What a Mid-level } should know

Understands the TCP/IP stack. Configures TLS/SSL. Works with load balancers and reverse proxies (nginx). Understands DNS resolution and TTL. Debugs network issues (tcpdump, wireshark basics).

Applies cloud security principles to application workloads. Conducts security reviews of cloud-native apps using CSPM tools. Performs container image scanning and serverless function analysis to identify misconfigurations and vulnerabilities in deployment pipelines.

Independently configures and maintains SCA tools (Snyk, Dependabot, Trivy) across multiple repositories. Analyzes transitive dependency trees to assess real exploitability of reported CVEs. Understands trade-offs between auto-merge policies for patch updates and manual review for major version bumps. Integrates dependency scanning into CI/CD pipelines with appropriate break-build thresholds.

Applies digital forensics techniques to investigate application security incidents. Collects and preserves application logs, memory dumps, and network captures maintaining chain of custody. Uses forensic tools (Volatility, Autopsy) to analyze artifacts from compromised web applications.

Applies GDPR/152-FZ compliance in application security: conducts privacy-focused code reviews, implements data minimization checks, and validates consent management flows. Uses SAST tools to detect PII exposure and logging violations.

Participates in application security incident response following established playbooks. Triages security alerts related to application vulnerabilities (SQLi, XSS, SSRF). Collects application logs and artifacts for investigation and communicates findings to the incident commander clearly.

Validates JWT/OAuth2 implementations in applications: reviews token validation logic, audits OAuth2 flow configurations for security weaknesses, and tests for common JWT attacks (algorithm confusion, claim injection). Conducts security code reviews focusing on authentication middleware. Uses tools like jwt.io and Burp Suite for token analysis.

Applies Kubernetes security practices to containerized applications including pod security standards, network policies, and RBAC configurations. Scans container images for vulnerabilities using Trivy or Snyk. Reviews Kubernetes manifests for security misconfigurations and hardening compliance.

Independently configures and audits network security controls protecting application infrastructure: WAF rules, reverse proxy hardening, TLS certificate management. Analyzes network traffic for signs of application-layer attacks (SQLi over HTTP, SSRF, DNS exfiltration). Integrates IDS/IPS alerts with application security monitoring workflows.

Applies OWASP Top 10 and application security practices to secure development workflows. Conducts security-focused code reviews identifying injection, authentication, and access control vulnerabilities. Uses SAST/DAST tools (SonarQube, Burp Suite, OWASP ZAP) for automated vulnerability scanning and triage.

Applies PCI DSS requirements when reviewing application security architecture. Conducts security code reviews focused on cardholder data handling and encryption. Uses vulnerability scanning tools to verify PCI compliance across services.

Implements RBAC and ABAC authorization models in application security reviews. Conducts code reviews focused on access control logic and permission enforcement. Uses static analysis tools to detect authorization bypass vulnerabilities in application code.

Configures and runs SAST/DAST tools to identify vulnerabilities in application code and running services. Conducts security code reviews using static analysis findings as input. Triages scanner results, eliminates false positives, and tracks confirmed issues to resolution.

Integrates secrets management into application security workflows: scans codebases for hardcoded secrets (TruffleHog, git-secrets), reviews Vault policies for least-privilege access, and validates secret rotation procedures. Conducts security code reviews focusing on credential handling patterns.

Applies secure coding practices in application security workflows — conducts in-depth security code reviews identifying injection, authentication, and cryptographic weaknesses. Uses SAST tools (Semgrep, CodeQL) for automated vulnerability detection and develops custom security rules for organization-specific risk patterns.

Implements SOC 2 security controls in application architecture: access logging, encryption at rest/in transit, and vulnerability management. Conducts security code reviews aligned with Trust Services Criteria.

Applies SBOM and supply chain security practices in CI/CD pipelines: integrates SCA tools (Snyk, Grype, Trivy), enforces license policies, and automates vulnerability patching workflows. Conducts security reviews of dependency trees and evaluates third-party component risks for production applications.

Independently conducts threat modeling sessions for application components using STRIDE methodology. Builds data flow diagrams and identifies trust boundaries. Prioritizes threats using DREAD or risk matrices. Integrates threat modeling into SDLC gates and tracks remediation of identified risks.

Manages vulnerability lifecycle from discovery to remediation in application environments. Conducts security code reviews to validate and classify identified vulnerabilities. Uses vulnerability scanners and tracking tools to maintain accurate inventory of application security issues.