CyArt
Academy
Become a better security engineer. Every day.
Cyber security engineering from first principles to staff-level design: threat models, identity, cryptography, cloud, detection and response. Learn what happens under the hood with clear diagrams, real code and the questions interviewers actually ask, one concept at a time.
Design a zero-trust access gateway
Design the system that replaces a corporate VPN: every request to a private app authenticated, authorised with identity and device context, proxied and logged. Built one requirement at a time, from a single proxy to a global, highly available control plane.
Design an MFA and step-up service
Design the service that proves the second factor for 2 million users: TOTP, passkeys, push with number matching, risk-based step-up for sensitive actions, recovery that is not the weakest link, and a defence against MFA fatigue.
Design a SIEM pipeline
Design the system that ingests 100 MB/s of security logs from endpoints, cloud and identity, never loses an authentication event, normalises everything to one schema, runs detections within a minute and keeps a year of searchable history at a price the CFO accepts.
Four tracks, one clear path each
Security engineering end to end, system design for security systems, machine-coding for security components, and the analyst essentials every engineer needs. Each course starts free and goes deep.
Cyber Security Engineering, One-Stop
Everything you need to build and defend real systems, in one place. Threat modelling to cryptography, identity to cloud, detection to response. Every topic ends with how to say the answer in the room.
“The security engineering path I wish I had: fundamentals first, then every building block, then real designs drawn out step by step.”Curated by the CyArt engineering team from production incidents, design reviews and the best material across the web, rewritten into one path.
- 01Foundations of Security EngineeringHow to think like a security engineer · What happens when you log in · Cryptography you actually need · Identity: authentication, authorisation and tokens · The security engineering interview · Secure design principles that still holdFREE
- 02AI, vibe coding & logic structuringAI in the security SDLC · Vibe coding safely · Logic structuring for security code · Mistakes that ship vulnerabilities · Building AI features into security platformsFREE
- 03Network & Infrastructure SecurityTLS and PKI in practice · Segmentation and zero trust · DDoS and WAF fundamentals · DNS and email securityFREE
- 04Application Security & DevSecOpsThe bugs that actually ship · Secure SDLC: where each scanner earns its keep · Supply chain: trusting code you did not write · API securityFREE
- 05Identity & Access EngineeringSSO at scale: SAML, OIDC and SCIM · Authorisation models: RBAC, ABAC, ReBAC · Secrets management and rotation · Workload identity and federation🔒
- 06Cloud & Platform SecurityCloud IAM: least privilege that survives contact with teams · Kubernetes security: hard to get in, harder to get out · Data protection: KMS, envelope encryption, tokenisation · Cloud guardrails and posture management🔒
- 07Detection & Response EngineeringSecurity logging architecture · Detection as code · Incident response engineering · Forensics and evidence engineering🔒
- 08Advanced: Security Architecture at ScaleZero trust reference architecture · Multi-tenant isolation · Security metrics, SLOs and risk quantification · Running security design reviews at scale🔒
High-Level Design for Security Systems
System design, security first. One framework you can run in any 45-minute round, the building blocks behind every secure design, and real "Design X" problems from the security world built up one requirement at a time.
“The security system design prep I wish I had: a framework first, then every building block, then real designs drawn out step by step.”Curated by the CyArt engineering team from production incidents, design reviews and the best material across the web, rewritten into one path.
- 01The security HLD roundThe round, the framework, the numbersFREE
- 02Design problems: Access & identityDesign a zero-trust access gateway · Design an SSO identity provider · Design an MFA and step-up service · Design an API authorisation gatewayFREE
- 03Design problems: Telemetry & detectionDesign a SIEM pipeline · Design an EDR telemetry pipeline · Design a threat intelligence platform🔒
- 04Design problems: Infrastructure & dataDesign a secrets manager · Design a DDoS protection edge · Design PKI and certificate automation · Design a vulnerability management platform · Design a key management service🔒
Low-Level Design for Security Components
The machine-coding round, security edition. A method that turns requirements into classes and interfaces, the patterns that earn their place, then real security components designed in TypeScript with interfaces, working code and tests.
“The machine-coding prep I wish I had: a method first, then the patterns that matter, and real security components coded end to end.”Curated by the CyArt engineering team from production incidents, design reviews and the best material across the web, rewritten into one path.
- 01Start hereThe LLD method in eight stepsFREE
- 02Problems: Access controlDesign an authorisation engine (RBAC + ABAC) · Design a JWT validator · Design a session managerFREE
- 03Problems: TelemetryDesign a log normaliser · Design a detection rule evaluatorFREE
- 04Problems: Advanced componentsDesign an alert deduplication and correlation engine · Design a rate limiter component · Design a credential store · Design a secrets rotation scheduler · Design a tamper-evident audit log🔒
Analyst Essentials for Engineers
The small set of analyst skills every security engineer needs: reading logs under pressure, running a triage loop that does not miss, and mapping what you see to how attackers actually move.
“Just enough of the analyst's craft to build systems analysts can use, and to hold your own in an incident.”Curated by the CyArt engineering team from production incidents, design reviews and the best material across the web, rewritten into one path.
- 01Analyst essentialsReading logs for triage · The triage loop · Attacker movement: kill chain and ATT&CK · Alert tuning and false positives · Network triage with flows and DNSFREE
- 02Investigation & threat huntingWindows and identity logs · Phishing investigation · Hypothesis-driven hunting · Cloud incident investigation · Malware triage for analysts🔒
Security systems, designed step by step
Every problem is built one requirement at a time, with a diagram at each step and the trade-offs said out loud. Then: what interviewers look for by level, the follow-ups, and how to say it in the room.
Design a zero-trust access gateway
Design an SSO identity provider
Design an MFA and step-up service
Design an API authorisation gateway
Design a SIEM pipeline
Design an EDR telemetry pipeline
Design a threat intelligence platform
Design a secrets manager
Design a DDoS protection edge
Design PKI and certificate automation
Design a vulnerability management platform
Design a key management service
Design an authorisation engine (RBAC + ABAC)
Design a JWT validator
Design a session manager
Design a log normaliser
Design a detection rule evaluator
Design an alert deduplication and correlation engine
Design a rate limiter component
Design a credential store
Design a secrets rotation scheduler
Design a tamper-evident audit log
Why CyArt Academy
Not another wall of notes. Every lesson is something you can draw, code and defend out loud.
Watch the board come together
Design a zero-trust gateway, design a SIEM: every problem is built up one requirement at a time, and ends on the board a strong candidate leaves behind in 45 minutes.
Components with the security property tested
Machine-coding problems like the authorisation engine become interfaces, working TypeScript and the five tests that prove deny-by-default and tenant isolation.
One route, ticked off
Networking basics to staff-level architecture in the order to learn them. Tick a lesson once and it shows as done on the roadmap, the course and the lesson nav.
What they probe: where the signing key lives, how 500 apps verify a token without calling the IdP, what happens to sessions when a user is terminated. Where candidates slip: keys on disk, day-long tokens, no SCIM.
The questions they really ask
Every lesson ends with the follow-ups an interviewer asks next and an answer you can say out loud.
Hard topics become easy topics with repetition.
Start at part 00 of the roadmap, or jump into the first design problem. Advanced modules unlock with the Pro pass.