AI Coding Assistants 1
▼
Uses GitHub Copilot for writing code with security awareness: checks suggestions for safety, rejects code with hardcoded secrets or SQL injections. Configures Copilot content exclusions for sensitive repositories. Understands AI-code generation limitations in security context.
Effectively uses Copilot for DevSecOps tasks: writing security automation scripts, Terraform modules, CI/CD pipelines. Configures Copilot for the organization with content exclusions and audit logs. Conducts security review of AI-generated code. Introduces AI tool usage rules in security context.
Develops AI assistant usage guidelines for the security team. Evaluates security risks of AI-generated code: supply chain, data leakage, vulnerable patterns. Introduces AI-assisted security analysis: Copilot for writing SAST rules, detection queries, incident response scripts. Trains the team.
Defines AI-coding tools usage policy for the organization from security perspective. Manages GitHub Copilot Enterprise rollout with DLP and content exclusions. Builds processes: AI code review, acceptable use policy, data protection. Evaluates ROI and security impact of AI-assisted development on engineering productivity.
Algorithms & Data Structures 2
▼
Understands basic algorithmic concepts for DevSecOps: simple pattern matching for policy checks, basic vulnerability sorting by severity, scan result filtering. Follows team guidance on algorithm selection for security automation scripts.
Independently applies algorithmic thinking in DevSecOps: evaluates vulnerability scanning algorithm efficiency, understands dependency graph traversal for security analysis, selects appropriate pattern matching algorithms for policy compliance. Analyzes trade-offs between scan thoroughness and pipeline speed.
Applies algorithmic thinking to security automation: vulnerability prioritization algorithms based on risk scoring, dependency graph traversal for transitive vulnerability analysis, pattern matching algorithms for policy compliance checking. Designs efficient scanning algorithms that minimize CI pipeline overhead.
Applies algorithmic expertise to optimize security systems: efficient SIEM log search algorithms, correlation engine rule optimization. Evaluates computational complexity of security tools for scaling. Designs efficient threat detection pipelines for processing millions of events per second.
Understands basic data structures for security pipelines: policy rule structures, scan configuration objects, compliance checklist formats. Follows team conventions for organizing security pipeline configurations and scan result handling.
Independently selects appropriate data structures for DevSecOps: vulnerability report schemas, policy rule data models, compliance evidence structures. Understands trade-offs between scan result data formats for efficient aggregation and deduplication.
Selects optimal data structures for security pipeline data: graph structures for dependency vulnerability propagation analysis, bloom filters for known-bad hash detection, indexed stores for compliance evidence. Optimizes scan result data structures for efficient deduplication and trend analysis. Designs efficient data models for security posture tracking across infrastructure.
Applies data structure knowledge for security system design: Bloom filters for IP reputation, Trie for URL filtering, Graph for threat intelligence relationships. Optimizes storage and search in vulnerability databases. Designs efficient SIEM indexes considering query patterns.
Application Security 5
▼
Configures Snyk and Dependabot for automated project dependency scanning. Studies CVE reports, understands CVSS vulnerability scoring. Updates vulnerable dependencies through Dependabot auto-merge for patch versions. Uses npm audit and pip audit for local checks.
Integrates Snyk into CI/CD with build-blocking policy for critical CVEs (CVSS 9+). Configures Dependabot with update grouping and scheduled runs. Manages .snyk policy files for justified exceptions. Analyzes transitive dependencies and license compliance through FOSSA.
Develops centralized dependency management strategy for all projects. Introduces Snyk Enterprise with custom policies and reporting. Configures private registry (Artifactory/Nexus) with automated scanning. Creates new dependency evaluation process with security and license review.
Defines corporate Software Composition Analysis (SCA) policy. Manages Snyk at organizational level with management reporting. Builds metrics: average CVE patching time, vulnerable dependency count, compliance score. Integrates SCA into software procurement processes.
Studies OWASP Top 10 vulnerabilities: SQL injections, XSS, CSRF, SSRF. Completes OWASP WebGoat and Juice Shop labs. Uses OWASP Cheat Sheets for understanding basic web application threats. Configures OWASP Dependency-Check locally for dependency analysis.
Introduces OWASP ASVS as application security verification standard. Conducts code review against OWASP Top 10. Configures OWASP ZAP for automated DAST scanning in CI/CD. Applies OWASP Testing Guide for systematic web application vulnerability testing.
Develops corporate security program based on OWASP SAMM. Configures OWASP ZAP in full scan mode with custom rules for business logic. Introduces OWASP Threat Dragon for threat modeling. Conducts OWASP Top 10 training for developers.
Defines application security strategy based on OWASP SAMM with maturity metrics per domain. Integrates OWASP ASVS Level 2-3 into SDLC. Manages Bug Bounty program with OWASP classification. Builds Security Champions culture in development teams.
Runs SonarQube and Semgrep locally for static code analysis. Studies SAST reports, classifies vulnerabilities by severity. Configures basic DAST scan with OWASP ZAP against test application. Understands difference between SAST, DAST and IAST approaches to security testing.
Integrates SonarQube and Semgrep into CI/CD pipelines with quality gates blocking merge on critical vulnerabilities. Configures OWASP ZAP in API scanning mode with OpenAPI specification. Writes custom Semgrep rules for project-specific vulnerability patterns.
Develops centralized SAST/DAST platform for all teams. Tunes SonarQube quality profiles, minimizing false positives to less than 10%. Introduces IAST (Contrast Security) for runtime analysis. Configures SAST and DAST result correlation for vulnerability prioritization.
Defines AST (Application Security Testing) strategy with SonarQube Enterprise, Semgrep Pro, OWASP ZAP and Burp Suite. Manages AppSec engineering team. Builds SAST/DAST effectiveness metrics: detection time, false positive rate, coverage. Integrates results into Defect Dojo.
Studies secure coding principles: input validation, parameterized queries, proper password hashing (bcrypt/Argon2). Applies encoding for XSS prevention. Uses OWASP Secure Coding Practices Quick Reference Guide in daily development.
Introduces secure coding practices in the team: Content Security Policy, CORS configuration, secure session handling. Configures pre-commit hooks with Semgrep for blocking insecure patterns. Conducts security review of pull requests. Implements SSRF and path traversal protection.
Develops corporate Secure Coding Guidelines for different stacks (Java, Python, Go, JS). Creates secure wrapper libraries for cryptography, authentication, sanitization. Introduces taint analysis. Conducts secure coding workshops with real vulnerability examples.
Defines secure development standards at the organizational level. Manages Security Champions program, training team leads to conduct security reviews. Integrates secure coding guidelines into IDE through SonarLint. Builds code security quality metrics by teams and projects.
Studies STRIDE and DREAD threat modeling methodologies. Participates in threat modeling sessions under senior engineer guidance. Documents identified threats in standard format. Uses OWASP Threat Dragon for visualizing DFD data flow diagrams.
Independently conducts threat modeling for microservices using STRIDE. Builds Data Flow Diagrams, identifies trust boundaries and attack surfaces. Applies Microsoft Threat Modeling Tool for systematic analysis. Prioritizes threats by DREAD model and creates mitigation plans.
Develops corporate threat modeling process integrated into SDLC. Conducts threat modeling for complex distributed systems and cloud architectures. Introduces automated threat modeling through IriusRisk. Trains teams on conducting independent threat modeling sessions.
Defines organizational threat modeling strategy with integration into architectural reviews. Manages threat model library for common architectural patterns. Introduces threat modeling as code with threatspec. Builds metrics: system coverage, time to mitigation, threat recurrence.
Authentication & Authorization 2
▼
Studies JWT basics: token structure (header, payload, signature), signing algorithms (HS256, RS256). Configures OAuth 2.0 Authorization Code flow for web application. Understands difference between access token and refresh token. Uses jwt.io for token debugging and validation.
Implements OAuth 2.0 with PKCE for SPA and mobile applications. Configures Keycloak/Auth0 as Identity Provider with OIDC support. Introduces secure token storage (HttpOnly cookies, token rotation). Implements rate limiting and token revocation. Configures scope-based authorization.
Designs corporate Identity and Access Management system. Introduces centralized IdP (Keycloak) with SAML and OIDC federation. Implements token exchange and impersonation for microservice architecture. Configures authentication pattern anomaly monitoring. Conducts JWT configuration audits.
Defines Identity Management strategy for the organization. Manages IAM platform with SSO for all corporate applications. Builds Zero Trust authentication with continuous verification. Integrates IdP with HR systems for automated provisioning/deprovisioning. Defines token standards.
Studies access control models: RBAC (Role-Based), ABAC (Attribute-Based), DAC and MAC. Configures basic RBAC in application with admin, editor, viewer roles. Applies Kubernetes RBAC with Roles and ClusterRoles. Understands least privilege and separation of duties principles.
Implements hierarchical RBAC with role inheritance and permission boundaries. Introduces ABAC with Open Policy Agent (OPA) for context-dependent access decisions. Configures AWS IAM policies with conditions for ABAC. Creates access change audit system. Implements just-in-time access.
Designs corporate access control model combining RBAC and ABAC. Introduces OPA as centralized policy engine for all services. Develops policy-as-code with versioning and CI/CD for policies. Configures policy testing and impact analysis before deploying new rules.
Defines access management strategy for the organization. Introduces Identity Governance and Administration (IGA). Builds periodic access review and certification processes. Manages centralized policy engine with self-service for teams. Integrates RBAC/ABAC with SOC 2 and GDPR compliance requirements.
CI/CD 2
▼
Creates GitHub Actions workflows for CI: build, test, lint. Configures security scanning: CodeQL, Dependabot, secret scanning. Uses actions/checkout, setup-node with pinned versions (SHA). Applies GITHUB_TOKEN with minimal permissions. Understands event triggers and job dependencies.
Develops comprehensive CI/CD pipelines with security gates: SAST (CodeQL), SCA (Dependabot), secret detection (GitLeaks), container scanning (Trivy). Configures GitHub Environments with protection rules and required reviewers. Introduces reusable workflows for standardizing security checks across repositories.
Designs GitHub Actions architecture for the organization: self-hosted runners with security hardening, network isolation. Introduces GitHub Advanced Security (GHAS) with custom CodeQL queries. Configures OIDC federation for secure AWS/GCP access without long-lived credentials. Creates custom composite actions.
Defines CI/CD strategy on GitHub for the organization. Manages GitHub Enterprise with SSO, audit logs, IP allow lists. Builds metrics: deployment frequency, lead time, MTTR, change failure rate (DORA). Introduces policy enforcement through repository rulesets and branch protection at scale.
Creates .gitlab-ci.yml with basic stages: build, test, deploy. Configures GitLab SAST and Dependency Scanning in pipeline. Uses GitLab Container Registry for image storage. Applies protected branches and merge request approvals. Understands GitLab runners and pipeline triggers.
Develops multi-stage GitLab CI pipelines with security scanning: SAST, DAST, Container Scanning, License Compliance. Configures GitLab Auto DevOps with review apps. Introduces parent-child pipelines for complex deployments. Manages GitLab runners with Docker executor and security isolation.
Designs GitLab CI/CD platform for the organization: shared runners, custom executors, pipeline efficiency. Introduces GitLab Security Dashboard for centralized vulnerability view. Configures compliance pipelines for enforced security checks. Creates CI/CD component library for reuse.
Defines CI/CD strategy on GitLab for the organization. Manages GitLab Premium/Ultimate with SAML SSO and audit events. Builds GitOps workflow with GitLab Agent for Kubernetes. Introduces compliance framework with mandatory pipeline stages. Optimizes pipeline performance and runner fleet management.
Cloud Providers 1
▼
Works with core AWS services: EC2, S3, VPC, IAM, CloudWatch. Configures IAM policies with least privilege principle. Enables CloudTrail for auditing. Applies Security Groups and NACLs for network security. Uses AWS CLI and Console for resource management. Configures MFA.
Manages AWS infrastructure through Terraform with security-first approach. Configures AWS Organizations with SCPs. Introduces GuardDuty, Security Hub, Config for continuous monitoring. Implements KMS for data encryption at rest and in transit. Configures VPC endpoints for private connectivity to AWS services.
Designs multi-account AWS architecture with Control Tower and landing zone. Configures centralized logging: CloudTrail, VPC Flow Logs, DNS logs in Security Account. Introduces AWS Firewall Manager for WAF/Shield management. Develops custom Config rules with auto-remediation through Lambda.
Defines AWS strategy for the organization. Manages cloud platform team. Builds Cloud Center of Excellence with security guardrails. Introduces AWS Well-Architected Security Pillar reviews for all workloads. Optimizes costs while maintaining security posture. Manages Reserved Instances and Savings Plans.
Code Review 1
▼
Participates in code review with security focus: looks for hardcoded secrets, SQL injections, XSS, insecure deserialization. Uses OWASP checklist for review. Leaves constructive comments with secure code examples. Learns secure code review best practices from the team.
Conducts security-focused code review for pull requests: checks authentication flows, authorization logic, input validation, cryptographic usage. Creates security review checklist for the team. Configures automated review with CodeRabbit or GitHub Copilot. Mentors junior engineers on security aspects of review.
Develops mandatory security review process for critical components. Introduces tiered review: automated (SAST) → peer review → security team review for high-risk changes. Creates security review guidelines by domain: API, auth, crypto, infra. Conducts architectural security reviews for new designs.
Defines code review standards for the organization with security as first-class concern. Manages Security Champions program: trained engineers in each team for security review. Builds metrics: review coverage, security finding rate, time-to-fix. Introduces risk-based review with automated triaging by impact.
Deployment Strategies 2
▼
Studies blue-green deployment concept: two identical environments, instant traffic switching. Configures blue-green through AWS ALB target groups. Understands benefits: zero downtime, instant rollback. Practices switching between blue and green environments in staging.
Implements blue-green deployment in Kubernetes with ArgoCD Rollouts. Configures health checks and automated rollback on metric degradation. Introduces database migration strategy for both-version compatibility. Automates smoke tests during switching. Configures monitoring of both environments for comparison.
Designs blue-green deployment strategy for multi-service architecture. Solves challenges: database schema compatibility, session management, cache warming. Introduces automated traffic shifting with rollback triggers based on SLOs. Develops runbooks for complex deployments with inter-service dependencies.
Defines zero-downtime deployment strategy for the organization. Manages deployment platform supporting blue-green, canary and rolling updates. Builds deployment safety metrics: change failure rate, rollback frequency, MTTR. Introduces deployment windows and change management for regulated environments.
Studies canary deployment concept: gradual rollout to a percentage of traffic with monitoring. Configures simple canary through Kubernetes with two Deployments and weighted routing. Monitors metrics (error rate, latency) during canary phase. Understands promote or rollback criteria.
Implements canary deployment with ArgoCD Rollouts and Istio/Nginx for traffic splitting. Configures analysis templates: Prometheus queries for automated canary evaluation (error rate < 1%, p99 < 500ms). Introduces progressive delivery: 5% → 25% → 50% → 100% with automated analysis at each step.
Designs advanced canary strategy with multi-metric analysis and machine learning anomaly detection. Introduces Flagger for automated canary deployments with custom webhooks. Configures canary for stateful services with database compatibility checks. Develops observability stack for detailed canary comparison.
Defines Progressive Delivery strategy with canary as primary deployment pattern. Manages canary deployment platform for all teams. Builds effectiveness metrics: canary duration, auto-rollback rate, detection accuracy. Introduces canary for infrastructure changes, not just application deployments.
Distributed Tracing 1
▼
Studies OpenTelemetry: traces, metrics, logs. Instruments application with OTel SDK for distributed tracing. Configures OTel Collector for telemetry collection and export. Understands W3C Trace Context for propagation between services. Visualizes traces in Jaeger or Grafana Tempo.
Implements OpenTelemetry for security observability: instruments critical security paths (auth, authz, data access). Configures custom spans with security attributes. Implements OTel Collector pipeline with processors for PII redaction. Integrates traces with logs for security event correlation through trace_id.
Designs OpenTelemetry architecture for the organization: multi-cluster collection, sampling strategies, tail-based sampling for security events. Develops security-specific instrumentation library. Introduces OTel for infrastructure telemetry: Kubernetes, cloud APIs. Configures trace-based SLO alerting.
Defines unified observability strategy through OpenTelemetry for the organization. Manages OTel deployment: Collector fleet, SDK versioning, backend integration. Builds security use cases: anomaly detection in traces, unauthorized access patterns, data flow visibility. Influences company observability roadmap.
Incident Management 1
▼
Participates in on-call rotation: responds to PagerDuty/OpsGenie alerts, follows runbooks for typical incidents. Documents actions and results. Understands escalation procedures. Studies basic security incidents: compromised credentials, suspicious login, certificate expiration. Maintains incident log.
Configures on-call processes for security incidents: escalation policies, severity classification, notification channels. Creates runbooks for security on-call: credential compromise, DDoS, data breach, ransomware. Integrates PagerDuty with SIEM alerts. Conducts weekly on-call review and trend analysis.
Develops corporate security Incident Management process: Incident Commander role, communication templates, stakeholder notification. Introduces automated triage through PagerDuty Event Intelligence. Creates tiered response: L1 (SOC), L2 (Security Engineering), L3 (Principal). Conducts GameDay exercises.
Defines incident management strategy for the security organization. Manages SOC team with 24/7 coverage. Builds metrics: MTTA, MTTD, MTTR, false positive rate. Introduces post-incident review processes with actionable improvements. Coordinates with legal, PR, management during major incidents.
Incident Response 2
▼
Studies incident response fundamentals: NIST phases (Preparation, Detection, Containment, Eradication, Recovery). Participates in on-call rotation under senior engineer mentorship. Documents incidents in tracking system. Masters basic tools: PagerDuty, OpsGenie, Slack incident bot.
Independently manages incidents as Incident Commander for P2/P3 incidents. Conducts security incident investigation with log analysis (ELK). Creates runbooks for common incidents: compromised credentials, DDoS, data breach. Configures automated alerts and escalation policies in PagerDuty.
Develops corporate Incident Response Plan per NIST SP 800-61. Conducts Tabletop Exercises for teams. Introduces IR automation through SOAR platform (Cortex XSOAR/Tines). Builds forensics capability: artifact collection, chain of custody, memory dump analysis. Conducts blameless postmortems.
Defines Incident Response strategy for the organization. Manages IR team and SOC. Builds processes for interaction with regulators and law enforcement during breach. Introduces IR metrics: MTTD, MTTR, incident count by severity. Conducts regular Red Team / Blue Team exercises.
Studies vulnerability management process: scanning, prioritization, patching. Runs Nessus/OpenVAS for basic infrastructure scanning. Understands CVSS scoring and vulnerability classification. Tracks CVEs in NVD. Creates tickets for vulnerability remediation with description and fix guidance.
Introduces regular vulnerability scanning for all infrastructure through Qualys/Rapid7 InsightVM. Configures remediation SLAs: Critical 24h, High 7d, Medium 30d. Integrates scan results with Jira for automated ticket creation. Builds dashboards with vulnerability trends.
Designs Vulnerability Management program with risk-based prioritization. Introduces Threat Intelligence enrichment (EPSS, CISA KEV) for contextual risk assessment. Configures automated remediation for common vulnerabilities. Integrates VM with CMDB for asset-aware prioritization. Conducts Red Team assessments.
Defines Vulnerability Management strategy for the organization. Manages VM program with CISO and board reporting. Builds maturity metrics: coverage, SLA compliance, mean time to remediate. Coordinates vulnerability disclosure program. Integrates VM with GRC platform.
Infrastructure as Code 1
▼
Writes basic Terraform configurations for AWS resources: VPC, EC2, S3, IAM. Uses tfsec and Checkov for scanning IaC for security misconfigurations. Manages state through remote backend (S3 + DynamoDB). Applies terraform plan for reviewing changes before apply. Uses registry modules.
Develops Terraform modules with built-in security hardening: encryption by default, least privilege IAM, logging enabled. Integrates tfsec/Checkov into CI/CD with blocking on Critical findings. Introduces Sentinel/OPA for policy-as-code. Configures Terraform Cloud/Enterprise with SSO and RBAC.
Designs corporate Terraform modules with security-first approach: secure VPC layouts, compliant storage, hardened compute. Develops Sentinel policies for SOC 2 and CIS compliance. Introduces drift detection for unauthorized change discovery. Creates self-service infrastructure with guardrails.
Defines Infrastructure-as-Code strategy for the organization. Manages Terraform Enterprise platform with workspace-based RBAC. Builds GitOps workflow for infrastructure: PR-based review, automated plan, policy check, apply. Introduces cost estimation and security scoring in pipeline. Manages module registry.
Infrastructure Security 4
▼
Studies AWS Security Hub, IAM best practices, S3 bucket policies. Configures MFA for root account and IAM users. Applies AWS Config rules for basic compliance. Uses ScoutSuite for automated cloud account security audit and misconfiguration detection.
Introduces AWS Security Hub with CIS and PCI DSS standards enabled. Configures GuardDuty for threat detection, AWS Config for continuous compliance. Implements landing zone with Control Tower and SCPs. Manages IAM through Terraform with enforced MFA and session policies.
Designs multi-account cloud security architecture with AWS Organizations. Configures centralized logging (CloudTrail, VPC Flow Logs) in Security Account. Introduces Cloud Security Posture Management (Prisma Cloud/Wiz). Develops custom Config rules with automated remediation.
Defines cloud security strategy for multi-cloud environment (AWS, GCP, Azure). Manages Cloud Security team. Builds Cloud Governance Framework with automated enforcement. Integrates CSPM, CWPP and CIEM into unified platform. Reports to CISO on cloud risk posture.
Studies Kubernetes security fundamentals: RBAC, ServiceAccount, SecurityContext. Configures Pod Security Standards (Restricted). Runs Trivy for image scanning in cluster. Applies NetworkPolicies for basic pod segmentation. Understands least privilege principles for containers.
Introduces OPA Gatekeeper with constraint templates for Policy-as-Code in cluster. Configures Falco for runtime anomaly detection in containers. Implements image signing with Cosign and verification through Kyverno. Manages Kubernetes RBAC with ClusterRoles following minimal access principle.
Designs comprehensive Kubernetes security system: admission controllers, runtime protection, network segmentation. Configures Aqua/Sysdig for full lifecycle security. Introduces eBPF-based monitoring with Cilium Tetragon. Develops cluster hardening guidelines per CIS Benchmark.
Defines Kubernetes security strategy for multi-cluster platform. Manages platform security team. Builds GitOps process with automated security policy enforcement. Integrates Kubernetes audit logs with SIEM. Develops incident response playbooks for container environments.
Studies network security fundamentals: firewall rules, VPN, TLS/SSL. Configures Security Groups and NACLs in AWS. Understands Defense in Depth and network segmentation principles. Uses Wireshark for basic traffic analysis. Configures HTTPS with Let's Encrypt for web applications.
Designs network architecture with DMZ, private subnets and NAT gateways. Configures WAF (AWS WAF / ModSecurity) with rules against OWASP Top 10. Introduces VPN (WireGuard/IPSec) for site-to-site and remote access. Monitors network anomalies through VPC Flow Logs and AWS Traffic Mirroring.
Develops corporate network security architecture: micro-segmentation, Zero Trust Network Access (ZTNA). Introduces service mesh (Istio) with mTLS for east-west traffic. Configures DDoS protection with AWS Shield Advanced. Designs secure connectivity for hybrid cloud with Transit Gateway.
Defines network security strategy for the entire organization. Manages SASE/SSE solution deployment (Zscaler/Cloudflare Access). Builds network security review processes for new architectures. Integrates NDR (Network Detection and Response) with SOC processes. Manages vulnerability scanning.
Installs HashiCorp Vault in dev mode, studies basic operations: reading/writing secrets via CLI and API. Configures KV secrets engine v2 with versioning. Understands zero-trust principle for secrets in code. Uses Vault Agent for automated token rotation.
Deploys Vault in production with auto-unseal through AWS KMS. Configures AppRole and Kubernetes auth methods for applications. Implements dynamic secrets for PostgreSQL and AWS IAM. Manages Vault policies with least privilege principle. Integrates Vault with Terraform through provider.
Designs secrets management architecture for multi-cluster environment. Configures Vault Enterprise with namespaces, performance replication and disaster recovery. Introduces PKI secrets engine for automated TLS certificate issuance. Develops legacy system secret migration strategy.
Defines corporate secrets management strategy with Vault as central component. Manages Vault platform team. Builds team onboarding processes for Vault with self-service portal. Integrates Vault audit logs with SIEM for monitoring secret access and anomaly detection.
Kubernetes & Orchestration 2
▼
Creates Helm charts for application deployment with values.yaml for configuration. Uses helm template for local debugging. Configures Security Context in charts: runAsNonRoot, readOnlyRootFilesystem, drop capabilities. Scans charts via helm lint and kubeaudit for misconfiguration detection.
Develops library Helm charts with secure defaults: Pod Security Standards, Network Policies, Resource Limits. Introduces Helm secrets (SOPS) for encrypting sensitive values. Configures chart testing in CI with ct (chart-testing) and Polaris. Versions charts in OCI-compatible registry.
Designs corporate Helm chart library with built-in security hardening per CIS Benchmark. Introduces OPA/Kyverno for validating chart values before deployment. Creates golden chart templates with mandatory security controls. Automates dependency updates in charts with vulnerability scanning.
Defines application packaging and deployment strategy through Helm with security-first approach. Manages chart repository and review process. Builds self-service platform for teams with pre-hardened chart templates. Integrates Helm chart compliance checking into GitOps pipeline.
Studies advanced Kubernetes concepts: Custom Resources, Operators, admission webhooks. Configures Pod Disruption Budgets and Priority Classes. Applies Horizontal Pod Autoscaler. Uses kubectl debug for pod troubleshooting. Understands etcd and control plane principles.
Develops Kubernetes Operators with Operator SDK for operations automation. Configures admission webhooks (validating/mutating) for security policy enforcement. Introduces Vertical Pod Autoscaler and KEDA for event-driven scaling. Manages Custom Resources for extending cluster API.
Designs multi-cluster Kubernetes platform with federation. Introduces service mesh (Istio/Linkerd) with mTLS and traffic management. Develops custom controllers for security workflow automation. Configures cluster autoscaling considering security zones. Optimizes etcd performance and backup.
Defines Kubernetes platform architecture for the organization. Manages platform engineering team. Builds Internal Developer Platform (IDP) with self-service and guardrails. Introduces GitOps with ArgoCD/Flux for all environments. Defines multi-tenancy standards and resource quotas.
Logging 2
▼
Installs ELK Stack (Elasticsearch, Logstash, Kibana) for centralized log collection. Configures Filebeat for sending application and system logs. Creates basic Kibana dashboards for log searching. Studies KQL queries for filtering and analyzing security events in logs.
Configures ELK for security monitoring: parses audit logs, VPC Flow Logs, CloudTrail through Logstash. Creates Kibana dashboards for security operations: failed logins, privilege escalation, suspicious network activity. Configures alerting through ElastAlert for critical security events. Manages index lifecycle.
Designs SIEM solution based on Elastic Security with detection rules and MITRE ATT&CK mapping. Configures Elastic Agent for endpoint detection. Introduces ML anomaly detection for lateral movement and data exfiltration. Develops correlation rules for multi-source threat detection.
Defines centralized logging and SIEM strategy for the organization. Manages Elastic Stack platform (multi-cluster, cross-cluster search). Builds SOC processes based on Elastic Security: alert triage, investigation, response. Defines retention policies and data tiering for compliance.
Implements structured logging (JSON format) in applications with fields: timestamp, level, service, request_id, user_id. Uses Winston (Node.js) or structlog (Python) libraries. Understands log correlation through trace_id for distributed systems. Avoids logging PII and secrets.
Standardizes log format for all microservices: mandatory fields, security context (user, ip, action). Introduces log sanitization for PII masking (email, IP) in compliance with GDPR. Configures log correlation with distributed tracing through OpenTelemetry. Creates dashboards for security-relevant events.
Designs corporate logging standard with security enrichment: threat indicators, risk scores, MITRE ATT&CK annotations. Introduces automated log analysis for anomaly detection. Develops logging SDK with built-in PII detection and masking. Configures immutable log storage for forensics and compliance.
Defines observability-driven security strategy for the organization. Manages logging pipeline from source to SIEM. Builds metrics: log coverage, parsing accuracy, detection efficiency. Introduces log-based compliance reporting for SOC 2 and PCI DSS. Optimizes costs at high log volumes.
Metrics & Monitoring 1
▼
Installs Prometheus and Grafana for infrastructure and application monitoring. Configures exporters: node_exporter, kube-state-metrics. Creates basic Grafana dashboards for CPU, memory, disk. Configures Alertmanager alerts for critical metrics: high CPU, disk space, pod restarts.
Configures Prometheus for security monitoring: failed auth attempts, certificate expiration, secret access patterns. Creates Grafana dashboards for security operations: vulnerability trends, compliance scores, incident metrics. Introduces Thanos for long-term storage and multi-cluster querying. Configures recording rules.
Designs observability platform for security monitoring: custom metrics, SLO-based alerting, anomaly detection. Introduces PromQL for complex security queries: failed login rate, unusual API patterns. Configures Grafana OnCall for security incident alerting. Develops security-specific Grafana dashboard library.
Defines metrics and monitoring strategy for security operations. Manages observability platform (Prometheus + Thanos + Grafana). Builds security KPI dashboards for CISO: MTTD, MTTR, vulnerability trends, compliance posture. Introduces SLO-based approach to security: availability, data integrity, confidentiality.
Networking 1
▼
Studies TCP/IP, DNS, HTTP/HTTPS basics, OSI model. Understands firewall, NAT, VPN operation. Uses nslookup, ping, traceroute, netstat for diagnostics. Configures Security Groups in AWS. Understands TLS handshake and X.509 certificate principles for connection security.
Designs cloud network architectures: VPC peering, Transit Gateway, PrivateLink. Configures DNS security (DNSSEC, DoH). Introduces mTLS between services. Analyzes network traffic with tcpdump and Wireshark for incident investigation. Configures VPN (WireGuard) for secure remote access.
Designs corporate network architecture with micro-segmentation and Zero Trust principles. Designs hybrid connectivity: Direct Connect, VPN failover. Introduces network monitoring with VPC Flow Logs analytics. Configures network-level DDoS protection. Optimizes network latency for distributed systems.
Supply Chain Security 1
▼
Understands basic SBOM concepts: software bill of materials formats (SPDX, CycloneDX), dependency tracking, and license compliance fundamentals. Follows security guidelines for reviewing dependency vulnerabilities using automated scanning tools. Recognizes common supply chain attack vectors.
Applies Supply Chain Security in daily work. Conducts security code review. Uses scanning and analysis tools.
Designs security solutions with Supply Chain Security. Conducts threat modeling. Introduces security practices into SDLC. Mentors the team.
Defines DevSecOps supply chain security strategy: establishes SBOM automation pipelines, artifact signing policies (Sigstore, in-toto), and dependency allowlisting governance. Coordinates cross-team response to supply chain incidents. Trains teams on software provenance verification and SLSA compliance.