vulnerability classification. Tracks CVEs in NVD. Creates tickets for vulnerability remediation with description and fix guidance.
Introduces regular vulnerability scanning for all infrastructure through Qualys/Rapid7 InsightVM. Configures remediation SLAs: Critical 24h, High 7d, Medium 30d. Integrates scan results with Jira for automated ticket creation. Builds dashboards with vulnerability trends.
Defines Vulnerability Management strategy for the organization. Manages VM program with CISO and board reporting. Builds maturity metrics: coverage, SLA compliance, mean time to remediate. Coordinates vulnerability disclosure program. Integrates VM with GRC platform.
Architecturally designs corporate Vulnerability Management program as part of Cyber Risk Management. Defines Exposure Management strategy unifying VM, ASM, CSPM. Develops risk quantification model for vulnerabilities. Influences organizational security budget and investment.
Infrastructure Security 4
▼
Studies AWS Security Hub, IAM best practices, S3 bucket policies. Configures MFA for root account and IAM users. Applies AWS Config rules for basic compliance. Uses ScoutSuite for automated cloud account security audit and misconfiguration detection.
Introduces AWS Security Hub with CIS and PCI DSS standards enabled. Configures GuardDuty for threat detection, AWS Config for continuous compliance. Implements landing zone with Control Tower and SCPs. Manages IAM through Terraform with enforced MFA and session policies.
Defines cloud security strategy for multi-cloud environment (AWS, GCP, Azure). Manages Cloud Security team. Builds Cloud Governance Framework with automated enforcement. Integrates CSPM, CWPP and CIEM into unified platform. Reports to CISO on cloud risk posture.
Architecturally defines enterprise cloud security approach. Develops Cloud Security Reference Architecture. Defines Zero Trust strategy for cloud workloads. Influences cloud provider selection considering compliance and data sovereignty requirements.
Studies Kubernetes security fundamentals: RBAC, ServiceAccount, SecurityContext. Configures Pod Security Standards (Restricted). Runs Trivy for image scanning in cluster. Applies NetworkPolicies for basic pod segmentation. Understands least privilege principles for containers.
Introduces OPA Gatekeeper with constraint templates for Policy-as-Code in cluster. Configures Falco for runtime anomaly detection in containers. Implements image signing with Cosign and verification through Kyverno. Manages Kubernetes RBAC with ClusterRoles following minimal access principle.
Defines Kubernetes security strategy for multi-cluster platform. Manages platform security team. Builds GitOps process with automated security policy enforcement. Integrates Kubernetes audit logs with SIEM. Develops incident response playbooks for container environments.
Architecturally defines enterprise container platform security approach. Designs Zero Trust networking for service mesh (Istio mTLS). Develops container security maturity assessment framework. Influences strategy for transitioning to confidential computing.
Studies network security fundamentals: firewall rules, VPN, TLS/SSL. Configures Security Groups and NACLs in AWS. Understands Defense in Depth and network segmentation principles. Uses Wireshark for basic traffic analysis. Configures HTTPS with Let's Encrypt for web applications.
Designs network architecture with DMZ, private subnets and NAT gateways. Configures WAF (AWS WAF / ModSecurity) with rules against OWASP Top 10. Introduces VPN (WireGuard/IPSec) for site-to-site and remote access. Monitors network anomalies through VPC Flow Logs and AWS Traffic Mirroring.
Defines network security strategy for the entire organization. Manages SASE/SSE solution deployment (Zscaler/Cloudflare Access). Builds network security review processes for new architectures. Integrates NDR (Network Detection and Response) with SOC processes. Manages vulnerability scanning.
Architecturally defines Zero Trust Network Architecture for the enterprise. Develops strategy for transitioning from perimeter approach to identity-based security. Designs global network security for multi-regional infrastructure. Defines data encryption standards in transit and at rest.
Installs HashiCorp Vault in dev mode, studies basic operations: reading/writing secrets via CLI and API. Configures KV secrets engine v2 with versioning. Understands zero-trust principle for secrets in code. Uses Vault Agent for automated token rotation.
Deploys Vault in production with auto-unseal through AWS KMS. Configures AppRole and Kubernetes auth methods for applications. Implements dynamic secrets for PostgreSQL and AWS IAM. Manages Vault policies with least privilege principle. Integrates Vault with Terraform through provider.
Defines corporate secrets management strategy with Vault as central component. Manages Vault platform team. Builds team onboarding processes for Vault with self-service portal. Integrates Vault audit logs with SIEM for monitoring secret access and anomaly detection.
Architecturally designs Zero Trust secrets management for the entire organization. Defines encryption, rotation and secret audit standards. Develops secrets management maturity assessment framework. Influences industry practices through publications and conference presentations.
Kubernetes & Orchestration 2
▼
Creates Helm charts for application deployment with values.yaml for configuration. Uses helm template for local debugging. Configures Security Context in charts: runAsNonRoot, readOnlyRootFilesystem, drop capabilities. Scans charts via helm lint and kubeaudit for misconfiguration detection.
Develops library Helm charts with secure defaults: Pod Security Standards, Network Policies, Resource Limits. Introduces Helm secrets (SOPS) for encrypting sensitive values. Configures chart testing in CI with ct (chart-testing) and Polaris. Versions charts in OCI-compatible registry.
Defines application packaging and deployment strategy through Helm with security-first approach. Manages chart repository and review process. Builds self-service platform for teams with pre-hardened chart templates. Integrates Helm chart compliance checking into GitOps pipeline.
Architecturally defines Kubernetes application packaging standards for the organization. Designs platform engineering approach with secure-by-default Helm charts. Develops Helm chart security assessment framework. Defines migration strategy to Helm + Kustomize for multi-tenant platform.
Studies advanced Kubernetes concepts: Custom Resources, Operators, admission webhooks. Configures Pod Disruption Budgets and Priority Classes. Applies Horizontal Pod Autoscaler. Uses kubectl debug for pod troubleshooting. Understands etcd and control plane principles.
Develops Kubernetes Operators with Operator SDK for operations automation. Configures admission webhooks (validating/mutating) for security policy enforcement. Introduces Vertical Pod Autoscaler and KEDA for event-driven scaling. Manages Custom Resources for extending cluster API.
Defines Kubernetes platform architecture for the organization. Manages platform engineering team. Builds Internal Developer Platform (IDP) with self-service and guardrails. Introduces GitOps with ArgoCD/Flux for all environments. Defines multi-tenancy standards and resource quotas.
Architecturally designs enterprise Kubernetes platform: multi-cluster, multi-region, multi-cloud. Defines Platform Engineering strategy for the organization. Develops reference architecture for secure container platform. Influences investment in platform tools and teams.
Logging 1
▼
Installs ELK Stack (Elasticsearch, Logstash, Kibana) for centralized log collection. Configures Filebeat for sending application and system logs. Creates basic Kibana dashboards for log searching. Studies KQL queries for filtering and analyzing security events in logs.
Configures ELK for security monitoring: parses audit logs, VPC Flow Logs, CloudTrail through Logstash. Creates Kibana dashboards for security operations: failed logins, privilege escalation, suspicious network activity. Configures alerting through ElastAlert for critical security events. Manages index lifecycle.
Defines centralized logging and SIEM strategy for the organization. Manages Elastic Stack platform (multi-cluster, cross-cluster search). Builds SOC processes based on Elastic Security: alert triage, investigation, response. Defines retention policies and data tiering for compliance.
Architecturally designs enterprise logging and SIEM platform. Defines threat detection strategy: custom rules, ML models, threat intelligence integration. Develops data lake architecture for long-term security analytics. Evaluates Elastic vs Splunk vs cloud SIEM for optimal solution.
Networking 1
▼
Studies TCP/IP, DNS, HTTP/HTTPS basics, OSI model. Understands firewall, NAT, VPN operation. Uses nslookup, ping, traceroute, netstat for diagnostics. Configures Security Groups in AWS. Understands TLS handshake and X.509 certificate principles for connection security.
Designs cloud network architectures: VPC peering, Transit Gateway, PrivateLink. Configures DNS security (DNSSEC, DoH). Introduces mTLS between services. Analyzes network traffic with tcpdump and Wireshark for incident investigation. Configures VPN (WireGuard) for secure remote access.
Designs corporate network architecture with micro-segmentation and Zero Trust principles. Designs hybrid connectivity: Direct Connect, VPN failover. Introduces network monitoring with VPC Flow Logs analytics. Configures network-level DDoS protection. Optimizes network latency for distributed systems.
Release Management 1
▼
Studies feature flag concepts: toggle, rollout, experiment. Uses LaunchDarkly or Unleash for feature management. Configures kill switches for quickly disabling problematic features. Understands feature flags relation to safe deployment: canary releases, dark launches without user risk.
Introduces feature flag management in production with LaunchDarkly/Unleash. Implements percentage rollouts and targeted releases by user segments. Configures feature flags for A/B testing. Manages technical debt: feature flag lifecycle with enforced cleanup. Integrates flags with monitoring for correlation.
Defines corporate Progressive Delivery strategy with feature flags. Manages feature management platform for all teams. Builds governance processes: naming conventions, mandatory expiration, security review for sensitive flags. Integrates feature flags with incident response for rapid mitigation.
Architecturally defines enterprise Progressive Delivery approach. Designs feature management as part of deployment strategy: feature flags + canary + blue-green. Defines secure feature flag usage standards. Develops deployment practices maturity assessment framework for the organization.
Supply Chain Security 1
▼
Understands basic SBOM concepts: software bill of materials formats (SPDX, CycloneDX), dependency tracking, and license compliance fundamentals. Follows security guidelines for reviewing dependency vulnerabilities using automated scanning tools. Recognizes common supply chain attack vectors.
Applies Supply Chain Security in daily work. Conducts security code review. Uses scanning and analysis tools.
Defines DevSecOps supply chain security strategy: establishes SBOM automation pipelines, artifact signing policies (Sigstore, in-toto), and dependency allowlisting governance. Coordinates cross-team response to supply chain incidents. Trains teams on software provenance verification and SLSA compliance.
Defines corporate Supply Chain Security strategy: SLSA Level 3+, SBOM generation (Syft/CycloneDX) for all artifacts, in-toto attestations. Designs Sigstore integration for signing and verifying the entire software supply chain. Introduces policy-as-code for automated provenance verification.
Technical Documentation 1
▼
Creates runbooks for typical operational tasks: deployment, rollback, service restart. Documents security procedures: credential rotation, certificate renewal. Follows standard template: pre-conditions, steps, expected output, troubleshooting. Stores runbooks in Git with version control.
Develops security runbooks: incident response for common scenarios (compromised host, leaked credentials, DDoS). Creates automated runbooks through Rundeck or AWS Systems Manager. Introduces runbook testing: periodic dry runs for validation. Integrates runbooks with PagerDuty for automatic provision on alerts.
Defines documentation standards for security operations. Manages Knowledge Base with runbooks, playbooks, postmortems. Builds processes: mandatory runbook creation, periodic review, automated testing. Integrates runbooks with SOAR platform for semi-automated response. Ensures runbook coverage for all critical systems.
Architecturally defines enterprise-scale operational documentation approach. Designs knowledge management system for security team. Defines runbook-as-code standards for IR automation. Develops operational maturity assessment framework. Influences documentation culture in the organization.