Flagship course · Security Engineering· ~/academy/tracks/security-engineering
Cyber Security Engineering, One-Stop
Everything you need to build and defend real systems, in one place. Threat modelling to cryptography, identity to cloud, detection to response. Every topic ends with how to say the answer in the room.
8
Modules
35
Lessons
15 h
Reading
01
Foundations of Security Engineering
How to think like a security engineer: assets, trust boundaries, threat models and the controls that actually move risk.
FREE6 lessons
- How to think like a security engineerSecurity is not a checklist. It is a way of reading any system: what is valuable, who can reach it, where trust changes hands and what happens when a control fails.Must know22 min
- What happens when you log inFollow one login from the keyboard to the database and back: DNS, TLS, the edge, the identity provider, the session cookie, the authorisation check. Every hop is a place attacks happen.Must know28 min
- Cryptography you actually needNot the maths. The decisions: which primitive for which job, the parameters that matter, and the five mistakes that account for most crypto bugs in production.Must know26 min
- Identity: authentication, authorisation and tokensSessions, OAuth 2.1, OIDC, JWTs, refresh tokens. What each one is for, the flows that are safe in 2026, and the token mistakes interviewers love to probe.Must know30 min
- The security engineering interviewHow the rounds are structured, what each one scores, and a repeatable framework for the design round that keeps you talking about trade-offs instead of tools.18 min
- Secure design principles that still holdSaltzer and Schroeder's eight principles applied to cloud, APIs and microservices, plus secure defaults and attack surface reduction, worked through real design reviews.Must know26 min
02
AI, vibe coding & logic structuring
How to use AI assistants, vibe coding and structured logic when building security products: where AI helps, where it must not be trusted alone, the guardrails that keep generated code safe, and the mistakes that ship vulnerabilities.
FREE5 lessons
- AI in the security SDLCWhere AI assistants genuinely speed up security engineering, where they must never be trusted alone, and why the engineer who merges the code owns every line of it.Must know24 min
- Vibe coding safelyVibe coding is fine for prototypes and dangerous in production. The guardrails that let you keep the speed: spec first, small diffs, tests before acceptance, CI controls, import review, data hygiene and provenance.Must know26 min
- Logic structuring for security codeAdvanced logic structuring that makes security code correct by construction and easy to review: state machines, decision tables, invariants, pure decision functions, parse-don't-validate, fail-closed totality and property tests, and how to hand that structure to an AI.Must know34 min
- Mistakes that ship vulnerabilitiesA catalogue of the mistakes AI-assisted engineering ships most often: broken authorisation, insecure defaults, weak crypto, injection, ReDoS, stale APIs, licence contamination, over-broad IAM, swallowed errors and tests that assert the bug. How each looks, why models produce it and how to catch it.Must know32 min
- Building AI features into security platformsShipping LLM features in a security product: SOC copilots, alert summaries, natural-language query and agentic response. Prompt injection through logs and tickets, tenant isolation in RAG, scoped tools, output handling, evaluation, and the OWASP Top 10 for LLM applications mapped to controls.35 min
03
Network & Infrastructure Security
The edge and the wire: TLS and PKI in practice, segmentation and zero trust, DDoS and WAF fundamentals.
FREE4 lessons
- TLS and PKI in practiceCertificates, chains, rotation, revocation and the operational mistakes that cause more outages than attacks do.24 min
- Segmentation and zero trustFrom flat networks to identity-aware access: VPC design, security groups, network policy and the per-request checks that zero trust actually means.Must know25 min
- DDoS and WAF fundamentalsVolumetric, protocol and application-layer attacks; what a scrubbing edge does; what a WAF can and cannot catch; and how to keep real users in during an attack.22 min
- DNS and email securityDNS hijack, dangling records and subdomain takeover, cache poisoning, DNSSEC and DoH, then SPF, DKIM, DMARC, MTA-STS and BIMI from the side of the engineer who owns the domain.28 min
04
Application Security & DevSecOps
The bugs that actually ship, how to find them before attackers do, and how to make the pipeline itself trustworthy.
FREE4 lessons
- The bugs that actually shipInjection, broken authz, SSRF, XSS, CSRF, deserialisation. For each: how it happens, how to spot it in a review, and the fix that removes the class, not the instance.Must know32 min
- Secure SDLC: where each scanner earns its keepSAST, DAST, SCA, secrets scanning, IaC scanning. What each finds, what it misses, where it runs in the pipeline, and how to keep developers from ignoring all of it.20 min
- Supply chain: trusting code you did not writeDependencies, build systems and artifacts are now the attack surface. SBOMs, signing, provenance and hermetic builds, and what SolarWinds and xz taught us.Must know24 min
- API securityThe OWASP API Security Top 10 in practice: object and function level authorisation, mass assignment, resource limits, SSRF and inventory, plus what belongs at the gateway versus in the service.Must know30 min
05
Identity & Access Engineering
SSO at scale, authorisation models that survive growth, and secrets that rotate themselves.
🔒 PRO4 lessons
- SSO at scale: SAML, OIDC and SCIMRunning identity for hundreds of apps and thousands of users: protocol choice, provisioning, session policy, break-glass and the failure modes that lock everyone out.28 min🔒
- Authorisation models: RBAC, ABAC, ReBACWhen roles stop scaling, when attributes get messy, and why Google built Zanzibar. How to pick a model and where the policy engine sits.Must know26 min🔒
- Secrets management and rotationStatic secrets are the problem; short-lived credentials are the answer. Dynamic secrets, workload identity, rotation without downtime and what to do when a key leaks.24 min🔒
- Workload identity and federationMachines need identity too. SPIFFE/SPIRE, cloud workload identity and OIDC federation from CI let you delete long-lived keys, as long as you pin the claims and avoid the confused-deputy traps.Must know30 min🔒
06
Cloud & Platform Security
IAM that stays least-privilege, Kubernetes that is hard to escape, and data protection built on KMS.
🔒 PRO4 lessons
- Cloud IAM: least privilege that survives contact with teamsRoles, policies, boundaries and guardrails across AWS, GCP and Azure. The patterns that keep IAM from becoming a 2,000-policy swamp.Must know26 min🔒
- Kubernetes security: hard to get in, harder to get outAdmission control, pod security, network policy, workload identity, secrets and the escape paths attackers actually use.28 min🔒
- Data protection: KMS, envelope encryption, tokenisationClassify, minimise, encrypt, tokenise. Designing data protection that satisfies auditors without slowing the product down.22 min🔒
- Cloud guardrails and posture managementMake the dangerous thing impossible, detect the merely bad thing, and vend every new account already safe. SCPs and org policies, CSPM, account vending, ownership tags, policy as code and exceptions that expire.30 min🔒
07
Detection & Response Engineering
Logging that is useful at 3 a.m., detection as code, and response automation that contains before humans wake up.
🔒 PRO4 lessons
- Security logging architectureWhich logs matter, how to collect them without losing any, how long to keep them and how to make them searchable when it counts.Must know26 min🔒
- Detection as codeWriting detections like software: Sigma rules, unit tests with attack telemetry, false-positive budgets, coverage against ATT&CK, and shipping through CI.24 min🔒
- Incident response engineeringRunbooks as code, containment that is one click, evidence that holds up, and the automation boundary: what SOAR should and should not do alone.22 min🔒
- Forensics and evidence engineeringBuild the system before the incident: evidence pipelines for memory, disk and cloud snapshots, chain of custody, trustworthy timestamps, triage collection across thousands of hosts, retention that answers the questions investigators ask, and legal hold.30 min🔒
08
Advanced: Security Architecture at Scale
Reference architectures, multi-tenant isolation and the metrics that let you run security like an engineering org.
🔒 PRO4 lessons
- Zero trust reference architecturePutting identity, device, policy, network and telemetry together into one architecture you can defend in a staff-level review.Must know30 min🔒
- Multi-tenant isolationSilo, pool and bridge models; the isolation primitives at each layer; and how to prove to a customer that another tenant cannot see their data.26 min🔒
- Security metrics, SLOs and risk quantificationMetrics that change decisions: time to remediate by tier, MFA coverage, detection precision, and how to put a number on risk without pretending to be precise.20 min🔒
- Running security design reviews at scaleHow a small security team reviews hundreds of designs a year: intake and risk tiering, templates, threat-model artefacts, paved roads, security champions, findings tracked to closure and the metrics that show it works.Must know28 min🔒