Stage D — Specialist
One track, taken deep: red team operations, DFIR and detection engineering, application security, exploit development and reverse engineering, malware analysis, or cloud security. Each track is concepts plus defender telemetry plus established labs — the safety line holds all the way down.
Published 2026-10-09 · generated from the lesson data
The milestone
A capstone body of work in one track: original, public, verifiable — the level-4 work each role path ends in. (The brief sets no single artifact for Stage D; the milestone is the depth itself.)
The lessons
1. Red team operations: concepts
A red team is hired to act like an adversary so the defenders can practice on something real. The job needs a shared language for "what the adversary did," and that language is MITRE ATT&CK. You will meet it in…
2. Malware analysis: concepts
Every SOC alert that says "suspicious file" ends with someone answering one question: what does this program do? Malware analysts answer it for incident response (what did it do here?), for threat intel (what…
3. Cloud security: concepts
Most "cloud breaches" are not breaks of the cloud — they are misconfigurations by the customer: a storage bucket left public, a firewall rule opened to the world, an access key committed to a repo, a trail left…
4. Application security: concepts
Someone has to make sure the software gets built securely, not just tested after release. Application security is that discipline: threat modeling before code, scanners and reviews during development,…
5. Exploit development and reverse engineering: concepts
Every memory-safety CVE you have ever read — the buffer overflow in the CVE record, the use-after-free in the Project Zero write-up — is the same story at the bottom: a program written in an unsafe language mishandled…
6. DFIR deep: disk, memory, network forensics
Triage ends with a decision: close it, or escalate it. Everything in this lesson is the escalation side — the work that begins when an alert becomes an incident and someone has to answer, with evidence, what…
In reading order, 6 lessons. Every lesson follows the same ten parts — mechanism, walkthrough, sources, proof — and every walkthrough was executed and dated.
What you can honestly claim
You can honestly claim: deep, demonstrable skill in one specialty, with public artifacts to prove it. You cannot yet claim: breadth across the field — the specialist knows their track cold and knows where its edges are.
What comes next
When the milestone is met, continue to Stage E — Expert.