What a Senior } should know

Applies algorithmic thinking to security testing: fuzzing algorithms for input space exploration, graph-based algorithms for attack surface analysis, risk scoring algorithms for vulnerability prioritization. Designs efficient algorithms for automated security regression testing and compliance checking.

Designs code quality standards for security testing frameworks: DAST scanner configurations, fuzzing harness structure, security regression test suites. Refactors vulnerability detection scripts for accuracy and false-positive reduction. Establishes review practices for security test coverage and compliance mapping.

Selects optimal data structures for security testing: vulnerability database models for efficient lookup, graph structures for attack surface mapping, indexed structures for compliance evidence storage. Optimizes fuzzing input data structures for maximum coverage. Designs efficient data models for security finding deduplication and risk scoring.

Designs security testing framework: abstractions for different scanner backends, plugin architecture for custom checks, Builder pattern for complex attack scenarios.

Integrates API testing tools into security pipeline: ZAP in CI/CD, custom Burp extensions, nuclei templates for company-specific vulnerabilities. Automates regression security testing.

Designs API security testing strategy: automated schema validation, business logic security tests, race condition testing. Implements custom API fuzzing. Tests GraphQL/gRPC security.

Designs container scanning strategy: multi-layer scanning (base → app → runtime), policy-as-code, automated remediation. Integrates with vulnerability management platform.

Designs container security testing: automated image scanning pipeline, runtime behaviour analysis, CIS benchmark compliance. Integrates container security into SDLC.

Designs security CI/CD integration: shift-left security testing, pre-commit hooks, mandatory security gates. Implements custom actions for organization-specific checks.

Designs E2E security testing: critical user journey security (payment, PII handling), browser security (XSS, clickjacking), multi-step attack scenarios.

Designs security integration testing: cross-service auth testing, API gateway security validation, database access control verification. Automates via test containers.

Designs security performance testing: API rate limiting validation, authentication under load, resource exhaustion attacks. Defines security performance baselines.

Designs property-based security tests: stateful testing for authentication flows, model-based testing for RBAC, generative fuzzing for input validation.

Designs security testing program: risk-based testing strategy, automated vulnerability scanning pipeline, manual penetration testing scope. Integrates with bug bounty.

Designs BDD approach for security: security acceptance criteria templates, automated compliance scenarios, integration with threat models. Implements security behavior specifications.

Designs security test data strategy: data masking for PII, synthetic attack payloads library, secure credential vault for testing. Automates test data provisioning.

Designs security testing infrastructure: ephemeral environments for DAST, isolated networks for pentest, vulnerable-by-design targets (DVWA, Juice Shop).

Designs security test pyramid: SAST as 'unit-level', DAST as 'integration', penetration testing as 'E2E'. Determines optimal effort distribution.

Designs unit testing for security modules: comprehensive test suites for auth/authz logic, parameterized tests for injection payloads, mutation testing for security-critical code.

Designs cloud security testing program: continuous compliance monitoring, infrastructure-as-code security (tfsec, Checkov), multi-cloud assessment. Implements custom checks.

Designs SCA strategy: multi-tool approach (Snyk + Grype), SBOM generation, supply chain security (SLSA). Implements risk-based prioritization with exploit prediction scoring.

Designs compliance testing strategy for GDPR/152-FZ: automated privacy regression tests, data subject rights verification, and consent flow validation suites. Implements continuous compliance monitoring in CI/CD with privacy-focused test scenarios.

Designs security incident response: automated detection (SIEM correlation), playbooks for typical incidents, forensics capabilities. Integrates with vulnerability management.

Designs auth security testing: automated token manipulation suite, OAuth flow testing matrix, SSO security verification. Tests PKCE, DPoP, token binding.

Designs K8s security testing: automated CIS compliance checking, runtime threat detection (Falco), supply chain verification (Sigstore). Tests multi-tenancy isolation.

Designs network security testing: automated network scanning pipeline, infrastructure penetration testing, zero-trust architecture validation. Tests microsegmentation.

Designs OWASP-based testing program: ASVS compliance verification, automated OWASP checks in CI, risk-based testing by OWASP categories. Maintains regression test suite per OWASP.

Designs comprehensive PCI DSS security testing strategies for payment systems. Builds automated test suites validating PCI compliance across environments. Implements threat-based testing scenarios for cardholder data flows. Mentors QA team on PCI testing practices.

Designs authorization testing framework: automated permission matrix verification, policy-based testing, cross-service authorization checks. Tests complex ABAC rules.

Designs SAST/DAST strategy: tool selection by technology stack, custom rules for business logic, finding correlation between SAST and DAST. Creates custom Semgrep/CodeQL rules.

Designs secure code review process: automated checks (Semgrep rules), manual review guidelines, secure coding standards per language. Creates secure coding training materials.

Designs threat modeling process: automated threat modeling (OWASP Threat Dragon, IriusRisk), organizational threat library, SDLC integration. Translates threats into security tests.

Designs vulnerability management program: risk-based prioritization (EPSS, threat intelligence), automated scanning pipeline, metrics (mean time to remediate). Integrates with SIEM.

Maximizes productivity: generates custom SAST rules (Semgrep), threat model templates, incident response playbooks. Workflow: AI for boilerplate, engineer for security analysis.

Designs security log analysis: custom detection rules, threat hunting queries, MITRE ATT&CK mapping. Configures anomaly detection. Implements security analytics pipeline.

Designs security metrics framework: security KPIs (MTTD, MTTR, vulnerability density), automated reporting, trend analysis. Integrates security metrics with business risk.

Designs security logging requirements: mandatory security events, forensic data requirements, compliance logging. Creates security logging testing framework.

Conducts architectural security review: threat model validation, trust boundary verification, data flow security. Reviews security-critical components.

Designs security documentation framework: threat model docs, security architecture docs, automated evidence collection for compliance. Versions security policies.

Defines Git security practices: pre-commit hooks for secret detection, signed commits, branch protection for security policies. Configures git for compliance.