The Security analyst path
You work out what an attacker did, or is doing, and write it up so someone can act. It is the broader analysis role next to the SOC’s shift-based entry point: ATT&CK is the working vocabulary and CISA advisories are the reading diet. It suits people who chase loose ends and can write clearly under time pressure.
Published 2026-10-09 · generated from the lesson data · serves Security analyst
Work the groups in order. Each checkpoint is a gate: do not move on until you can do it unaided. The capstone is level 4 — original work, made public, verifiable by a stranger.
Foundations
Practitioner
7. Authorization, scope, and the hard rules
Stage B · Practitioner
8. Engagement methodology: WSTG, PTES, and NIST SP 800-115
Stage B · Practitioner
9. IDOR: Insecure Direct Object References
Stage B · Practitioner
10. SQL injection: when your input becomes the query
Stage B · Practitioner
11. Cross-site scripting: when the browser can't tell your code from the attacker's
Stage B · Practitioner
12. Broken authentication and session management: proving who you are, and staying proven
Stage B · Practitioner
Studied to Apply level — you must understand exploitation to analyze it, even though you are not the one breaking in.
Professional, lighter
13. The CVE Program
Stage C · Professional
14. CVSS v3.1 and v4.0, scored by hand
Stage C · Professional
15. The surrounding catalogs: CWE, CAPEC, KEV, EPSS — and where enrichment comes from now
Stage C · Professional
16. Building a public track record: write-ups that teach
Stage C · Professional
Disclosure literacy and write-up craft, not CVE-chasing: the full disclosure pipeline is optional on this path.
Detection and DFIR
Checkpoints
- An investigation of a simulated incident written up in ATT&CK vocabulary, with the evidence chain a stranger can re-derive.
- A detection rule written and tested against labeled data, with the tuning decisions documented.
- A one-page threat brief from a current CISA advisory, written for a non-technical manager.
The capstone
Level 4 — Extend: Published original threat analysis. A technique deep-dive with detection logic and test evidence, or a detection pack derived from a real advisory series — published, sources dated, reproducible. That is the artifact a hiring stranger checks.