Template

Cybersecurity Engineer — Competency Roadmap

Work towards being a cybersecurity engineer: understanding how systems are attacked and defended across networks, operating systems, applications and cloud, and building the practical skills to do it lawfully.

This comprehensive roadmap guides you from zero technical background to the full competency profile of a cybersecurity engineer through hands-on labs and builds. Working through it at 10 hours per week comes to roughly three to five months, which walks the territory rather than exhausting it. You will build private virtual test networks, dissect raw network protocols, harden Linux and Windows environments, implement applied cryptography, audit web application vulnerabilities, secure cloud infrastructure, and deploy automated monitoring and threat-detection pipelines. By the end of this plan, you will have configured and defended a multi-tier hybrid architecture with documented incident response playbooks, automated security scanning pipelines, and reproducible evidence of offensive and defensive security implementations.

By the end: You will be able to design, implement, and audit defensive controls across networks, operating systems, web applications, and cloud environments, write automated security tools in Python and Bash, and detect and mitigate simulated multi-stage cyber attacks in a fully documented home lab environment.

Starting levelBeginnerStyleBuilding things
10h / week11 phases32 tasks~177h total

This is the map — make this roadmap yours

It shows what this journey generally looks like. Tell Kaidoro your version of the goal and it builds the plan around where you are actually starting, what to do first, the hours you really have, and what you have already finished.

1

Computer Networking & Traffic Analysis Fundamentals

Master core networking protocols, routing, and traffic inspection by building a local virtual lab. Networking is the foundational medium of almost all attacks and defenses.

  • Build a multi-subnet virtual laboratory in VirtualBox
    ~6hBuild1 resource

    An isolated hypervisor environment is mandatory for running safe security drills, malware analysis, and packet capture without endangering real hardware or networks.

    You'll learn

    • VirtualBox Internal Networking — hypervisor network adapter mode isolating guests from host traffic
    • pfSense / OPNsense — open-source FreeBSD-based firewall and routing platform
    • Subnet Masking — CIDR notation determining network and host bit boundaries
    • Default Gateway — the routing node that forwards traffic across disparate subnets

    Set up an isolated host-only network environment with an internal gateway/router virtual machine (such as pfSense or OPNsense) and two separate host networks. Configure static routing and DHCP pools to understand how network segments isolate traffic.

    Done when: your host machine can route traffic through the virtual router between subnet A and subnet B while remaining isolated from your home local network.

    How to work through it

    1. Install Oracle VirtualBox and extension packs
    2. Download and install a pfSense or OPNsense ISO onto a primary VM
    3. Configure two distinct internal virtual networks in VirtualBox settings
    4. Assign static IPs and configure DHCP services for both internal subnets
    5. Verify connectivity by pinging across subnets via the virtual firewall
  • Capture and dissect TCP, UDP, and DNS traffic using Wireshark
    ~4hPractice1 resource

    Security engineers must recognize normal packet flow at the byte and flag level before they can detect anomalies or protocol abuse.

    You'll learn

    • Wireshark — GUI packet analyzer for real-time network protocol inspection
    • TCP Three-Way Handshake — SYN, SYN-ACK, and ACK synchronization mechanism establishing reliable streams
    • Display Filters — Wireshark expression syntax for isolating targeted protocol fields
    • Address Resolution Protocol (ARP) — layer 2 protocol mapping IP addresses to physical MAC addresses

    Generate standard network requests (HTTP, DNS lookup, TCP handshakes, ICMP pings) and inspect the raw packet structures in Wireshark. Filter packets using Berkeley Packet Filters (BPF) and display filters to trace three-way handshakes and state flags.

    Done when: you can export a PCAP file containing an annotated three-way TCP handshake (SYN, SYN-ACK, ACK), an explicit DNS query/response pair, and an ARP resolution exchange.

    How to work through it

    1. Install Wireshark on a virtual machine in your lab
    2. Start capturing traffic on the primary network interface
    3. Perform a manual DNS query using nslookup or dig
    4. Establish an unencrypted HTTP session and capture full payload streams
    5. Apply Wireshark display filters (tcp.flags.syn==1, dns, arp) and document header fields
  • Execute and analyze targeted Nmap network scans
    ~5hPractice1 resource

    Network reconnaissance is the first phase of an attack; understanding how scanners elicit responses is essential for both firewall configuration and intrusion detection.

    You'll learn

    • Nmap — open-source network exploration tool and security scanner
    • SYN Stealth Scan (-sS) — half-open scanning technique avoiding full TCP connection completion
    • RST Packet — TCP flag returned by closed ports indicating connection termination
    • NSE (Nmap Scripting Engine) — Lua scripts automating vulnerability checks and service enumeration

    Run various Nmap scan types (TCP SYN scan, TCP Connect scan, UDP scan, OS detection, and NSE script scans) against your lab hosts. Inspect the resulting packet traces in Wireshark side-by-side to understand what traffic each scan type emits and what triggers detection.

    Done when: you have generated a comparative matrix document mapping Nmap scan flags (-sS, -sT, -sU, -sV) to their exact packet signatures observed in Wireshark.

    How to work through it

    1. Install Nmap on a Linux VM in your virtual lab
    2. Run a stealth SYN scan (-sS) against a target VM while recording packet capture
    3. Run a full TCP Connect scan (-sT) and compare open vs closed port responses
    4. Execute an Nmap Scripting Engine (NSE) banner-grabbing scan (-sV -sC)
    5. Document the distinct packet flags emitted by each scanning mode
  • Configure stateful firewall rules and NAT on pfSense
    ~5hBuild1 resource

    Configuring network boundaries and the principle of least privilege at layer 3/4 is the baseline defense of corporate infrastructure.

    You'll learn

    • Stateful Packet Inspection (SPI) — tracking the state of active network connections to dynamically allow return traffic
    • DMZ (Demilitarized Zone) — physical or logical subnet exposing outward-facing services to untrusted networks
    • Port Address Translation (PAT) — mapping multiple private IP addresses to a single public IP using distinct source ports
    • Default-Deny — fundamental security baseline rejecting all traffic unless explicitly permitted

    Build strict ingress and egress firewall rule sets in pfSense. Implement Network Address Translation (NAT), port forwarding for a designated internal DMZ web server, and block inter-VLAN communications by default.

    Done when: an external virtual client can access only port 443 on the DMZ host, while attempts to reach other ports or cross into the internal management VLAN are dropped and logged.

    How to work through it

    1. Create a separate DMZ network interface in pfSense
    2. Configure default-deny ingress rules on all internal interfaces
    3. Add explicit pass rules for DNS and HTTP/HTTPS egress only
    4. Set up port forwarding rules to pass external test traffic to an internal web server
    5. Review pfSense firewall logs to verify dropped connection attempts
2

Linux Systems Internals & Hardening

Gain deep familiarity with Linux administration, file permissions, processes, user security, and OS-level hardening. Linux runs the vast majority of security infrastructure, servers, and cloud workloads.

  • Configure a headless Linux server with SSH key authentication and sudo access
    ~4hBuild1 resource

    Direct root logins and password authentication on SSH are the most frequent entry points for automated credential brute-force attacks.

    You'll learn

    • sshd_config — configuration file controlling daemon behavior and authentication requirements for OpenSSH
    • Ed25519 — high-security elliptic curve public-key signature system
    • Sudoers — configuration file defining root execution delegation rules for standard users
    • Systemd / systemctl — init system and service manager for Linux systems

    Deploy an Ubuntu Server or Debian virtual machine without a graphical interface. Configure non-root administrative users, disable password-based SSH authentication, change standard listening ports, and enforce key-based authentication with Ed25519 key pairs.

    Done when: you can log into the server over SSH using an Ed25519 key pair with password authentication completely rejected by the SSH daemon.

    How to work through it

    1. Install a minimal Ubuntu/Debian Server VM
    2. Create a new standard user and assign sudo privileges via /etc/sudoers.d/
    3. Generate an Ed25519 SSH keypair on your local host and copy the public key
    4. Modify /etc/ssh/sshd_config to set PasswordAuthentication no and PermitRootLogin no
    5. Restart sshd and confirm remote login works with the key while password logins fail
  • Audit and lock down POSIX permissions and SUID binaries
    ~5hPractice1 resource

    SUID binaries execute with the privileges of the file owner (often root); misconfigured binaries are an immediate vector for local privilege escalation.

    You'll learn

    • SUID / SGID (SetUID / SetGID) — special access flags permitting users to execute binaries with owner/group permissions
    • GTFOBins — curated Unix binary list detailing privilege escalation bypass methods
    • Umask — default permission mask applied to newly created files and directories
    • Octal Permission Notation — three-digit numeric representation of rwx permissions

    Investigate standard Linux file permissions (read, write, execute), octal modes, sticky bits, and special permissions (SUID/SGID). Identify misconfigured SUID binaries that could lead to privilege escalation and remediate them.

    Done when: you have executed a script finding all SUID/SGID binaries on the filesystem, analyzed them against GTFOBins, and removed unsafe permission bits.

    How to work through it

    1. Use find / -perm -u=s -type f 2>/dev/null to enumerate all SUID files
    2. Look up each discovered executable on GTFOBins to see if standard abuse primitives exist
    3. Create a deliberate test vulnerability (e.g. SUID bit set on python or find) and exploit it to gain a root shell
    4. Remediate the vulnerability by stripping the SUID bit with chmod u-s
    5. Configure umask 027 as system-wide default in /etc/profile to enforce least privilege on new files
  • Enforce mandatory access controls with AppArmor or SELinux
    ~6hBuild1 resource

    Discretionary Access Control (file permissions) can fail; Mandatory Access Controls contain breaches even when an attacker achieves code execution inside a process.

    You'll learn

    • Mandatory Access Control (MAC) — kernel-enforced access constraints independent of file owner decisions
    • AppArmor — Linux security module utilizing path-based access control profiles
    • SELinux Type Enforcement — label-based access control enforcing strict domain transitions
    • Auditd — Linux audit daemon recording system calls and security events

    Configure and enforce Mandatory Access Control (MAC) profiles on a running service (e.g., NGINX or Apache). Transition a profile from complain/permissive mode into enforce mode, verify that unauthorized file access outside permitted paths is blocked by the kernel, and inspect audit logs.

    Done when: a web server process is physically unable to read a file in /root or /home even if the underlying process runs with read permissions on the file.

    How to work through it

    1. Inspect current system AppArmor/SELinux status using aa-status or sestatus
    2. Create a custom profile for an NGINX web server restricting access strictly to /var/www/html
    3. Attempt to configure NGINX to serve a file from /home/user/
    4. Examine kernel audit logs (/var/log/audit/audit.log or journalctl) to identify access denials
    5. Tune and switch the profile into enforce mode
  • Perform a baseline CIS Benchmark hardening audit on Linux
    ~6hApply1 resource

    Standardizing system configurations against industry benchmarks like CIS is the standard method organizations use to maintain a defensible security posture.

    You'll learn

    • CIS Benchmarks — consensus-based best practice guidelines for hardening system configurations
    • Lynis — extensible open-source security auditing tool for Unix-based systems
    • Kernel Sysctl Hardening — tuning runtime kernel parameters to mitigate network and memory attacks
    • Attack Surface Reduction — disabling unnecessary software, protocols, and kernel modules to minimize exploit paths

    Run an automated auditing engine (such as Lynis) against your Linux server to evaluate compliance against Center for Internet Security (CIS) Benchmarks. Manually resolve high-severity findings including core dumps, unused filesystem protocols, and kernel sysctl parameters.

    Done when: your Lynis hardening index score increases from baseline by at least 20 points, with all critical sysctl and filesystem vulnerabilities resolved.

    How to work through it

    1. Install Lynis on the target Linux system
    2. Run an initial scan using lynis audit system and export the score and recommendations
    3. Harden sysctl settings in /etc/sysctl.d/99-security.conf (disable IP forwarding, enable SYN cookies, disable ICMP redirects)
    4. Disable unused legacy filesystems (cramfs, freevxfs, jffs2, hfs) in /etc/modprobe.d/
    5. Re-run Lynis to verify score improvement and document remaining acceptable risks
3

Windows Architecture & Active Directory Security

Deploy a multi-machine Windows Active Directory domain environment. Enterprise cyber engineering overwhelmingly revolves around securing, auditing, and monitoring Windows identity and domain infrastructure.

  • Deploy a Windows Server Domain Controller and join a Windows workstation
    ~6hBuild1 resource

    Active Directory is the identity backbone for over 90% of Fortune 500 companies; you must understand its architecture to defend it.

    You'll learn

    • Active Directory Domain Services (AD DS) — Microsoft directory service for centralized identity and network management
    • Domain Controller (DC) — Windows server responding to security authentication requests within a domain
    • Kerberos — network authentication protocol using secret-key cryptography and tickets to provide identity proof
    • Organizational Unit (OU) — subdivision within Active Directory into which users, groups, and computers are placed

    Set up a Windows Server 2022 evaluation VM and promote it to an Active Directory Domain Controller (AD DC). Configure DNS, create Organizational Units (OUs), create test users and security groups, and join a Windows 10/11 VM to the domain.

    Done when: a domain user can successfully log into the joined Windows workstation with Kerberos tickets issued by the Domain Controller.

    How to work through it

    1. Install Windows Server 2022 evaluation in your hypervisor
    2. Install Active Directory Domain Services (AD DS) and DNS server roles
    3. Promote the server to a Domain Controller for a test domain (e.g., corp.local)
    4. Create an Organizational Unit structure with administrative and standard user accounts
    5. Join a Windows client VM to the domain and verify domain authentication
  • Enforce endpoint security baseline policies via Group Policy Objects
    ~5hBuild1 resource

    Group Policy allows centralized, automated enforcement of system configurations across thousands of enterprise endpoints simultaneously.

    You'll learn

    • Group Policy Object (GPO) — collection of settings that define how computers and users operate in an AD domain
    • LLMNR / NBT-NS — legacy name resolution protocols frequently abused in poisoned credential-harvesting attacks
    • Windows Event Log — structured diagnostic and security audit logging service in Windows
    • Process Creation Auditing (Event ID 4688) — audit event capturing binary executions and command-line arguments

    Create and link Group Policy Objects (GPOs) to enforce security baselines across domain workstations. Configure User Account Control (UAC) settings, disable legacy NetBIOS and LLMNR protocols, enforce screen locks, and configure advanced Windows Event audit policies.

    Done when: a gpresult /r report on the workstation confirms that LLMNR is disabled and failed logon events (Event ID 4625) are recorded in the security event log.

    How to work through it

    1. Open Group Policy Management Console (gpmc.msc) on the Domain Controller
    2. Create a new GPO named 'Endpoint Security Baseline' linked to the Workstations OU
    3. Disable Link-Local Multicast Name Resolution (LLMNR) to prevent local spoofing attacks
    4. Enable Advanced Audit Policies for Logon/Logoff, Process Creation, and Privilege Use
    5. Run gpupdate /force on the client machine and verify applied policies with gpresult /v
  • Simulate and detect Active Directory attacks with BloodHound and Mimikatz
    ~7hApply1 resource

    Engineers must understand identity attack graphs and credential extraction mechanics to properly architect tiered administration and tier-0 boundaries.

    You'll learn

    • BloodHound — graph theory tool revealing hidden relational attack paths in Active Directory
    • Kerberoasting — attack targeting service account passwords via offline cracking of Kerberos TGS tickets
    • LSASS (Local Security Authority Subsystem Service) — Windows process responsible for enforcing security policy and storing credentials in memory
    • LAPS (Local Administrator Password Solution) — tool managing and rotating unique local admin passwords on domain computers

    Execute common Active Directory attack techniques in your isolated lab: extract Kerberoasting tickets, perform domain enumeration using SharpHound/BloodHound, and simulate LSASS memory credential dumping. Analyze the resulting event logs to see how these attacks leave traces.

    Done when: you have generated a BloodHound graph revealing shortest paths to Domain Admin and written down the specific Windows Event IDs generated by each attack step.

    How to work through it

    1. Create a service account with a registered Service Principal Name (SPN) and weak password
    2. Use a PowerShell script or Rubeus to request a Kerberos TGS ticket (Kerberoasting)
    3. Run SharpHound data collector and import the zip file into BloodHound GUI to map attack paths
    4. Simulate LSASS reading with a controlled tool and check Windows Defender / Event Viewer alerts
    5. Document mitigation controls (AES encryption enforcement, gMSA accounts, LAPS)
4

Applied Cryptography & PKI Implementation

Build a functional Public Key Infrastructure (PKI) and master symmetric encryption, asymmetric encryption, hashing, and digital certificates. This phase can run concurrently with system administration phases.

  • Build a two-tier Public Key Infrastructure (PKI) with OpenSSL
    ~6hBuild1 resource

    PKI is the backbone of zero-trust communication, HTTPS, code signing, and enterprise VPN authentication; building one from scratch demystifies certificate chains.

    You'll learn

    • Certificate Authority (CA) — entity that issues digital certificates validating entity identity
    • X.509 — standard defining the format of public key certificates
    • Subject Alternative Name (SAN) — X.509 extension specifying all domain names/IPs secured by a certificate
    • Certificate Revocation List (CRL) — list of digital certificates that have been revoked before their expiration date

    Create an offline Root Certificate Authority (Root CA) and an intermediate issuing CA using OpenSSL CLI. Generate custom cryptographic configuration files, issue TLS certificates with Subject Alternative Names (SAN), and maintain a Certificate Revocation List (CRL).

    Done when: you issue a TLS certificate signed by your Intermediate CA that validates cleanly in a browser after importing your Root CA into the trusted root store.

    How to work through it

    1. Create an OpenSSL configuration file (openssl.cnf) with extensions for Root and Issuing CAs
    2. Generate an encrypted RSA 4096-bit or ECC private key and self-signed Root CA certificate
    3. Generate an Intermediate CA keypair and Certificate Signing Request (CSR), then sign it with the Root CA
    4. Issue a leaf web server certificate with appropriate Subject Alternative Name (SAN) fields
    5. Construct the full certificate chain bundle and test validation using openssl s_client and verify
  • Implement cryptographic hashing, HMACs, and AES encryption in Python
    ~5hPractice1 resource

    Security engineers often write scripts to verify payload integrity, encrypt sensitive logs, or review code using cryptographic libraries.

    You'll learn

    • AES-GCM (Galois/Counter Mode) — authenticated symmetric encryption providing confidentiality and integrity simultaneously
    • Initialization Vector / Nonce — unique arbitrary number that must never be reused with the same key in stream/counter ciphers
    • HMAC (Hash-based Message Authentication Code) — construction calculating a message authentication code combining a cryptographic hash function with a secret key
    • Cryptographic Salt — random data fed into a one-way function to protect against rainbow table attacks

    Write a Python script utilizing the cryptography library to perform AES-GCM authenticated encryption/decryption, compute SHA-256 integrity hashes, and verify data authenticity with HMAC-SHA256. Handle initialization vectors (IVs) and nonce generation properly.

    Done when: your script successfully encrypts a sample file with AES-256-GCM, verifies its authentication tag during decryption, and throws an integrity error if a single byte is tampered with.

    How to work through it

    1. Install Python 3 and the standard cryptography package (pip install cryptography)
    2. Write a function to generate cryptographically secure random bytes for keys and nonces using os.urandom
    3. Implement AES-GCM encryption returning ciphertext, authentication tag, and nonce
    4. Implement corresponding decryption verifying the authentication tag before returning plaintext
    5. Add an HMAC verification function to demonstrate data integrity checking without full encryption
  • Audit TLS configurations with testssl.sh and harden web server ciphers
    ~4hApply1 resource

    Misconfigured SSL/TLS servers leak sensitive communications and fail compliance standards across financial and enterprise environments.

    You'll learn

    • testssl.sh — free command-line tool which checks a server's service on any port for support of TLS/SSL ciphers and flaws
    • Perfect Forward Secrecy (PFS) — feature of key agreement protocols ensuring session keys remain secure even if server private keys are compromised later
    • HSTS (HTTP Strict Transport Security) — web security policy mechanism forcing web browsers to interact exclusively over HTTPS
    • Diffie-Hellman Key Exchange — method allowing two parties to establish a shared secret over an insecure channel

    Deploy an NGINX or Apache web server using certificates from your PKI. Run testssl.sh or SSLyze against it to audit supported protocols, cipher suites, and key exchange algorithms. Remediate weak ciphers (such as 3DES, RC4, or CBC-mode ciphers) and enforce TLS 1.2 and 1.3 only.

    Done when: a testssl.sh audit reports zero weak ciphers, disables SSLv2/v3 and TLS 1.0/1.1, and enforces Perfect Forward Secrecy (PFS) with HSTS headers enabled.

    How to work through it

    1. Install testssl.sh on your testing VM
    2. Run an initial scan against your lab HTTPS web server and log findings
    3. Update the web server SSL configuration file to restrict protocols to TLSv1.2 and TLSv1.3
    4. Configure ECDHE cipher suites to enforce Perfect Forward Secrecy
    5. Add HTTP Strict Transport Security (HSTS) response headers and re-audit
5

Web Application Security & Threat Assessment (AppSec)

Understand how web applications break, how attackers exploit vulnerabilities (OWASP Top 10), and how developers and security engineers remediate them with defensive coding practices.

  • Intercept and manipulate HTTP traffic with Burp Suite Community
    ~4hPractice1 resource

    Burp Suite is the industry-standard proxy for application security auditing, security code reviews, and penetration testing.

    You'll learn

    • Burp Suite — integrated platform for performing security testing of web applications
    • Intercepting Proxy — proxy server placed between client and server to monitor and alter web traffic
    • Burp Repeater — tool for modifying and resending individual HTTP requests to observe behavior
    • OWASP Juice Shop — intentionally insecure modern web application for security practice

    Deploy an intentionally vulnerable application (such as OWASP Juice Shop or OWASP WebGoat) locally via Docker. Configure your browser to proxy all traffic through Burp Suite, inspect request/response headers, and modify parameters in the Burp Repeater module.

    Done when: you can intercept a checkout or login request, alter a price or user-role parameter in Burp Repeater, and observe the application's modified response.

    How to work through it

    1. Install Docker and run OWASP Juice Shop in a container
    2. Install Burp Suite Community Edition and import its CA certificate into your browser
    3. Browse the application and review the HTTP history in Burp Proxy
    4. Send an HTTP POST request to Burp Repeater
    5. Modify payload variables, replay the request, and analyze status codes and reflection
  • Exploit and remediate SQL Injection (SQLi) and Cross-Site Scripting (XSS)
    ~6hPractice1 resource

    SQLi and XSS remain ubiquitous vulnerabilities; knowing both the exploitation mechanism and the precise code remediation is central to AppSec.

    You'll learn

    • SQL Injection (SQLi) — code injection technique exploiting unfiltered database queries
    • Parameterized Queries — database coding practice separating SQL statements from user-supplied parameters
    • Cross-Site Scripting (XSS) — client-side code injection where malicious scripts are executed in victim browsers
    • Content Security Policy (CSP) — HTTP header restricting sources of scripts, images, and other resources

    Locate and exploit both in-band SQL Injection and Stored/Reflected Cross-Site Scripting vulnerabilities inside your test application. Write defensive code snippets demonstrating parameterized queries / prepared statements and contextual HTML entity encoding.

    Done when: you demonstrate a SQL bypass authentication payload, followed by providing a code patch using parameterized queries that completely neutralizes the attack vector.

    How to work through it

    1. Identify an input parameter vulnerable to SQL injection (e.g., ' OR '1'='1)
    2. Extract database schema names or user hashes using UNION-based injection payloads
    3. Identify an input reflecting user payload without sanitization to trigger an XSS alert box
    4. Write a backend database query using Prepared Statements in Python or PHP to remediate SQLi
    5. Implement Content Security Policy (CSP) headers to mitigate XSS impact
  • Integrate SAST and DAST vulnerability scanners into a CI/CD pipeline
    ~6hApply1 resource

    Modern security engineers build automated guardrails in software delivery pipelines to catch security defects before code reaches production.

    You'll learn

    • SAST (Static Application Security Testing) — analysis of source code from the inside without executing the application
    • SCA (Software Composition Analysis) — automated scanning identifying known vulnerabilities in third-party dependencies
    • Secret Scanning — automated scanning of code commits to prevent credential and API key exposure
    • SARIF (Static Analysis Results Interchange Format) — standard JSON format for output of static analysis tools

    Create a local or GitHub Actions CI/CD pipeline for a sample web application. Integrate Static Application Security Testing (SAST, such as Semgrep or Bandit) and Software Composition Analysis (SCA, such as Trivy or npm audit) that automatically fail the build when critical vulnerabilities or secret leaks are detected.

    Done when: your automated pipeline catches a hardcoded API token and an unparameterized SQL query, failing the build and generating an actionable SARIF report.

    How to work through it

    1. Create a GitHub repository containing a simple Python/Flask application with deliberate code flaws
    2. Configure a GitHub Actions workflow (.github/workflows/security.yml)
    3. Add Semgrep rules to scan source code on pull requests for OWASP Top 10 flaws
    4. Add Gitleaks to detect hardcoded credentials and private keys
    5. Run the workflow, review the build logs, and commit code patches to verify clean passes
6

Cloud Architecture & Cloud Security (AWS)

Learn cloud-native architecture, Identity and Access Management (IAM), storage security, VPC networking, and infrastructure-as-code hardening. Cloud security is a primary hiring focus across the industry.

  • Build a secure multi-tier AWS VPC with Terraform
    ~6hBuild1 resource

    Security engineers manage cloud environments through infrastructure-as-code rather than manual console clicking to ensure auditable, reproducible guardrails.

    You'll learn

    • Terraform — open-source infrastructure-as-code software tool providing consistent CLI workflow to manage cloud resources
    • AWS VPC (Virtual Private Cloud) — isolated virtual network dedicated to an AWS account
    • NAT Gateway — AWS managed service allowing private subnet instances to connect outwards while preventing inbound connections
    • Security Groups vs Network ACLs — stateful instance-level firewalls vs stateless subnet-level boundaries

    Write Infrastructure-as-Code (Terraform) to deploy an AWS Virtual Private Cloud (VPC) with public and private subnets across two Availability Zones. Configure an Internet Gateway, NAT Gateways, route tables, and strictly defined Security Groups.

    Done when: a virtual machine in the private subnet can access the internet for updates through the NAT Gateway but has zero public IP addresses and rejects all direct inbound connections from the internet.

    How to work through it

    1. Set up an AWS Free Tier account and configure AWS CLI credentials locally
    2. Write Terraform code defining VPC, public/private subnets, and route tables
    3. Define Security Groups that restrict inbound traffic to specific ports and source CIDRs
    4. Execute terraform init, terraform plan, and terraform apply
    5. Verify connectivity and run checkov or tfsec against your Terraform files to audit for misconfigurations
  • Enforce AWS IAM Least Privilege, MFA, and Permission Boundaries
    ~5hBuild1 resource

    IAM misconfigurations and overly permissive access policies are the single leading cause of cloud data breaches.

    You'll learn

    • IAM Role — AWS identity with specific permissions that can be assumed temporarily by users or services
    • Instance Profile — container for an IAM role that allows Amazon EC2 to pass temporary credentials to instances
    • IAM Policy Condition Block — rules specifying conditions under which an IAM policy grants or denies access
    • IMDSv2 (Instance Metadata Service Version 2) — session-oriented metadata access method mitigating SSRF cloud credential theft

    Configure an AWS IAM architecture that enforces least privilege. Build customer-managed IAM policies using condition blocks (e.g., aws:MultiFactorAuthPresent, aws:PrincipalArn), set up IAM Roles for EC2 instances using Instance Profiles (avoiding long-lived API access keys), and implement Permission Boundaries.

    Done when: an EC2 instance securely reads an encrypted S3 bucket using an attached IAM Role without any hardcoded credentials stored on the instance.

    How to work through it

    1. Create a custom IAM policy granting s3:GetObject and s3:ListBucket on a specific bucket ARN only
    2. Attach an IAM Role with this policy to an EC2 instance via an Instance Profile
    3. Log into the EC2 instance and interact with the S3 bucket using AWS CLI using temporary instance metadata credentials
    4. Enforce MFA requirements for all human IAM users using policy Condition statements
    5. Test and verify that access is blocked when conditions are not met
  • Deploy AWS CloudTrail, GuardDuty, and audit cloud posture with ScoutSuite
    ~6hApply1 resource

    Cloud defense requires centralized audit logging, automated threat intelligence, and continuous posture management to identify misconfigurations before attackers do.

    You'll learn

    • AWS CloudTrail — service that enables auditing, compliance, and governance of AWS account actions
    • Amazon GuardDuty — threat detection service that continuously monitors for malicious activity and unauthorized behavior
    • ScoutSuite / Prowler — multi-cloud and AWS security auditing tools evaluating compliance against CIS benchmarks
    • CIS AWS Foundations Benchmark — industry-standard configuration guidelines for hardening AWS environments

    Enable AWS CloudTrail across all regions and forward management events to an encrypted S3 bucket with Object Lock enabled. Activate Amazon GuardDuty for threat detection, and run ScoutSuite or Prowler locally to audit your AWS account against the CIS AWS Foundations Benchmark.

    Done when: you generate an automated multi-cloud compliance report from ScoutSuite detailing your account's CIS compliance posture with zero critical findings.

    How to work through it

    1. Enable a multi-region AWS CloudTrail with log file validation and KMS encryption
    2. Enable Amazon GuardDuty in your primary operating region
    3. Install ScoutSuite (pip install scoutsuite) or Prowler locally
    4. Execute an automated posture assessment scan against your AWS environment
    5. Remediate any identified high-risk findings (e.g. open S3 buckets, missing root MFA, unencrypted EBS volumes)
7

Security Automation & Tool Development (Python & Bash)

Security engineers automate repetitive analysis, alert enrichment, and forensic data collection. Build custom tooling to bridge systems and APIs.

  • Write a multi-threaded TCP port scanner and banner grabber in Python
    ~5hBuild1 resource

    Writing low-level socket tools cements your understanding of network protocols and develops the scripting agility required for custom security tasks.

    You'll learn

    • Socket Programming — low-level networking interface for sending and receiving raw stream/datagram packets
    • Banner Grabbing — technique to extract service name and version information from open network ports
    • ThreadPoolExecutor — Python concurrency abstraction for executing calls asynchronously across a thread pool
    • Argparse — standard Python library for parsing command-line options and subcommands

    Develop a standalone CLI port scanner from scratch using Python's socket and concurrent.futures modules. Include command-line argument parsing (argparse), timeout controls, target IP/CIDR parsing, and service banner grabbing.

    Done when: your script scans 1,000 ports across a local subnet in under 15 seconds, accurately identifying open ports and returning service banners (e.g., OpenSSH version, NGINX header).

    How to work through it

    1. Create a Python script importing socket, argparse, and concurrent.futures
    2. Implement a function that attempts a TCP socket connection with a configurable timeout
    3. Implement banner grabbing by sending a minimal HTTP request or reading the initial service welcome banner
    4. Use ThreadPoolExecutor to parallelize port probing across worker threads
    5. Add structured JSON output export formatting
  • Build an automated log-parsing and threat-intelligence enrichment script
    ~6hBuild1 resource

    Security operations teams rely on automated ingestion scripts to enrich raw system events with external threat data.

    You'll learn

    • Regular Expressions (RegEx) — pattern matching strings used to extract structured telemetry from unstructured logs
    • Threat Intelligence APIs — programmatic endpoints providing reputation data and threat feeds for IPs, domains, and hashes
    • Rate Limiting & Caching — architectural patterns to prevent exhausting third-party API quotas
    • Structured Output Generation — transforming raw forensic data into actionable reporting formats

    Write a Python script that parses web server access logs (NGINX/Apache), extracts remote IP addresses, and queries threat intelligence APIs (such as VirusTotal, AbuseIPDB, or AlienVault OTX). Cache results in a local SQLite database to prevent API rate-limit exhaustion.

    Done when: the script processes a 10,000-line access log, identifies the top 5 suspicious IP addresses based on reputation scores, and outputs a formatted Markdown summary report.

    How to work through it

    1. Write regular expressions to extract IP addresses, status codes, and HTTP user-agents from log lines
    2. Integrate with the AbuseIPDB or VirusTotal REST API using the Python requests library
    3. Implement a local SQLite caching table to avoid querying the same IP multiple times
    4. Calculate basic risk scoring based on request rate and external reputation
    5. Generate a structured Markdown incident summary table
  • Automate forensic artifact collection on Linux with Bash
    ~4hBuild

    Live triage scripts allow rapid evidence preservation during an active incident without overwriting volatile forensic data.

    You'll learn

    • Volatile Data — forensic information stored in RAM or transient states lost upon system reboot
    • Chain of Custody — forensic tracking demonstrating that evidence has remained untampered using cryptographic hashes
    • Persistence Mechanisms — system locations where malware registers itself to survive restarts
    • ss & lsof — Linux utilities for listing network sockets and active open file descriptors

    Write a modular Bash script that executes on a compromised Linux host to collect live forensic artifacts (running processes, network connections, open sockets, logged-in users, cron jobs, modified binaries in /tmp, and kernel modules) into a timestamped, SHA-256 hashed tarball.

    Done when: running the script generates a single compressed tarball containing system state snapshots and a manifest file with cryptographic hashes for all collected artifacts.

    How to work through it

    1. Draft a Bash script checking for root execution privileges
    2. Collect volatile memory data: ss -tulpn, ps auxww, lsof, w, last
    3. Collect persistence vectors: crontab -l, /etc/cron.*, /etc/systemd/system/
    4. Hash all collected text files using sha256sum into an evidence manifest
    5. Package everything into a tar.gz archive and verify archive integrity
8

Defensive Operations (SIEM, Detection Engineering & EDR)

Deploy enterprise detection infrastructure. Learn how to ingest security telemetry, write detection rules (Sigma/YARA), and analyze attacks using Endpoint Detection and Response (EDR) agents.

  • Deploy an Elastic Security (SIEM) and Fleet Server cluster via Docker
    ~6hBuild1 resource

    SIEM platforms are the central brain of security operations; deploying and configuring one provides direct insight into log aggregation pipelines.

    You'll learn

    • SIEM (Security Information and Event Management) — centralized platform aggregating and analyzing telemetry across an enterprise
    • Elastic Stack (ELK) — data ingestion, search, and visualization ecosystem comprising Elasticsearch, Logstash, and Kibana
    • Fleet Server — centralized management plane for configuring and updating distributed Elastic Agents
    • Index Lifecycle Management (ILM) — automated hot/warm/cold log retention and rollover policies

    Set up an Elastic Stack (Elasticsearch, Kibana, Fleet Server) environment using Docker Compose. Configure secure TLS communication between components and prepare the instance to ingest logs from multiple endpoints.

    Done when: the Kibana web interface is accessible, healthy, and ready to enroll remote Elastic Agents.

    How to work through it

    1. Write a multi-container Docker Compose file defining Elasticsearch, Kibana, and Fleet Server
    2. Generate internal TLS certificates for inter-node communication
    3. Start the stack and verify cluster health using curl to the Elasticsearch API
    4. Log into the Kibana dashboard and configure default Fleet policies
    5. Verify memory and index lifecycle management settings
  • Deploy Wazuh / Elastic Agent and Sysmon across Linux and Windows endpoints
    ~5hBuild1 resource

    Default Windows event logging misses many adversary execution techniques; Sysmon provides the deep kernel and process telemetry needed for modern detection.

    You'll learn

    • Sysmon (System Monitor) — Windows system service and device driver that logs detailed system activity to the event log
    • Telemetry Ingestion — continuous pipeline transporting endpoint events into centralized analytics platforms
    • SwiftOnSecurity Sysmon Config — widely adopted open-source baseline configuration for Sysmon
    • Endpoint Detection and Response (EDR) — tools monitoring endpoint activity to identify malicious behavior and support response

    Install endpoint monitoring agents on your Linux and Windows lab VMs. On Windows, deploy Microsoft System Monitor (Sysmon) with the SwiftOnSecurity configuration to capture high-fidelity telemetry (process creation, network connections, memory access).

    Done when: process execution events (Sysmon Event ID 1) from the Windows workstation appear in real-time within your central SIEM dashboard with full command-line arguments.

    How to work through it

    1. Download and install Sysmon on the Windows workstation using SwiftOnSecurity's sysmonconfig.xml
    2. Enroll the Windows VM into your Fleet/Wazuh server with an endpoint integration policy
    3. Enroll your Linux server with auditd and system logs forwarded to the SIEM
    4. Generate test process activity on both endpoints
    5. Confirm that structured telemetry flows into Kibana/Wazuh dashboards
  • Write custom Sigma rules and map detection queries to MITRE ATT&CK
    ~7hApply2 resources

    Detection engineering is the practice of converting threat knowledge into resilient, high-signal alerts that catch attacks while minimizing false positives.

    You'll learn

    • Sigma — generic, open signature format for SIEM systems allowing portable detection rule creation
    • MITRE ATT&CK — globally accessible knowledge base of adversary tactics and techniques based on real-world observations
    • Atomic Red Team — library of simple, open-source scripted tests mapped directly to MITRE ATT&CK
    • True Positive / False Positive — measuring the accuracy and operational signal-to-noise ratio of detection logic

    Simulate attacks using Atomic Red Team (e.g., executing encoded PowerShell commands, dumping credentials, adding persistence keys). Write custom detection rules in Sigma format, convert them to SIEM queries, and map each rule to specific MITRE ATT&CK techniques.

    Done when: executing an Atomic Red Team test on the endpoint automatically triggers your custom SIEM alert within 60 seconds with the correct MITRE ATT&CK technique tag.

    How to work through it

    1. Install Atomic Red Team on your test workstation
    2. Execute a controlled test (e.g., T1059.001 - PowerShell Encoded Command)
    3. Analyze the resulting Sysmon/SIEM log to identify unique indicator fields (e.g. process.command_line contains -EncodedCommand)
    4. Draft a Sigma rule defining detection logic, metadata, and MITRE ATT&CK tags
    5. Use sigmac / pySigma to translate the Sigma rule into Elasticsearch Query Language (ES|QL / KQL) and enable the alert
9

Threat Modeling, Security Architecture & Risk Assessment

Develop the high-level engineering and architectural skills needed to design secure systems before they are built. Learn threat modeling frameworks (STRIDE) and risk quantification.

  • Conduct a STRIDE threat model on a modern web and microservices architecture
    ~6hBuild1 resource

    Security engineers are expected to review designs before implementation to eliminate architectural flaws that cannot be fixed by firewalls or patching.

    You'll learn

    • STRIDE — threat modeling methodology categorizing threats into six distinct operational vectors
    • Trust Boundary — boundary across which data changes privilege levels or levels of trust
    • Data Flow Diagram (DFD) — graphical representation of data flow through an information system
    • OWASP Threat Dragon / Microsoft Threat Modeling Tool — dedicated software tools for generating structured threat models

    Take a reference system architecture (e.g., a banking API with a mobile frontend, OAuth gateway, payment microservice, and database). Construct a Data Flow Diagram (DFD) and systematically identify threats across all six STRIDE categories (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege).

    Done when: you produce a complete Threat Model Document detailing data flows, trust boundaries, 12+ specific threat scenarios, and corresponding architectural mitigations.

    How to work through it

    1. Draw a Data Flow Diagram (DFD) identifying processes, data stores, data flows, and external entities
    2. Delineate trust boundaries where data moves between different security privilege zones
    3. Apply STRIDE per element to systematically uncover potential attack vectors
    4. Assign mitigations for each identified threat (e.g., mTLS, signed JWTs, rate limiting, encryption at rest)
    5. Document residual risks and present recommendations in an engineering-ready design document
  • Design a Zero-Trust Network Architecture blueprint
    ~5hBuild1 resource

    Perimeter-only defense ('castle-and-moat') is obsolete; modern security engineering designs assume breach and enforce zero-trust access controls everywhere.

    You'll learn

    • NIST SP 800-207 — federal standard defining foundational zero-trust concepts, deployment models, and use cases
    • Control Plane vs Data Plane — separation between administrative decision logic and actual packet forwarding
    • Policy Enforcement Point (PEP) — gatekeeper component terminating connections and enforcing authorization decisions
    • Mutual TLS (mTLS) — process where client and server authenticate each other simultaneously before establishing an encrypted tunnel

    Design an enterprise Zero-Trust Network Architecture (ZTNA) adhering to NIST SP 800-207 guidelines. Document components for Policy Engine (PE), Policy Administrator (PA), Policy Enforcement Points (PEP), microsegmentation, and device posture verification.

    Done when: you complete an architectural specification blueprint detailing identity validation, contextual device verification, continuous authorization flows, and microsegmented network policies.

    How to work through it

    1. Review the core tenets of NIST Special Publication 800-207 (Zero Trust Architecture)
    2. Define the control plane versus data plane boundaries in your architectural diagram
    3. Design the dynamic authorization flow incorporating user identity, MFA status, device compliance, and location
    4. Define microsegmentation rules for service-to-service communication using Mutual TLS (mTLS)
    5. Compile the architecture into a technical design review paper
10

Incident Response, Digital Forensics & Memory Analysis

Learn how to respond when preventative controls fail. Investigate compromised hosts, analyze memory dumps, trace adversary activity, and construct incident response timelines.

  • Perform memory forensics on a compromised Windows memory dump with Volatility 3
    ~6hPractice1 resource

    Advanced malware often runs solely in memory (fileless attacks); memory forensics is crucial to discovering covert persistence and active payloads.

    You'll learn

    • Volatility 3 — premier open-source memory extraction and analysis framework
    • Process Injection — defense evasion technique where malicious code runs inside the address space of a legitimate process
    • C2 (Command and Control) — infrastructure used by attackers to maintain communication with compromised systems
    • Memory Page Protections — permissions (such as RWX) indicating dynamically allocated executable memory

    Analyze an infected Windows memory image (.raw or .vmem) using Volatility 3. Inspect running process trees (windows.pstree), extract injected DLLs (windows.malfind), analyze network connections (windows.netscan), and dump suspicious memory segments for malware analysis.

    Done when: you identify the malicious injected process, the injected code's memory address, the parent process PID, and the remote C2 IP address and port from the memory image.

    How to work through it

    1. Install Volatility 3 and Python dependencies
    2. Obtain a sample infected Windows memory capture (from CTF challenges or memory forensic archives)
    3. Run windows.pslist and windows.pstree to identify anomalous or orphaned processes
    4. Execute windows.malfind to locate memory sections with executable and writable permissions (PAGE_EXECUTE_READWRITE)
    5. Run windows.netscan to trace active or terminated TCP sockets associated with suspicious PIDs
    6. Extract the memory payload using windows.dumpfiles for static analysis
  • Build a comprehensive forensic timeline and Incident Response Post-Mortem
    ~6hApply1 resource

    Technical findings are useless unless structured into a clear narrative that allows engineering teams to patch root causes and executive teams to understand business risk.

    You'll learn

    • Log Correlation — cross-referencing events across independent systems to reconstruct unified attack chains
    • Root Cause Analysis (RCA) — structured problem-solving method identifying the primary vulnerability enabling an incident
    • Incident Post-Mortem — formal retrospective analyzing the timeline, technical impact, containment speed, and lessons learned
    • Plaso / log2timeline — framework for generating comprehensive super-timelines from multiple forensic artifacts

    Ingest multiple log sources (web logs, auth logs, Sysmon, firewall captures) from a simulated multi-stage intrusion exercise. Normalize timestamps to UTC, build an end-to-end incident timeline, and write a formal Root Cause Analysis (RCA) and incident post-mortem report.

    Done when: you deliver a structured incident response report containing an exact chronological event timeline, compromised accounts and systems, initial access vector, and 5 actionable remediation recommendations.

    How to work through it

    1. Collect all raw log extracts from the simulated breach scenario
    2. Use a timeline tool (e.g., Plaso / log2timeline or custom Python scripts) to sort events chronologically in UTC
    3. Map each phase of the attack to the MITRE ATT&CK lifecycle (Initial Access, Persistence, Lateral Movement, Exfiltration)
    4. Draft an Incident Post-Mortem document following standard industry formats
    5. List both short-term containment fixes and long-term architectural remediations
11

End-to-End Enterprise Capstone, Threat Emulation & Evidence

Synthesize all domains: networks, systems, cloud, detection, and automation. Execute an end-to-end simulated defense exercise and build a public portfolio demonstrating your practical capabilities.

  • Execute a full-scope simulated attack and defense exercise in your lab
    ~8hApply1 resource

    Integrating offensive execution and defensive validation across all infrastructure layers proves you can operate as a complete security engineer.

    You'll learn

    • Adversary Emulation — structured testing simulating specific known threat actor tactics in a controlled manner
    • Detection Validation — testing whether defensive controls and telemetry catch real-world attack techniques
    • Pivoting & Lateral Movement — techniques used by attackers to extend access to other systems on internal subnets
    • Defense-in-Depth — layered security architecture ensuring that failure in one control does not lead to total compromise

    Run an end-to-end adversary emulation exercise in your multi-tier lab. Execute an attack chain starting from external web exploitation, pivoting across the network into the Active Directory domain, and attempting data exfiltration. Validate that your firewalls, detection rules, SIEM alerts, and automated containment scripts react as designed.

    Done when: the entire attack chain is captured across your SIEM, alerts trigger for each stage, and you produce a technical verification video or comprehensive lab report demonstrating the working defenses.

    How to work through it

    1. Establish the exercise plan mapping out initial access (AppSec), lateral movement (AD/Network), and exfiltration
    2. Execute the attack in your isolated environment while monitoring SIEM dashboards
    3. Verify that IDS/IPS, OS hardening, and endpoint detection triggered alerts at each step
    4. Identify any blind spots where logging or alerts failed, and tune the detection rules
    5. Compile the results, screenshots, and logs into a capstone engineering report
  • Publish your documented security engineering portfolio and technical write-ups
    ~6hBuild1 resource

    Demonstrable code, configurations, and technical writing provide concrete evidence of capability that sets you apart in engineering interviews.

    You'll learn

    • Technical Documentation — communicating complex engineering architectures and security controls clearly in writing
    • Repository Sanitization — auditing public repositories to ensure zero credentials, tokens, or private data are leaked
    • System Architecture Diagrams — visual modeling of network boundaries, data flows, and security controls
    • Proof of Work — building a publicly auditable track record of real technical deliverables

    Curate your scripts, Terraform configurations, Sigma detection rules, threat models, and incident reports into clean, public GitHub repositories. Write high-quality README documentation explaining architecture diagrams, reproduction steps, design decisions, and remediation strategies.

    Done when: your public GitHub profile contains at least 3 documented repositories (e.g., Security Automation Tools, Terraform Cloud Architecture + Threat Model, and Custom Detection Engineering Rules with Test Cases) with clear architectural diagrams and instructions.

    How to work through it

    1. Clean and sanitize all Python and Bash scripts, removing any private credentials or API keys
    2. Create clear architecture diagrams for your lab and cloud setups using draw.io or Excalidraw
    3. Draft comprehensive README.md files detailing purpose, prerequisites, usage, and security considerations
    4. Publish your Sigma detection rules with corresponding sample Sysmon event logs demonstrating detection
    5. Perform a final peer review or self-audit of your public code and documentation

How the plan fits together

11 phases in 6 stages. Anything on the same row can be worked on at the same time, and 2 of them can start straight away.

An arrow points from a phase to the work it unlocks: before starting any phase, every phase with an arrow into it has to be finished first.

STARTSTAGE 2STAGE 3STAGE 4STAGE 5STAGE 61Computer Networking &Traffic AnalysisFundamentals4 tasks · ~20h2Linux Systems Internals &Hardening4 tasks · ~21h3Windows Architecture &Active Directory Security3 tasks · ~18h4Applied Cryptography & PKIImplementation3 tasks · ~15h5Web Application Security &Threat Assessment (AppSec)3 tasks · ~16h6Cloud Architecture & CloudSecurity (AWS)3 tasks · ~17h7Security Automation & ToolDevelopment (Python &Bash)3 tasks · ~15h8Defensive Operations(SIEM, DetectionEngineering & EDR)3 tasks · ~18h9Threat Modeling, SecurityArchitecture & RiskAssessment2 tasks · ~11h10Incident Response, DigitalForensics & MemoryAnalysis2 tasks · ~12h11End-to-End EnterpriseCapstone, Threat Emulation& Evidence2 tasks · ~14h
Solid arrow
Must be finished before the phase it points to
Dashed arrow
Same rule, but the prerequisite sits more than one stage back

Resources

14 in this plan's library, beyond the links on individual tasks.

Learning & Reference

Authoritative documentation, standards, and manuals.

  • AWS Security Pillar - AWS Well-Architected Framework

    Official architecture guidance detailing foundational defense principles, IAM controls, and incident detection in AWS.

    docs.aws.amazon.com · Amazon Web Services · Whitepaper / Documentation · Free · Intermediate

  • Black Hat Python: Python Programming for Hackers and Pentesters (2nd Edition)

    Practical hands-on projects for crafting custom network sniffers, log scrapers, and automation scripts in Python 3.

    No Starch Press · Book · ~$40 · Intermediate

  • CIS Linux Benchmarks

    The definitive industry baseline for auditing and hardening Linux operating system configurations and service daemons.

    Center for Internet Security (CIS) · Hardening Guide · Free PDF download with registration · Intermediate

  • OWASP Top Ten Web Application Security Risks

    Study the core awareness standard detailing the most critical web application security risks and mitigation patterns.

    owasp.org · OWASP · Standard / Reference Document · Free · Beginner

  • Practical Packet Analysis: Using Wireshark to Solve Real-World Network Problems

    Read during network fundamentals to understand packet flow, protocol handshakes, and diagnosing anomalous traffic.

    No Starch Press · Book · ~$40 · Beginner

  • Serious Cryptography: A Practical Introduction to Modern Encryption

    A developer- and engineer-friendly deep dive into modern cryptography concepts, mathematics, and implementation pitfalls.

    No Starch Press · Book · ~$45 · Intermediate

  • Threat Modeling: Designing for Security

    The authoritative textbook for establishing threat modeling processes, identifying software flaws early, and applying STRIDE.

    Wiley · Book · ~$50 · Intermediate

Security Tools & Frameworks

Essential open-source software and platforms.

  • BloodHound

    Use to map complex relationship paths, privilege escalation chains, and ACL misconfigurations in Active Directory domains.

    SpecterOps · Active Directory Analysis Tool · Free (Community Edition) · Intermediate

  • Sigma: Generic Signature Format for SIEM Systems

    Reference and rule repository to learn how to write portable detection signatures for enterprise log telemetry.

    github.com · SigmaHQ · Detection Rule Specification & Tooling · Free · Intermediate

  • The Volatility Framework

    The industry-standard memory analysis toolkit for extracting artifacts, process lists, and code injection evidence from RAM dumps.

    volatilityfoundation.org · Volatility Foundation · Memory Forensics Framework · Free · Advanced

  • Wazuh

    Deploy in a home lab to practice endpoint telemetry ingestion, log analysis, and host-based intrusion detection.

    wazuh.com · Wazuh, Inc. · SIEM & XDR Platform · Free · Intermediate to Advanced

  • Wireshark

    Essential open-source network packet inspection tool to dissect protocols and inspect live or recorded network traffic.

    wireshark.org · Wireshark Foundation · Network Packet Analyzer · Free · Beginner to Intermediate

Industry Signposts & Certifications

Recognized certifications for benchmarking progress.

  • Blue Team Level 1 (BTL1)

    A purely practical, 24-hour defensive exam that validates junior to mid-level hands-on capability in detection and response.

    Security Blue Team · Hands-on Certification · ~£399 · Intermediate

Communities & CTFs

Interactive practice labs and peer networks.

  • PortSwigger Web Security Academy

    The highest quality interactive training platform for learning and practicing defensive and offensive web application security.

    portswigger.net · PortSwigger · Interactive Lab & Course · Free · Beginner to Advanced