Think, defend and respond like a security engineer
A foundations-first security path built to complement the DevOps & Cloud course — the threat models, networking and cryptography fundamentals, web and cloud attack surfaces, and incident-response habits that turn "I can ship it" into "I can ship it safely." This course is brand new: the full 16-week plan is below, with Week 1 live now and new weeks publishing regularly.
Prerequisites & tooling
What you should already know
- Comfortable opening a terminal and running basic Linux commands
- A rough sense of how a client and server talk over HTTP
- No prior security, hacking or compliance experience required
- Handy alongside our DevOps & Cloud course, but not required as a prerequisite
Stack you'll work with
The tools defenders actually reach for, on the same infrastructure you'd secure in production.
The full 16-week roadmap
Fifteen modules, from the security mindset through networking, cryptography, web and cloud attack surfaces, monitoring and incident response, to a capstone that secures a real DevOps pipeline.
Security Mindset, CIA Triad & Threat Modeling
Learn to think like an attacker before you learn to think like a defender.
- Confidentiality, Integrity & Availability as the frame for every decision ahead
- Threats, vulnerabilities, risk & the STRIDE threat-modeling framework
- Drawing your first data-flow diagram & attack surface
Networking Fundamentals for Security
The packet-level view every later attack and defense builds on.
- TCP/IP, DNS & the request/response model, read through a security lens
- Firewalls, VPNs & segmenting a network into trust zones
- Capturing and reading traffic with Wireshark
Linux & OS Hardening Basics
Reduce the attack surface of a box before it ever ships.
- Users, groups & the principle of least privilege on a real server
- Disabling unused services & keeping a minimal, patched attack surface
- File integrity, auditd & a security-focused baseline checklist
Cryptography Fundamentals
The math underneath every padlock icon you've ever trusted.
- Hashing, symmetric & asymmetric encryption — what each is actually for
- TLS handshakes, certificates & a working mental model of PKI
- Hands-on with OpenSSL: keys, certs & signing
Authentication & Access Control
Proving who someone is, and deciding what they're allowed to do next.
- Password hygiene, MFA & why password resets are an attack surface too
- OAuth 2.0, OIDC & reading a JWT without trusting it blindly
- RBAC vs. ABAC & designing least-privilege access
Web App Security & the OWASP Top 10 (Part 1)
The vulnerability classes behind most real-world breaches, from the inside.
- SQL injection & command injection, exploited and then fixed
- Cross-site scripting (XSS) & cross-site request forgery (CSRF)
- Broken authentication & session-management flaws
Web App Security & the OWASP Top 10 (Part 2)
The subtler flaws that slip past a first-pass code review.
- Server-side request forgery (SSRF) & insecure deserialization
- Broken access control & security misconfiguration
- Finding these live with Burp Suite / OWASP ZAP against a deliberately vulnerable app
Cloud Security Fundamentals
The shared-responsibility line, and everything on your side of it.
- The shared responsibility model across IaaS, PaaS & SaaS
- IAM least privilege & the S3-bucket misconfigurations behind real breaches
- Security groups, VPC boundaries & cloud-native logging (CloudTrail)
Container & Kubernetes Security
The isolation boundaries containers give you, and where they quietly stop.
- Image scanning & building minimal, non-root container images
- Kubernetes RBAC, network policies & Pod Security Standards
- Why a container escape matters & how runtime isolation limits it
Secrets Management & Supply-Chain Security
Keep credentials out of Git history and know what's actually in your dependency tree.
- Vaults, environment secrets & rotating credentials that leaked
- Dependency scanning & a software bill of materials (SBOM)
- Signing artifacts & locking down a CI/CD pipeline's write access
Vulnerability & Patch Management
Finding what's exposed before someone else does, on a schedule.
- CVEs, CVSS scoring & prioritizing what actually needs fixing first
- Scanning a host and a network with Nmap & an open-source vulnerability scanner
- Building a patch cadence that doesn't break production
Security Monitoring, Logging & SIEM Basics
Know an attack is happening while it's still happening.
- What to log, what to alert on, and what just becomes noise
- Centralizing logs & a first look at SIEM tooling
- Writing detection rules for common attack patterns
Incident Response & Digital Forensics Basics
What to do in the first hour after "we think we've been breached."
- The incident-response lifecycle: prepare, detect, contain, eradicate, recover
- Preserving evidence & a basic forensic timeline
- Writing a blameless post-incident report
Ethical Hacking & Penetration Testing Fundamentals
Attack a system you're authorized to attack, and document what you find.
- The pentest lifecycle: recon, scanning, exploitation, reporting
- Legal & ethical boundaries: scope, authorization & responsible disclosure
- A guided walkthrough against an intentionally vulnerable lab target
Compliance, Governance & Security Frameworks
The paperwork that turns "we're secure" into something an auditor will sign off on.
- SOC 2, ISO 27001 & the NIST Cybersecurity Framework, at a glance
- GDPR & data-privacy basics every engineer should know
- Writing a security policy an engineering team will actually follow
Capstone: Secure a Full DevOps Pipeline End-to-End
Apply every module in one project — threat-model, harden and monitor a real pipeline.
- A threat model & hardening pass on a real CI/CD → cloud pipeline
- Secrets, scanning & least-privilege IAM wired into the pipeline itself
- Portfolio-ready security writeup you can show employers