Job role capstone: application security engineer
As a product team’s application security engineer you run design and code reviews, set up the CI pipeline and WAF guardrails, triage an external vulnerability report and manage the emergency fix and post-incident review.
Level 501 · 13 lessons · 11 practice labs
Lessons
Design and review
- A security design review for a new feature
- The feature’s threat model and security requirements
- Security review of a pull request
- Short task: write a security approval or rejection for the design document
Pipeline and guardrails
- Setting up SAST, SCA, secret scanning and DAST in CI
- WAF rules and a detection dashboard
- Writing a secure library or middleware for the teams
- Short task: prove the pipeline catches three known flaws
Incident and improvement
- Triaging a report from an external researcher
- An emergency fix, a virtual patch and communication
- Post-incident review and variant analysis
- Preparing a short secure-coding session for developers
- Capstone: run a product team’s security work for a quarter end to end
Practice labs
- A security note on a design document: Mark the security gaps in a new feature's design document and write them as requirements.
- Approve or reject: a reasoned decision: Write a security approval or rejection with reasons for a design document and state the conditions for approval.
- A security review of a pull request: Find the authorisation and input issues in a pull request in the product repo and write comments proposing fixes.
- The feature's threat model: Produce a threat model for the new feature and verify the two most critical requirements on staging.
- Add secret scanning to the pipeline: Add secret scanning to the CI pipeline and show a deliberately planted key is caught.
- Does the pipeline catch three known flaws: Prove the SAST, SCA and DAST steps catch three known flaws and add a rule for the one that slips through.
- A WAF rule and detection dashboard for staging: Write a virtual patch for the known flaw in the staging app and build a dashboard that shows attempts.
- A secure middleware for teams: Write middleware that gathers input validation and security headers in one place and roll it out in the product repo.
- Triage an outside report: Verify the researcher report in the disclosure inbox, set its severity and reply to the researcher.
- An urgent fix and a virtual patch: Deploy a virtual patch for the confirmed flaw, prepare the lasting fix and write a status message to the team.
- Post-incident variant analysis: Write the post-incident review, search the repo for variants of the flaw and prepare a ten-minute training note for developers.
About this course
As a product team’s application security engineer you run design and code reviews, set up the CI pipeline and WAF guardrails, triage an external vulnerability report and manage the emergency fix and post-incident review.
What you will learn
- Design and review
- Pipeline and guardrails
- Incident and improvement
Prerequisites
You should be experienced in the topics of the same path up to level 401.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 501; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.