Application Security 4
▼
Understands the purpose of dependency scanning tools such as Snyk, Dependabot, and OWASP Dependency-Check. Follows established SCA policies when triaging vulnerability alerts. Recognizes common CVE severity levels and can escalate critical findings to senior analysts.
Independently runs and interprets SCA scans using Snyk, Dependabot, or Trivy across the organization's repositories. Conducts security reviews of dependency update pull requests, assessing changelog impact and potential regressions. Correlates vulnerability scanner output with threat intelligence feeds to prioritize remediation. Produces actionable reports for engineering teams with clear remediation timelines.
Defines the security analytics team's strategy for dependency vulnerability monitoring and triage at product-line scale. Establishes standardized dashboards and KPI tracking for mean-time-to-remediate across SCA tools (Snyk, Dependabot, Trivy). Coordinates cross-team incident response when critical dependency vulnerabilities emerge, ensuring consistent communication and patching timelines. Trains analysts on advanced SCA interpretation, SBOM-driven risk assessment, and license compliance monitoring.
Defines the enterprise security analytics strategy for dependency vulnerability management, shaping tooling and process architecture across all organizational units. Drives adoption of SBOM-based risk quantification models and integrates SCA programs with enterprise GRC platforms for continuous compliance monitoring. Coordinates organization-wide vulnerability disclosure processes and defines escalation frameworks for supply chain incidents impacting multiple business units. Represents the organization in industry bodies (OpenSSF, FIRST) and shapes evolving standards for vulnerability scoring, SCA benchmarking, and supply chain transparency.
Understands basic SAST/DAST concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Analyzes SAST/DAST scan results to assess risk levels and prioritize remediation efforts. Correlates scanner findings with threat intelligence and known vulnerability databases. Generates actionable security reports from scanning data for development and management teams.
Defines SAST/DAST monitoring and reporting strategy across the organization. Establishes vulnerability management policies based on scanner data and risk classification. Coordinates cross-team remediation tracking for critical scanner findings. Trains security analysts on scan result analysis and prioritization.
Defines enterprise vulnerability intelligence strategy powered by SAST/DAST data across all business units. Shapes security analytics architecture integrating scanner output with threat intelligence platforms. Coordinates compliance reporting with regulatory bodies. Drives vulnerability management standards in the industry.
Understands basic secure coding concepts from a security analysis perspective — recognizes injection patterns, authentication bypass indicators, and insecure data handling in application logs. Follows security guidelines for identifying vulnerability signatures in code review findings and SAST/DAST reports.
Applies secure coding knowledge in security event analysis — correlates SAST/DAST findings with runtime security events, identifies exploitation attempts for known code vulnerabilities, and validates security fixes in remediation workflows. Uses code analysis tools to support threat investigation and vulnerability triage.
Defines security analysis strategy integrating secure coding intelligence across monitoring operations. Establishes policies for code-informed detection engineering, vulnerability correlation workflows, and code-level threat analysis standards. Coordinates cross-team security analysis for application vulnerabilities and trains analysts on code-aware investigation techniques.
Defines enterprise security analysis strategy integrating code intelligence with threat detection across application, network, and cloud environments. Shapes security operations architecture leveraging secure coding insights for advanced detection capabilities. Coordinates organizational compliance and represents the organization in threat intelligence and security analysis communities.
Understands basic threat modeling methodologies (STRIDE, DREAD). Identifies common threats in simple systems using predefined templates. Documents threat scenarios following organizational guidelines. Assists in data flow diagram creation for threat analysis.
Independently conducts threat modeling for medium-complexity systems using STRIDE and attack trees. Correlates identified threats with MITRE ATT&CK framework tactics. Understands trade-offs between security controls and system usability. Produces actionable threat reports with risk-ranked mitigation recommendations.
Defines threat modeling strategy at team and product level for security operations. Establishes threat intelligence-driven modeling processes aligned with MITRE ATT&CK and industry frameworks. Coordinates threat assessments across SOC, incident response, and vulnerability management teams. Drives integration of threat models into detection engineering and monitoring strategy.
Defines organizational threat modeling strategy aligned with enterprise risk management. Shapes security operations architecture through threat landscape analysis and adversary modeling at scale. Establishes cross-departmental threat assessment standards integrating MITRE ATT&CK, STRIDE, and business impact analysis. Drives industry collaboration on threat intelligence sharing and modeling frameworks.
Authentication & Authorization 2
▼
Understands basic JWT / OAuth2 / OIDC concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Analyzes JWT/OAuth2 security posture: monitors authentication logs for anomalous token usage, reviews OIDC provider configurations for misconfigurations, and assesses token lifecycle policies. Creates security dashboards for authentication metrics. Conducts access reviews for OAuth2 client registrations and scope assignments.
Defines security monitoring strategy for authentication infrastructure. Establishes detection rules, incident response procedures, and compliance requirements for identity systems. Coordinates threat intelligence for authentication-related attacks. Creates security analytics dashboards for organization-wide authentication health monitoring.
Defines enterprise security monitoring strategy for identity infrastructure. Shapes organizational SOC capabilities for authentication threat detection and response. Drives adoption of advanced security analytics for identity-based attacks. Coordinates compliance and regulatory requirements for authentication systems across the enterprise.
Understands basic RBAC / ABAC Authorization concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Analyzes RBAC and ABAC authorization policies for compliance and risk exposure. Reviews access control configurations and identifies excessive permissions. Uses audit tools to monitor authorization events and detect anomalous access patterns.
Defines authorization monitoring and audit strategy for RBAC/ABAC across the organization. Establishes access control review policies and compliance frameworks. Coordinates cross-team access control incident investigations. Trains security analysts on authorization risk analysis methods.
Defines enterprise access control governance strategy spanning RBAC and ABAC across all business units. Shapes authorization analytics architecture for organization-wide visibility. Coordinates with regulators on access control compliance programs. Drives authorization standards in the security community.
Compliance 3
▼
Understands basic GDPR / 152-FZ Compliance concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Applies GDPR/152-FZ compliance in security analysis: monitors data processing activities for regulatory violations, conducts DPIA assessments, and validates data retention policies. Uses DLP tools to detect unauthorized PII transfers.
Defines GDPR/152-FZ compliance monitoring strategy: establishes data processing registers, incident classification criteria, and regulatory reporting workflows. Coordinates with legal team on cross-border data transfer assessments and supervisory authority interactions.
Defines enterprise data protection strategy aligned with GDPR/152-FZ and emerging privacy regulations. Shapes organizational compliance framework spanning multiple jurisdictions. Drives privacy-by-default culture and represents organization in regulatory community.
Understands basic PCI DSS concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Applies PCI DSS controls during security assessments and risk analysis. Monitors compliance status across systems processing cardholder data. Uses scanning and log analysis tools to detect deviations from PCI requirements.
Defines PCI DSS compliance monitoring strategy across the organization. Establishes security analytics policies for cardholder data environments. Coordinates incident response and forensic analysis for PCI breaches. Trains analysts on PCI assessment methodologies.
Defines enterprise PCI DSS compliance and risk management strategy. Shapes security monitoring architecture for cardholder data across all business units. Coordinates with external auditors and payment networks on compliance programs. Drives industry standards adoption.
Understands basic SOC2 Compliance concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Applies SOC 2 compliance frameworks in daily security operations. Conducts control testing, collects audit evidence, and maintains documentation for Trust Services Criteria across availability, security, and confidentiality.
Defines SOC 2 compliance program spanning all Trust Services Criteria. Establishes control frameworks, manages audit relationships, coordinates remediation of control gaps, and trains cross-functional teams on compliance requirements.
Defines enterprise-wide compliance strategy across SOC 2, ISO 27001, and related frameworks. Shapes organizational security architecture for multi-framework compliance, drives automation of compliance processes, and serves as executive liaison to audit firms.
Docs-as-Code 1
▼
Understands the fundamentals of Diagramming: Mermaid, PlantUML, D2. Applies basic practices in daily work. Follows recommendations from the team and documentation.
Applies Mermaid, PlantUML, or D2 to build threat model diagrams, basic attack trees, and network topology maps. Understands trade-offs between diagram formats for security documentation. Creates incident flow visuals independently.
Defines diagramming strategy for threat modeling, attack surface visualization, and incident response documentation. Establishes standards for security architecture diagrams, network topology maps, and compliance visuals. Conducts reviews of security diagram accuracy and completeness.
Defines organization-wide diagramming strategy for enterprise threat modeling, security architecture documentation, and compliance reporting visuals. Establishes enterprise approaches to attack surface mapping and incident response diagramming. Mentors leads and architects on security visualization standards.
Incident Response 3
▼
Understands basic Digital Forensics concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Performs initial forensic triage on security alerts using log analysis and artifact collection. Preserves digital evidence following established procedures and chain of custody requirements. Uses forensic imaging tools to create verified copies of affected systems for detailed investigation.
Defines the organization's digital forensics strategy including tooling, processes, and team capabilities. Establishes forensic readiness policies ensuring systems produce investigation-quality logs and artifacts. Coordinates forensic investigations with legal counsel and law enforcement when required.
Defines enterprise digital forensics strategy aligned with legal, compliance, and business continuity requirements. Shapes forensic architecture across all environments ensuring investigation readiness at scale. Represents the organization in industry forensic communities and drives adoption of advanced forensic methodologies.
Understands basic Incident Response Process concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Executes incident response procedures including detection, containment, and initial investigation. Classifies incidents by severity using established criteria and escalates appropriately. Performs log analysis and IOC correlation in SIEM to determine attack scope and impact on affected systems.
Defines the organization's incident response framework including team structure, escalation paths, and communication plans. Establishes incident classification standards, SLAs for response times, and post-incident review processes. Coordinates tabletop exercises and drives continuous improvement of IR capabilities.
Defines enterprise-wide incident response strategy aligned with business risk management and regulatory requirements. Shapes the security operations architecture including SOAR, threat intelligence, and automated response capabilities. Represents the organization to regulators, partners, and industry bodies on incident management practices.
Understands basic Vulnerability Management concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Triages and prioritizes vulnerabilities based on risk scoring, asset criticality, and threat context. Monitors vulnerability feeds and correlates with organizational exposure. Uses vulnerability management platforms to generate remediation reports and track SLA compliance across teams.
Defines vulnerability management program strategy with risk-based metrics and executive reporting. Establishes vulnerability triage policies, remediation SLAs, and exception management processes. Coordinates organization-wide vulnerability response during zero-day events. Trains security analysts on vulnerability intelligence and prioritization.
Defines enterprise vulnerability governance strategy with board-level risk reporting and compliance alignment. Shapes vulnerability intelligence architecture integrating internal and external threat data at scale. Coordinates with regulators and industry consortiums on vulnerability management frameworks. Drives organizational resilience through proactive vulnerability programs.
Infrastructure Security 4
▼
Understands basic Cloud Infrastructure Security concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Monitors cloud environments using SIEM platforms and CloudTrail analysis. Conducts security reviews of cloud resource configurations. Uses cloud-native detection tools to identify suspicious activity, analyze security events, and escalate confirmed threats for incident response.
Defines cloud security monitoring strategy using SIEM, CloudTrail, and cloud-native detection services. Establishes cloud security policies and alert triage procedures. Coordinates cloud incident response across distributed teams and trains analysts on cloud threat intelligence and forensic investigation methods.
Defines enterprise cloud security monitoring and detection strategy across multi-cloud environments. Shapes security operations architecture including SOC modernization for cloud workloads. Coordinates compliance with industry security standards and represents the organization in cloud security threat intelligence sharing communities.
Understands basic Kubernetes Security concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Monitors Kubernetes clusters for security events using Falco and audit logs. Analyzes container runtime behavior to detect anomalous activity and potential breaches. Investigates Kubernetes-specific security alerts including unauthorized API access, privilege escalation, and suspicious pod deployments.
Defines organization-wide Kubernetes security monitoring and incident response strategy. Establishes detection engineering standards for container runtime, orchestration events, and service mesh telemetry. Coordinates security operations coverage for multi-cluster environments and drives adoption of runtime protection platforms.
Defines enterprise container security strategy integrating Kubernetes security into the broader security operations framework. Shapes security architecture for cloud-native workloads at organizational scale with automated compliance and policy enforcement. Represents the organization in Kubernetes security communities and influences upstream security features.
Understands basic Network Security concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Independently monitors and investigates network security events using SIEM and IDS/IPS platforms. Correlates firewall logs, NetFlow data, and DNS queries to detect lateral movement and C2 communication. Tunes IDS signatures to reduce false positives and documents network-based indicators of compromise for incident response playbooks.
Leads the team's network security monitoring and response capabilities: defines SIEM use cases for network threat detection, establishes SLAs for network incident triage, and builds runbooks for common network attack patterns. Coordinates with SOC and infrastructure teams to ensure comprehensive network visibility and drives adoption of NDR (Network Detection and Response) solutions.
Defines the organization's network threat intelligence and detection strategy: architects enterprise-wide network security monitoring covering on-prem, cloud, and hybrid environments. Establishes network forensics standards, drives investment in NDR and SIEM capabilities, and sets organizational benchmarks for mean-time-to-detect network-based threats. Represents the company in industry threat-sharing consortiums and shapes network security policy at the board level.
Understands basic Secrets Management concepts. Follows security guidelines. Recognizes common code vulnerabilities.
Monitors secrets usage patterns for security anomalies: analyzes Vault audit logs, detects unauthorized access attempts, and tracks secret lifecycle compliance. Conducts periodic access reviews for secret-consuming services. Uses SIEM integration for secrets-related incident detection.
Defines security monitoring strategy for secrets infrastructure. Establishes audit policies for Vault operations, compliance reporting requirements, and secret lifecycle governance. Coordinates incident response for organization-wide credential compromise. Creates threat intelligence integration for credential-based attacks.
Defines enterprise security monitoring strategy with secrets management as a critical component. Shapes organizational security operations center (SOC) capabilities for credential-based threat detection. Drives adoption of advanced security analytics and threat intelligence for secrets protection. Represents the organization in security industry forums and standards bodies.
Logging 1
▼
Understands the fundamentals of ELK Stack for security event analysis. Navigates Kibana dashboards to monitor SIEM alerts and security events. Applies basic KQL and Lucene queries to filter logs by severity, source IP, and event type. Follows SOC playbooks for initial triage using Elasticsearch data.
Configures ELK Stack as a core SIEM platform for threat detection. Builds Logstash pipelines to normalize and enrich security events from firewalls, IDS/IPS, and endpoint agents. Creates Kibana dashboards for SOC operations with drill-down capabilities. Writes Elasticsearch detection rules and correlation queries for known TTPs. Participates in on-call rotation and performs initial incident analysis.
Defines the product's security observability strategy built on ELK Stack. Establishes SLO-based approach for SOC operations: alert quality, detection coverage by MITRE ATT&CK matrix, and analyst response times. Coordinates incident management across security, DevOps, and engineering through unified Elasticsearch indices and Kibana spaces. Drives migration strategies between Elastic and OpenSearch based on licensing and cost analysis. Optimizes MTTD/MTTR through automated triage pipelines and Logstash enrichment workflows.
Defines the organization's security observability strategy with ELK Stack as the enterprise SIEM backbone. Implements platform solutions: multi-cluster Elasticsearch with cross-cluster search for global threat visibility, centralized detection-as-code repositories with CI/CD deployment to Elasticsearch. Builds reliability culture with SLO frameworks for log ingestion latency, detection coverage by kill chain phase, and SOC analyst efficiency metrics. Establishes enterprise governance for security data classification, retention policies aligned with regulatory requirements, and Kibana RBAC across business units.
Specialized Testing 1
▼
Understands security testing from an analytical perspective: vulnerability assessment reports interpretation, security scan result analysis, and risk rating methodologies (CVSS). Monitors security scanning dashboards and tracks remediation progress. Follows team practices for vulnerability management workflows.
Independently analyzes security testing results: correlates vulnerability scan findings across tools, assesses risk impact for business-critical applications, and tracks remediation SLA compliance. Creates vulnerability management reports and trend analysis. Conducts threat modeling sessions to prioritize security testing efforts.
Defines security analysis and vulnerability management strategy. Establishes vulnerability scanning policies, risk assessment frameworks, and remediation SLA requirements. Coordinates threat intelligence integration for security testing prioritization. Creates security analytics capabilities for organization-wide vulnerability visibility.
Defines enterprise security monitoring and vulnerability management strategy. Shapes organizational security analytics capabilities and risk management frameworks. Drives adoption of advanced threat detection and automated security assessment at scale. Coordinates compliance requirements and industry standards for security testing practices.
Supply Chain Security 1
▼
Understands basic supply chain security concepts: SBOM generation, dependency vulnerability databases (NVD, OSV), and package provenance verification. Follows security guidelines for triaging dependency alerts and documenting component inventories. Recognizes common supply chain risks in third-party software.
Applies supply chain security analysis in daily work: reviews SBOM outputs for vulnerability exposure, tracks CVE impact across dependency graphs, and assesses third-party component risks. Uses SCA scanning tools to monitor software composition and produces risk reports for stakeholders.
Defines organizational supply chain security strategy: establishes SBOM compliance requirements, vulnerability SLA policies, and third-party risk assessment frameworks. Coordinates incident response for dependency compromises across teams. Trains analysts on supply chain threat intelligence and regulatory compliance.
Defines enterprise security strategy for software supply chain: shapes SBOM adoption across the organization, evaluates emerging standards (SLSA, VEX, OpenSSF Scorecard), and coordinates regulatory compliance. Represents the organization in the security community and influences industry supply chain practices.
Technical Documentation 2
▼
Understands the fundamentals of architecture documentation including C4 diagrams and arc42 templates. Can read threat models and security architecture documents. Follows team guidelines when documenting security controls and their placement within the system architecture. Creates basic security component diagrams under guidance.
Independently creates security architecture documentation using C4 diagrams at context, container, and component levels. Writes ADRs for security-related decisions such as authentication flows and encryption strategies. Understands trade-offs between documentation granularity and maintenance overhead in security contexts. Documents trust boundaries and data classification in arc42 security sections.
Defines the security architecture documentation strategy at the team and product level. Establishes standards for documenting security boundaries, data flows, and threat models using C4 and arc42. Conducts security architecture reviews ensuring ADRs properly capture risk decisions, compliance rationale, and mitigation strategies. Drives adoption of security documentation practices across development teams through templates and review checklists.
Defines security architecture documentation strategy at the organizational level. Establishes enterprise-wide standards for documenting security architectures using C4 and arc42 aligned with compliance frameworks (SOC 2, ISO 27001, NIST). Creates cross-organizational ADR governance for security decisions ensuring traceability from threat models to implemented controls. Mentors leads and architects on integrating security documentation into the overall architecture documentation lifecycle.
Understands the role of runbooks in SOC operations and alert triage. Follows existing playbooks for common alert types: phishing, malware detection, unauthorized access attempts. Documents incident handling steps and escalation decisions.
Independently writes SOC runbooks for alert investigation: SIEM correlation rule triage, endpoint detection response workflows, threat intelligence integration procedures. Understands trade-offs between automated SOAR playbooks and manual analyst decision points.
Defines runbook strategy for SOC operations at the team level: establishes playbook governance frameworks, drives SOAR-integrated automated response procedures, creates runbook effectiveness metrics tied to MTTD and MTTR improvements.
Defines organizational strategy for security operations runbooks: establishes enterprise-wide incident response playbook standards aligned with NIST and ISO 27001, drives cross-functional runbook integration between SOC, IT operations, and business units, creates executive communication playbooks for major security incidents.