These skills do not affect the main grade but show the breadth of your profile.
AI Coding Assistants
▼
Uses ChatGPT and Claude for finding information about security testing methodologies. Formulates queries for generating test scenarios and understanding vulnerability types.
Applies LLMs for security test generation: fuzzing data, exploit scenarios, authorization checks. Uses AI for analyzing scan results and prioritizing vulnerabilities.
Integrates LLMs into security QA process: automated test case generation from threat models, AI-assisted vulnerability triage. Develops prompt library for common security tests.
Defines AI usage strategy in the organization's security QA. Trains the team on effective LLM application for test generation and security analysis considering limitations and risks.
Getting familiar with Cursor IDE as an AI tool for accelerating security QA work. Uses autocomplete and chat for writing security test scenarios and analyzing scan results.
Effectively applies Cursor for security QA: test case generation, code vulnerability analysis, security autotest writing. Configures project context for accurate security recommendations.
Integrates Cursor into security QA workflow: automating exploit scenario generation, pentest result analysis, security report creation. Creates custom instructions for QA tasks.
Defines Cursor IDE usage strategy for the organization's security QA team. Trains testers on productive AI-assisted work for test generation and vulnerability analysis.
Uses Copilot for security testing: generating test payloads, writing security test scripts, automating routine checks. Critically evaluates suggestions for security correctness.
Works productively with Copilot: generates security scan configs, custom detection rules, automation scripts. Uses Chat for analyzing vulnerability reports and code review.
Maximizes productivity: generates custom SAST rules (Semgrep), threat model templates, incident response playbooks. Workflow: AI for boilerplate, engineer for security analysis.
Implements AI tools in the security team: defines boundaries (automation scripts — yes, vulnerability assessment — review). Evaluates AI for security (AI-powered SAST, automated triage).
Algorithms & Data Structures
▼
Understands basic data structures for security testing: vulnerability lists, test case collections, configuration dictionaries for scanner setup. Applies simple data structures following team patterns for organizing security test inputs and results.
Independently selects appropriate data structures for security testing: vulnerability databases, attack vector trees, compliance checklist structures. Understands trade-offs between data organization for security scan efficiency and finding deduplication.
Selects optimal data structures for security testing: vulnerability database models for efficient lookup, graph structures for attack surface mapping, indexed structures for compliance evidence storage. Optimizes fuzzing input data structures for maximum coverage. Designs efficient data models for security finding deduplication and risk scoring.
Defines test data standards: structured payloads for fuzzing, immutable test fixtures for security tests. Reviews data models of vulnerability tracking systems.
API Management
▼
Understands the role of API documentation in planning security testing. Analyzes OpenAPI specifications to determine attack surface and prepare security test scenarios.
Uses API documentation for systematic security testing: verifying all endpoints, testing auth schemes, parameter fuzzing. Documents discovered vulnerabilities with clear reproduction steps.
Automates security test generation from API documentation: parsing OpenAPI to create test cases, automatic verification of new endpoints. Develops security documentation standards.
Defines API documentation requirements from a security testing perspective for the organization. Implements mandatory documentation of API security characteristics in the development process.
Authentication & Authorization
▼
Tests JWT/OAuth: verifies token validation (signature, expiration), scope enforcement, redirect URI validation. Uses jwt.io for token analysis.
Conducts authentication security testing: JWT manipulation (algorithm confusion, key injection), OAuth flow abuse (CSRF, open redirect), session management. Tests refresh token security.
Designs auth security testing: automated token manipulation suite, OAuth flow testing matrix, SSO security verification. Tests PKCE, DPoP, token binding.
Defines auth testing standards: mandatory tests per auth flow, OAuth security review checklist, compliance requirements. Coordinates auth security with the identity team.
Caching
▼
Understands basics of Redis from a security testing perspective — testing authentication bypass, data leakage through cache, and command injection risks. Validates Redis security configurations against compliance requirements. Follows team guidelines for Redis security validation in QA processes.
Conducts Redis security testing: ACL verification, TLS connection testing, network isolation auditing. Creates test scenarios for cache poisoning and session hijacking via Redis.
Develops comprehensive Redis infrastructure security testing strategy: configuration auditing, data-at-rest encryption testing, access pattern verification for data leaks.
Defines Redis security testing standards for the organization. Implements automated Redis configuration checks in the deployment process and regular cluster security assessments.
Clean Code & Refactoring
▼
Understands basic code quality principles for security test scripts. Follows team conventions for writing clean scanner configurations and test definitions. Writes simple security checks following established templates. Accepts code review feedback on test automation code.
Independently applies code quality practices in security testing development. Writes clean DAST configurations and fuzzing harnesses with proper input generation. Understands trade-offs between scan depth and execution time. Reviews security test code for coverage completeness, false positive handling, and compliance requirement mapping.
Designs code quality standards for security testing frameworks: DAST scanner configurations, fuzzing harness structure, security regression test suites. Refactors vulnerability detection scripts for accuracy and false-positive reduction. Establishes review practices for security test coverage and compliance mapping.
Establishes security code quality standards: code review for test scripts, linting for security configs, coverage requirements for security tests. Implements quality gates.
Cloud Providers
▼
Understands basic AWS security services for conducting security tests: IAM, Security Groups, CloudTrail. Can verify configurations and find typical misconfigurations in the test environment.
Conducts AWS infrastructure security testing: IAM policy verification, Security Groups scanning, S3 bucket policy audits. Uses AWS Inspector and Trusted Advisor for automated checks.
Designs comprehensive AWS security test scenarios: multi-account strategy verification, network isolation testing, encryption at rest/transit validation. Automates cloud security posture testing.
Defines AWS infrastructure security testing strategy for the organization. Implements continuous security testing for cloud resources with CI/CD and change management process integration.
Code Review
▼
Conducts security-focused code review: searches for hardcoded credentials, injection vulnerabilities, missing input validation. Uses security review checklists.
Conducts deep security review: authentication/authorization flaws, cryptographic misuse, race conditions, SSRF. Provides recommendations with secure implementation examples.
Conducts architectural security review: threat model validation, trust boundary verification, data flow security. Reviews security-critical components.
Builds security review culture: defines checklist by categories (OWASP), SLA for security review, automated pre-review checks. Trains developers on security review skills.
Collaboration Tools
▼
Documents security findings: vulnerability reports, test results, security checklists in Markdown. Follows documentation templates.
Creates security documentation: test plans, security assessment reports, runbooks in git-managed docs. Automates report generation.
Designs security documentation framework: threat model docs, security architecture docs, automated evidence collection for compliance. Versions security policies.
Defines security documentation standards: required documents per project, templates, review process. Implements docs-as-code for security policies and procedures.
Compliance
▼
Understands basic PCI DSS concepts and their impact on QA processes. Follows security testing checklists aligned with PCI requirements. Identifies common vulnerabilities in payment-related functionality during test execution.
Applies PCI DSS in daily work. Conducts security code review. Uses scanning and analysis tools.
Designs comprehensive PCI DSS security testing strategies for payment systems. Builds automated test suites validating PCI compliance across environments. Implements threat-based testing scenarios for cardholder data flows. Mentors QA team on PCI testing practices.
Defines PCI DSS testing strategy across all payment-related products. Establishes security QA policies ensuring continuous compliance validation. Coordinates cross-team security testing during PCI audit preparation. Trains QA engineers on PCI compliance verification methods.
Concurrency & Parallelism
▼
Understands basic asynchronous programming concepts for writing security tests. Uses async/await when working with API calls and vulnerability scanners in test scenarios.
Implements asynchronous test scenarios for parallel vulnerability scanning and security checks. Properly handles timeouts and errors when interacting with security tools.
Designs high-performance asynchronous test frameworks for security QA: parallel DAST scan execution, concurrent authorization verification. Optimizes test pipeline throughput.
Defines architectural patterns for asynchronous processing in organizational security testing. Establishes standards for concurrent security test execution with focus on result stability.
Understands basic multithreading concepts and related security vulnerabilities: race conditions, TOCTOU. Knows how concurrent resource access can lead to security violations.
Develops tests for detecting concurrency vulnerabilities in applications: race conditions in authorization, double-spend attacks. Applies load testing to provoke threading bugs.
Designs specialized testing strategies for detecting concurrency vulnerabilities: deterministic tests with scheduler control, stress testing with timing manipulation for security-critical code.
Defines concurrency security testing standards for the organization. Implements tools and methodologies for detecting threading vulnerabilities in CI/CD pipelines.
Containerization
▼
Runs security tools in Docker: ZAP, Trivy, SonarQube. Understands container security basics. Scans images for vulnerabilities through Trivy/Grype.
Tests container security: image scanning pipeline, Dockerfile best practices review, secret detection in images. Configures security scanning in CI. Verifies runtime security.
Designs container security testing: automated image scanning pipeline, runtime behaviour analysis, CIS benchmark compliance. Integrates container security into SDLC.
Defines container security standards: mandatory scanning policies, base image requirements, vulnerability SLA. Coordinates container security with DevOps and development.
Distributed Tracing
▼
Understands basics of OpenTelemetry from a security testing perspective. Follows team guidelines for analyzing distributed traces to validate security control behavior and detect anomalous request patterns. Uses telemetry data to support security test scenario verification and compliance validation.
Uses OpenTelemetry data to improve security testing: trace analysis for identifying unusual flows, metric monitoring during security load testing.
Designs OpenTelemetry integration into security QA: correlating test results with traces, detecting security anomalies through metrics, automated triage based on observability data.
Defines observability usage standards for security QA in the organization. Implements OpenTelemetry-based monitoring for detecting security regressions and anomalies in tested systems.
GraphQL
▼
Understands basics of GraphQL security testing — introspection exposure, query complexity attacks, and field-level authorization validation. Writes simple security test cases for GraphQL endpoints. Follows team guidelines for GraphQL vulnerability scanning and authentication testing.
Conducts GraphQL API security testing: depth limiting verification, query complexity analysis, field-level authorization testing. Develops test cases for GraphQL-specific vulnerabilities.
Designs comprehensive GraphQL security testing strategy: automated schema fuzzing, batching attack testing, complexity-based rate limiting verification. Creates specialized testing tools.
Defines GraphQL security testing standards for the organization. Implements automated GraphQL security testing in CI/CD and trains the QA team on GraphQL API testing specifics.
Incident Response
▼
Works with vulnerability management: creates and tracks vulnerability reports, understands CVSS scoring, monitors remediation status. Uses Jira/DefectDojo.
Manages vulnerability lifecycle: triage, prioritization (CVSS + context), SLA tracking, verification of fixes. Configures DefectDojo/vulnerability tracker. Generates reports.
Designs vulnerability management program: risk-based prioritization (EPSS, threat intelligence), automated scanning pipeline, metrics (mean time to remediate). Integrates with SIEM.
Defines vulnerability management standards: SLA per severity, triage process, escalation policy. Coordinates vulnerability response. Implements vulnerability metrics and reporting.
Infrastructure Security
▼
Tests cloud security basics: IAM policies audit, public S3 buckets detection, security group review. Uses ScoutSuite/Prowler for cloud security assessment.
Conducts cloud security assessment: multi-service audit (IAM, networking, encryption, logging), compliance checks (CIS Benchmarks). Configures automated scanning with Prowler/Checkov.
Designs cloud security testing program: continuous compliance monitoring, infrastructure-as-code security (tfsec, Checkov), multi-cloud assessment. Implements custom checks.
Defines cloud security testing standards: mandatory assessments per account, compliance framework (SOC2, ISO 27001), reporting requirements. Coordinates with cloud engineering.
Tests basic K8s security: RBAC misconfigurations, exposed services, default credentials. Uses kube-bench for CIS compliance. Scans manifests through kubesec.
Conducts K8s security assessment: network policies audit, pod security standards compliance, secret management review. Tests with kube-hunter. Verifies admission controllers.
Designs K8s security testing: automated CIS compliance checking, runtime threat detection (Falco), supply chain verification (Sigstore). Tests multi-tenancy isolation.
Defines K8s security testing standards: mandatory checks per cluster, compliance requirements, incident response for K8s. Coordinates security hardening with platform team.
Kubernetes & Orchestration
▼
Understands basic Kubernetes concepts from a security testing perspective. Follows kubectl commands to inspect pod security contexts and network policies. Uses team-provided checklists for validating Kubernetes security configurations during QA assessments.
Conducts Kubernetes cluster security testing: RBAC verification, network policies, pod security standards. Uses kube-bench and kube-hunter for automated checks.
Develops comprehensive Kubernetes security testing strategy: supply chain auditing, runtime security verification, network isolation testing between namespaces and service mesh.
Defines Kubernetes security testing standards for the organization. Implements continuous cluster security assessment with admission control and CI/CD pipeline integration.
Metrics & Monitoring
▼
Monitors security metrics: failed login attempts, authorization denials, scan findings count. Reads security dashboards. Responds to security alerts.
Creates security dashboards: vulnerability trends, scan coverage, remediation progress, SLA compliance. Configures alerting for security thresholds.
Designs security metrics framework: security KPIs (MTTD, MTTR, vulnerability density), automated reporting, trend analysis. Integrates security metrics with business risk.
Defines security metrics standards: mandatory KPIs, dashboard templates, reporting cadence. Implements data-driven security management.
Networking
▼
Understands basic network protocols for conducting security testing: TCP/UDP, HTTP/HTTPS, DNS. Uses tools like Wireshark and curl for basic network traffic analysis.
Conducts network security testing: port scanning, TLS configuration verification, DNS security analysis. Tests network segmentation and firewall rules for service isolation.
Develops comprehensive network security test scenarios: defense-in-depth verification, lateral movement testing, traffic pattern anomaly analysis. Automates network auditing.
Defines network security testing standards for the organization. Implements continuous network security assessment with automated detection of network configuration changes.
OOP & Design Patterns
▼
Knows basic design patterns and their application in creating security test frameworks. Understands Page Object and Strategy for organizing application security tests.
Applies design patterns for building extensible test frameworks: Builder for constructing test data, Factory for creating different types of security scanners.
Designs security testing platform architecture using advanced patterns: Plugin for extensible scanners, Observer for result monitoring, Template Method for test scenarios.
Defines a pattern catalog for security testing in the organization. Trains teams on using patterns to build maintainable and scalable security test frameworks.
Understands OOP for writing security tests: inheriting base test classes, encapsulating test helpers, using interfaces for mock objects.
Applies OOP in security automation: Page Object for security UI tests, Strategy pattern for different scan types, Factory for creating test payloads.
Designs security testing framework: abstractions for different scanner backends, plugin architecture for custom checks, Builder pattern for complex attack scenarios.
Defines architectural standards for security tooling: modular scanner design, extensible frameworks for custom security rules. Trains the team on design patterns.
Prompt Engineering
▼
Uses AI to generate security test scenarios and penetration testing checklists. Formulates prompts with vulnerability context (OWASP, CVE) for targeted security analysis. Validates AI suggestions against established security frameworks.
Creates advanced prompts for security testing: payload generation for fuzzing, test case creation from CVE descriptions, security configuration analysis. Applies few-shot for complex test scenarios.
Develops prompt system for security QA automation: test generation from specifications, scan result analysis, risk prioritization. Integrates AI-generated tests into CI/CD.
Defines AI-assisted security testing strategy for the organization with a validated prompt library. Trains the QA team on effective LLM usage for automating routine checks.
Relational Databases
▼
Understands basic PostgreSQL security testing: testing for SQL injection vulnerabilities, verifying database access controls and encryption settings, validating input sanitization in database queries. Follows team conventions for security test coverage of database interactions.
Conducts PostgreSQL security testing: SQL injection verification, privilege auditing, connection encryption testing. Creates test scenarios for row-level security and data masking validation.
Develops comprehensive PostgreSQL security testing strategy: automated configuration auditing, backup security testing, compliance requirement verification.
Defines database security testing standards for the organization. Implements automated PostgreSQL checks in CI/CD and establishes security baselines for all instances.
System Design
▼
Understands basic system architectural components for effective security testing. Knows typical attack surfaces in different architectural patterns: monolith, microservices, serverless.
Analyzes architecture of systems under test to determine security testing strategy. Identifies trust boundaries, critical data flows, and entry points for targeted testing.
Designs security testing strategies for complex distributed systems considering architectural specifics. Develops threat models as the basis for test campaign planning.
Defines security testing methodology for various architectural patterns in the organization. Creates test strategies for new systems at the architectural design stage.