What a Mid-level } should know

Writes E2E security tests: login/logout flows, session hijacking prevention, CSRF protection, file upload security. Uses Selenium/Playwright with security focus.

Writes integration tests for security: authentication flows, authorization checks across services, session management. Tests security middleware and filters.

Conducts security load testing: DDoS simulation, brute-force resistance testing, rate limiting verification. Uses k6/Locust for security load tests.

Applies property-based testing for security: random input generation for fuzzing, invariant checking for authorization rules. Uses Hypothesis/QuickCheck for security properties.

Conducts security testing: OWASP Top 10 verification, vulnerability scanning (ZAP/Burp), dependency checking (Snyk). Documents findings with reproducible steps.

Applies BDD for security requirements: Gherkin scenarios for authentication, authorization rules, compliance requirements. TDD for security utility functions.

Manages test data for security: sanitized production data, synthetic PII generation, credential management for test environments. Ensures compliance in test data.

Manages security test environments: isolated environments for penetration testing, sandboxed environments for malware analysis. Configures network isolation.

Applies test pyramid for security: unit tests for validation functions, integration for auth flows, E2E for critical security paths. Balances coverage and speed.

Writes unit tests for security code: input validation functions, encoding/escaping, cryptographic helpers. Tests edge cases and boundary values.