Make security part of the engineering job, not a department down the hall.
For engineers and administrators who need to harden, detect and respond, and for people moving into security engineering. Defensive, hands-on, built on real stacks.
Who this track is for
- System administrators and DevOps engineers who own security without a security team
- Developers who need application security beyond a checklist
- IT staff moving into a security engineer role
- Security analysts moving from tickets to engineering
Three entry levels
Profiling places you on one. The cohort is built from people on the same level with the same target, so the plan is never too slow for half the room.
- level 1
Entry
- you are
- You run systems or write code, and security is something you hear about after the fact.
- you get
- You threat-model a stack, harden it, detect the common attacks and handle a basic incident end to end.
- level 2
Security engineer
- you are
- You already handle vulnerabilities and audits and want structure and depth.
- you get
- A full programme: appsec pipeline, infrastructure and cloud security, detection and response, done consistently.
- level 3
Senior / lead
- you are
- You are building a security function and need it to stick with the engineering teams.
- you get
- Security architecture, policy as code, metrics, compliance mapping and the working relationship with engineering.
What a typical plan covers
10 modules in the order a typical cohort runs them. Your cohort's plan is cut, extended and re-ordered after profiling, and names the exact tools.
Threat modelling
01- Assets, attackers, trust boundaries
- STRIDE in practice
- Prioritising what to fix first
Linux and network hardening
02- Baseline configs and CIS benchmarks
- SSH, firewalls, segmentation
- Verifying the baseline stays
Identity and access
03- SSO, OIDC/SAML, MFA
- RBAC and least privilege
- Secrets management
Application security
04- OWASP Top 10, hands-on
- SAST, DAST, dependency scanning
- Supply chain and SBOMs
Cloud and infrastructure security
05- IAM design
- Policy as code, posture checks
- Encryption and key management
Container and Kubernetes security
06- Image scanning
- Admission and network policies
- Runtime detection
Logging and detection
07- Central logging
- SIEM basics and detection rules
- Alert tuning
Incident response
08- Playbooks and triage
- Containment and evidence handling
- Communication during an incident
Compliance basics
09- ISO 27001, SOC 2, NIS2 awareness
- Mapping controls to the stack
- Evidence without the paperwork theatre
Capstone
10- Assess, harden and instrument a sample stack
- Present findings and fixes
- Written report for a non-technical reader
Tools you will work with
- Linux
- nmap
- Wireshark
- OpenSSL
- Vault
- Keycloak
- Semgrep
- Trivy
- Grype
- OWASP ZAP
- Falco
- Wazuh
- OpenSearch
- Terraform
- Kubernetes
The final list is set in the cohort plan. Where the market is split, such as cloud providers, the cohort picks the one most of its members need.
By the end, you can
- Produce a threat model and a prioritised fix list for a real stack
- Harden Linux, Kubernetes and a cloud account against a checklist you can defend
- Detect a simulated attack from logs and run the response playbook
- Map what you did to ISO 27001 or SOC 2 controls when asked
Seven people, security for engineers, 10 weeks
Four DevOps engineers and three sysadmins responsible for security at small companies. The plan was weighted toward hardening, detection and incident response. Application security was reduced to one module because none of them ship application code.
Illustrative cohort, built from the typical mix for this track.
Tell us where you want to get to.
Applying takes five minutes. Profiling is free and you keep the skills map. The cohort, the plan and the price come before any commitment.
Cohorts are forming now for all four tracks. We reply within two working days.