What a Junior } should know

Studies TCP/IP, DNS, HTTP/HTTPS basics, OSI model. Understands firewall, NAT, VPN operation. Uses nslookup, ping, traceroute, netstat for diagnostics. Configures Security Groups in AWS. Understands TLS handshake and X.509 certificate principles for connection security.

Studies AWS Security Hub, IAM best practices, S3 bucket policies. Configures MFA for root account and IAM users. Applies AWS Config rules for basic compliance. Uses ScoutSuite for automated cloud account security audit and misconfiguration detection.

Configures Snyk and Dependabot for automated project dependency scanning. Studies CVE reports, understands CVSS vulnerability scoring. Updates vulnerable dependencies through Dependabot auto-merge for patch versions. Uses npm audit and pip audit for local checks.

Studies incident response fundamentals: NIST phases (Preparation, Detection, Containment, Eradication, Recovery). Participates in on-call rotation under senior engineer mentorship. Documents incidents in tracking system. Masters basic tools: PagerDuty, OpsGenie, Slack incident bot.

Studies JWT basics: token structure (header, payload, signature), signing algorithms (HS256, RS256). Configures OAuth 2.0 Authorization Code flow for web application. Understands difference between access token and refresh token. Uses jwt.io for token debugging and validation.

Studies Kubernetes security fundamentals: RBAC, ServiceAccount, SecurityContext. Configures Pod Security Standards (Restricted). Runs Trivy for image scanning in cluster. Applies NetworkPolicies for basic pod segmentation. Understands least privilege principles for containers.

Studies network security fundamentals: firewall rules, VPN, TLS/SSL. Configures Security Groups and NACLs in AWS. Understands Defense in Depth and network segmentation principles. Uses Wireshark for basic traffic analysis. Configures HTTPS with Let's Encrypt for web applications.

Studies OWASP Top 10 vulnerabilities: SQL injections, XSS, CSRF, SSRF. Completes OWASP WebGoat and Juice Shop labs. Uses OWASP Cheat Sheets for understanding basic web application threats. Configures OWASP Dependency-Check locally for dependency analysis.

Studies access control models: RBAC (Role-Based), ABAC (Attribute-Based), DAC and MAC. Configures basic RBAC in application with admin, editor, viewer roles. Applies Kubernetes RBAC with Roles and ClusterRoles. Understands least privilege and separation of duties principles.

Runs SonarQube and Semgrep locally for static code analysis. Studies SAST reports, classifies vulnerabilities by severity. Configures basic DAST scan with OWASP ZAP against test application. Understands difference between SAST, DAST and IAST approaches to security testing.

Installs HashiCorp Vault in dev mode, studies basic operations: reading/writing secrets via CLI and API. Configures KV secrets engine v2 with versioning. Understands zero-trust principle for secrets in code. Uses Vault Agent for automated token rotation.

Studies secure coding principles: input validation, parameterized queries, proper password hashing (bcrypt/Argon2). Applies encoding for XSS prevention. Uses OWASP Secure Coding Practices Quick Reference Guide in daily development.

Understands basic SBOM concepts: software bill of materials formats (SPDX, CycloneDX), dependency tracking, and license compliance fundamentals. Follows security guidelines for reviewing dependency vulnerabilities using automated scanning tools. Recognizes common supply chain attack vectors.

Studies STRIDE and DREAD threat modeling methodologies. Participates in threat modeling sessions under senior engineer guidance. Documents identified threats in standard format. Uses OWASP Threat Dragon for visualizing DFD data flow diagrams.

Studies vulnerability management process: scanning, prioritization, patching. Runs Nessus/OpenVAS for basic infrastructure scanning. Understands CVSS scoring and vulnerability classification. Tracks CVEs in NVD. Creates tickets for vulnerability remediation with description and fix guidance.