These skills do not affect the main grade but show the breadth of your profile.
AI Coding Assistants
▼
Uses ChatGPT and Claude for finding information about security testing methodologies. Formulates queries for generating test scenarios and understanding vulnerability types.
Applies LLMs for security test generation: fuzzing data, exploit scenarios, authorization checks. Uses AI for analyzing scan results and prioritizing vulnerabilities.
Defines AI usage strategy in the organization's security QA. Trains the team on effective LLM application for test generation and security analysis considering limitations and risks.
Getting familiar with Cursor IDE as an AI tool for accelerating security QA work. Uses autocomplete and chat for writing security test scenarios and analyzing scan results.
Effectively applies Cursor for security QA: test case generation, code vulnerability analysis, security autotest writing. Configures project context for accurate security recommendations.
Defines Cursor IDE usage strategy for the organization's security QA team. Trains testers on productive AI-assisted work for test generation and vulnerability analysis.
Uses Copilot for security testing: generating test payloads, writing security test scripts, automating routine checks. Critically evaluates suggestions for security correctness.
Works productively with Copilot: generates security scan configs, custom detection rules, automation scripts. Uses Chat for analyzing vulnerability reports and code review.
Implements AI tools in the security team: defines boundaries (automation scripts — yes, vulnerability assessment — review). Evaluates AI for security (AI-powered SAST, automated triage).
Algorithms & Data Structures
▼
Understands basic algorithmic concepts for security testing: simple pattern matching for vulnerability signatures, basic search through scan results, sorting findings by severity. Follows team guidance on algorithm selection for security test automation.
Independently applies algorithmic thinking in security testing: evaluates fuzzing algorithm coverage strategies, selects vulnerability detection algorithms for different attack types, understands risk scoring algorithms. Analyzes complexity trade-offs between security scan depth and execution time.
Defines performance budgets for security tests. Reviews fuzzing and brute-force scripts with focus on algorithm efficiency. Implements optimal strategies for security scanning.
Understands basic data structures for security testing: vulnerability lists, test case collections, configuration dictionaries for scanner setup. Applies simple data structures following team patterns for organizing security test inputs and results.
Independently selects appropriate data structures for security testing: vulnerability databases, attack vector trees, compliance checklist structures. Understands trade-offs between data organization for security scan efficiency and finding deduplication.
Defines test data standards: structured payloads for fuzzing, immutable test fixtures for security tests. Reviews data models of vulnerability tracking systems.
API Management
▼
Understands the role of API documentation in planning security testing. Analyzes OpenAPI specifications to determine attack surface and prepare security test scenarios.
Uses API documentation for systematic security testing: verifying all endpoints, testing auth schemes, parameter fuzzing. Documents discovered vulnerabilities with clear reproduction steps.
Defines API documentation requirements from a security testing perspective for the organization. Implements mandatory documentation of API security characteristics in the development process.
Uses Postman and Burp Suite for API security testing: intercepts requests, modifies headers and body. Understands Swagger/OpenAPI for determining attack surface.
Effectively uses security testing tools: Burp Suite Professional (scanner, intruder, repeater), OWASP ZAP for automated scanning, nuclei for template-based testing.
Defines tooling strategy: selection and standardization of tools (Burp vs ZAP), licensing, training. Implements custom rule sets for organization-specific threats.
Designs API security tooling platform: integrated testing pipeline, custom scanner development, vulnerability correlation across tools. Defines tool evaluation and adoption strategy.
Application Security
▼
Knows OWASP Top 10: injection, broken auth, XSS, SSRF. Tests following the OWASP Testing Guide. Uses checklists for manual security testing.
Tests against OWASP Top 10: automated scanning (ZAP), manual verification for complex scenarios. Understands OWASP ASVS for security requirements. Documents findings using CVSS.
Defines OWASP testing standards: mandatory checks per release, ASVS compliance level requirements, training program. Coordinates OWASP adoption in development.
Understands secure coding principles: input validation, output encoding, parameterized queries. Tests code for typical vulnerabilities. Uses secure coding checklists.
Verifies secure coding practices: code review for injection flaws, authentication issues, cryptographic misuse. Writes secure code examples and anti-patterns. Tests error handling.
Defines organizational secure coding standards: language-specific guidelines, mandatory training, code review security checklist. Builds secure coding culture.
Understands threat modeling: STRIDE for threat identification, data flow diagrams for the system. Participates in threat modeling sessions. Documents identified threats.
Conducts threat modeling: STRIDE/PASTA for new features, identifies trust boundaries and attack surfaces. Creates threat models for APIs and data flows. Derives security test cases from threats.
Defines threat modeling standards: mandatory for high-risk features, templates, review process. Trains dev teams. Coordinates threat models across teams.
Designs organizational threat modeling: automated threat discovery, threat intelligence integration, continuous threat assessment. Defines risk-based security strategy.
Caching
▼
Understands basics of Redis from a security testing perspective — testing authentication bypass, data leakage through cache, and command injection risks. Validates Redis security configurations against compliance requirements. Follows team guidelines for Redis security validation in QA processes.
Conducts Redis security testing: ACL verification, TLS connection testing, network isolation auditing. Creates test scenarios for cache poisoning and session hijacking via Redis.
Defines Redis security testing standards for the organization. Implements automated Redis configuration checks in the deployment process and regular cluster security assessments.
CI/CD
▼
Runs security tests in CI: SAST (SonarQube), dependency scan (Snyk), image scan (Trivy). Reads security scan results. Creates issues from findings.
Configures security CI pipeline: SAST/DAST/SCA in GitHub Actions, quality gates by severity, automated PR comments with findings. Configures scheduled security scans.
Defines CI security standards: mandatory security checks, gate policies, remediation SLA. Coordinates security tooling in CI/CD. Introduces security pipeline metrics.
Clean Code & Refactoring
▼
Understands basic code quality principles for security test scripts. Follows team conventions for writing clean scanner configurations and test definitions. Writes simple security checks following established templates. Accepts code review feedback on test automation code.
Independently applies code quality practices in security testing development. Writes clean DAST configurations and fuzzing harnesses with proper input generation. Understands trade-offs between scan depth and execution time. Reviews security test code for coverage completeness, false positive handling, and compliance requirement mapping.
Establishes security code quality standards: code review for test scripts, linting for security configs, coverage requirements for security tests. Implements quality gates.
Cloud Providers
▼
Understands basic AWS security services for conducting security tests: IAM, Security Groups, CloudTrail. Can verify configurations and find typical misconfigurations in the test environment.
Conducts AWS infrastructure security testing: IAM policy verification, Security Groups scanning, S3 bucket policy audits. Uses AWS Inspector and Trusted Advisor for automated checks.
Defines AWS infrastructure security testing strategy for the organization. Implements continuous security testing for cloud resources with CI/CD and change management process integration.
Code Review
▼
Conducts security-focused code review: searches for hardcoded credentials, injection vulnerabilities, missing input validation. Uses security review checklists.
Conducts deep security review: authentication/authorization flaws, cryptographic misuse, race conditions, SSRF. Provides recommendations with secure implementation examples.
Builds security review culture: defines checklist by categories (OWASP), SLA for security review, automated pre-review checks. Trains developers on security review skills.
Collaboration Tools
▼
Documents security findings: vulnerability reports, test results, security checklists in Markdown. Follows documentation templates.
Creates security documentation: test plans, security assessment reports, runbooks in git-managed docs. Automates report generation.
Defines security documentation standards: required documents per project, templates, review process. Implements docs-as-code for security policies and procedures.
Designs security knowledge management: organizational security wiki, automated policy distribution, compliance evidence management. Defines documentation governance.
Concurrency & Parallelism
▼
Understands basic asynchronous programming concepts for writing security tests. Uses async/await when working with API calls and vulnerability scanners in test scenarios.
Implements asynchronous test scenarios for parallel vulnerability scanning and security checks. Properly handles timeouts and errors when interacting with security tools.
Defines architectural patterns for asynchronous processing in organizational security testing. Establishes standards for concurrent security test execution with focus on result stability.
Understands basic multithreading concepts and related security vulnerabilities: race conditions, TOCTOU. Knows how concurrent resource access can lead to security violations.
Develops tests for detecting concurrency vulnerabilities in applications: race conditions in authorization, double-spend attacks. Applies load testing to provoke threading bugs.
Defines concurrency security testing standards for the organization. Implements tools and methodologies for detecting threading vulnerabilities in CI/CD pipelines.
Containerization
▼
Runs security tools in Docker: ZAP, Trivy, SonarQube. Understands container security basics. Scans images for vulnerabilities through Trivy/Grype.
Tests container security: image scanning pipeline, Dockerfile best practices review, secret detection in images. Configures security scanning in CI. Verifies runtime security.
Defines container security standards: mandatory scanning policies, base image requirements, vulnerability SLA. Coordinates container security with DevOps and development.
Distributed Tracing
▼
Understands basics of OpenTelemetry from a security testing perspective. Follows team guidelines for analyzing distributed traces to validate security control behavior and detect anomalous request patterns. Uses telemetry data to support security test scenario verification and compliance validation.
Uses OpenTelemetry data to improve security testing: trace analysis for identifying unusual flows, metric monitoring during security load testing.
Defines observability usage standards for security QA in the organization. Implements OpenTelemetry-based monitoring for detecting security regressions and anomalies in tested systems.
Git & Workflows
▼
Works with Git for security: commits security test scripts, tracks vulnerability findings. Follows branching workflow. Does not commit sensitive data.
Uses Git for security projects: branch-per-assessment, PR review for security configs, git-secrets for pre-commit scanning. Manages security tool configurations.
Establishes Git workflow for the security team: branching model, review requirements for security changes, CODEOWNERS for security-critical configs.
GraphQL
▼
Understands basics of GraphQL security testing — introspection exposure, query complexity attacks, and field-level authorization validation. Writes simple security test cases for GraphQL endpoints. Follows team guidelines for GraphQL vulnerability scanning and authentication testing.
Conducts GraphQL API security testing: depth limiting verification, query complexity analysis, field-level authorization testing. Develops test cases for GraphQL-specific vulnerabilities.
Defines GraphQL security testing standards for the organization. Implements automated GraphQL security testing in CI/CD and trains the QA team on GraphQL API testing specifics.
Infrastructure Security
▼
Tests cloud security basics: IAM policies audit, public S3 buckets detection, security group review. Uses ScoutSuite/Prowler for cloud security assessment.
Conducts cloud security assessment: multi-service audit (IAM, networking, encryption, logging), compliance checks (CIS Benchmarks). Configures automated scanning with Prowler/Checkov.
Defines cloud security testing standards: mandatory assessments per account, compliance framework (SOC2, ISO 27001), reporting requirements. Coordinates with cloud engineering.
Designs cloud security assurance: continuous compliance platform, multi-cloud security governance, automated remediation. Defines organizational cloud security strategy.
Kubernetes & Orchestration
▼
Understands basic Kubernetes concepts from a security testing perspective. Follows kubectl commands to inspect pod security contexts and network policies. Uses team-provided checklists for validating Kubernetes security configurations during QA assessments.
Conducts Kubernetes cluster security testing: RBAC verification, network policies, pod security standards. Uses kube-bench and kube-hunter for automated checks.
Defines Kubernetes security testing standards for the organization. Implements continuous cluster security assessment with admission control and CI/CD pipeline integration.
Logging
▼
Uses ELK for security: searches for security events in Kibana, filters by severity and source IP. Creates saved searches for typical security alerts.
Configures security monitoring in ELK: correlation rules for attack detection, security dashboards, automated alerting. Integrates with SIEM. Analyzes security logs.
Defines security logging standards: mandatory security events, retention for compliance, access control for security data. Coordinates security monitoring with SOC.
Designs security observability platform: SIEM integration, threat detection pipeline, automated investigation. Defines organizational security monitoring strategy.
Verifies security logging: presence of security-relevant events (auth failures, access denials), absence of sensitive data in logs. Understands security log requirements.
Tests logging for security compliance: audit trail completeness, PII leakage in logs, log tampering protection. Configures security-specific structured logs.
Defines security logging standards: event categories, retention requirements, compliance mapping (GDPR, PCI-DSS). Coordinates security logging across services.
Metrics & Monitoring
▼
Monitors security metrics: failed login attempts, authorization denials, scan findings count. Reads security dashboards. Responds to security alerts.
Creates security dashboards: vulnerability trends, scan coverage, remediation progress, SLA compliance. Configures alerting for security thresholds.
Defines security metrics standards: mandatory KPIs, dashboard templates, reporting cadence. Implements data-driven security management.
Networking
▼
Understands basic network protocols for conducting security testing: TCP/UDP, HTTP/HTTPS, DNS. Uses tools like Wireshark and curl for basic network traffic analysis.
Conducts network security testing: port scanning, TLS configuration verification, DNS security analysis. Tests network segmentation and firewall rules for service isolation.
Defines network security testing standards for the organization. Implements continuous network security assessment with automated detection of network configuration changes.
OOP & Design Patterns
▼
Knows basic design patterns and their application in creating security test frameworks. Understands Page Object and Strategy for organizing application security tests.
Applies design patterns for building extensible test frameworks: Builder for constructing test data, Factory for creating different types of security scanners.
Defines a pattern catalog for security testing in the organization. Trains teams on using patterns to build maintainable and scalable security test frameworks.
Understands OOP for writing security tests: inheriting base test classes, encapsulating test helpers, using interfaces for mock objects.
Applies OOP in security automation: Page Object for security UI tests, Strategy pattern for different scan types, Factory for creating test payloads.
Defines architectural standards for security tooling: modular scanner design, extensible frameworks for custom security rules. Trains the team on design patterns.
Prompt Engineering
▼
Uses AI to generate security test scenarios and penetration testing checklists. Formulates prompts with vulnerability context (OWASP, CVE) for targeted security analysis. Validates AI suggestions against established security frameworks.
Creates advanced prompts for security testing: payload generation for fuzzing, test case creation from CVE descriptions, security configuration analysis. Applies few-shot for complex test scenarios.
Defines AI-assisted security testing strategy for the organization with a validated prompt library. Trains the QA team on effective LLM usage for automating routine checks.
Relational Databases
▼
Understands basic PostgreSQL security testing: testing for SQL injection vulnerabilities, verifying database access controls and encryption settings, validating input sanitization in database queries. Follows team conventions for security test coverage of database interactions.
Conducts PostgreSQL security testing: SQL injection verification, privilege auditing, connection encryption testing. Creates test scenarios for row-level security and data masking validation.
Defines database security testing standards for the organization. Implements automated PostgreSQL checks in CI/CD and establishes security baselines for all instances.
REST API
▼
Tests REST API security: verifies authentication, authorization, input validation. Uses Postman/curl for sending malicious payloads. Understands HTTP security headers.
Designs security tests for APIs: automated OWASP API Top 10 checks, injection testing, broken authentication scenarios. Integrates API security tests into CI via ZAP/Burp.
Defines API security testing standards: mandatory checks per endpoint, security review process for new APIs, automated regression testing. Coordinates with development teams.
System Design
▼
Understands basic system architectural components for effective security testing. Knows typical attack surfaces in different architectural patterns: monolith, microservices, serverless.
Analyzes architecture of systems under test to determine security testing strategy. Identifies trust boundaries, critical data flows, and entry points for targeted testing.
Defines security testing methodology for various architectural patterns in the organization. Creates test strategies for new systems at the architectural design stage.