Learning path
Cybersecurity Engineer learning path: everything to study, topic by topic
Comprehensive Cybersecurity Engineer assessment covering security fundamentals, vulnerability management, identity and access, threat detection and response, application and cloud security, and security strategy.
Short answer
To learn Cybersecurity Engineer, work through 7 modules and 35 topics in the order they build on each other. It starts with Security Fundamentals, then moves on to Vulnerability Management and Identity & Access. Use the map as a checklist, or measure your level and study only what is missing.
What you will study
Topics are grouped by module. Open one to see its objectives and key concepts.
1 · Security Fundamentals5 topics
CIA Triad & Security Principles
Confidentiality, integrity, and availability principles, defense in depth, least privilege, and separation of duties
Objectives
- Explain how CIA triad guides security decisions
- Apply defense in depth to a multi-layer architecture
Key concepts
- confidentiality
- integrity
- availability
- defense in depth
- least privilege
- separation of duties
- non-repudiation
Network Security Basics
Firewalls, VPNs, network segmentation, IDS/IPS, DNS security, and secure network architecture
Objectives
- Design a basic segmented network with appropriate security controls
- Explain the difference between IDS and IPS and when to use each
Key concepts
- firewalls
- VPN
- network segmentation
- IDS/IPS
- DMZ
- DNS security
- TLS/SSL
- network ACLs
Operating System Security
OS hardening, patch management, file permissions, process isolation, and endpoint security
Objectives
- Apply CIS benchmark hardening to a Linux or Windows server
- Configure appropriate file permissions and audit logging
Key concepts
- OS hardening
- CIS benchmarks
- file permissions
- process isolation
- endpoint detection
- host-based firewalls
- audit logging
Cryptography Fundamentals
Symmetric and asymmetric encryption, hashing, digital signatures, PKI, and key management basics
Objectives
- Choose appropriate cryptographic algorithms for different use cases
- Explain the TLS handshake and certificate validation process
Key concepts
- symmetric encryption
- asymmetric encryption
- hashing
- digital signatures
- PKI
- key management
- TLS handshake
- certificate authorities
Security Frameworks (NIST/ISO 27001)
NIST Cybersecurity Framework, ISO 27001, CIS Controls, and how frameworks guide security programs
Objectives
- Map organizational security controls to NIST CSF functions
- Explain the ISO 27001 certification process and key requirements
Key concepts
- NIST CSF
- ISO 27001
- CIS Controls
- identify
- protect
- detect
- respond
- recover
2 · Vulnerability Management5 topics
Vulnerability Scanning
Vulnerability scanners, CVSS scoring, scan scheduling, false positive management, and remediation tracking
Objectives
- Configure and interpret vulnerability scan results
- Prioritize vulnerabilities using CVSS scores and business context
Key concepts
- Nessus
- Qualys
- CVSS scoring
- scan scheduling
- false positives
- remediation SLAs
- authenticated scans
- vulnerability databases
OWASP Top 10
Common web application vulnerabilities including injection, broken authentication, XSS, CSRF, and security misconfigurations
Objectives
- Identify OWASP Top 10 vulnerabilities in application code
- Recommend appropriate mitigations for each vulnerability category
Key concepts
- injection
- broken authentication
- XSS
- CSRF
- SSRF
- security misconfiguration
- insecure deserialization
- broken access control
Patch Management Strategy
Patch lifecycle, risk-based patching, rollback plans, patch automation, and emergency patching procedures
Objectives
- Design a risk-based patch management process
- Create emergency patching procedures with rollback plans
Key concepts
- patch lifecycle
- risk-based patching
- patch automation
- rollback plans
- emergency patches
- patch testing
- WSUS
- configuration management
Penetration Testing Basics
Pentest methodology, reconnaissance, exploitation, post-exploitation, reporting, and rules of engagement
Objectives
- Describe the phases of a penetration test
- Create a scope document and rules of engagement for a pentest
Key concepts
- reconnaissance
- enumeration
- exploitation
- post-exploitation
- pentest reporting
- rules of engagement
- scope definition
- Metasploit
Attack Surface Management
Asset discovery, shadow IT detection, external attack surface monitoring, and continuous exposure assessment
Objectives
- Design an attack surface management program
- Implement continuous monitoring for external exposure
Key concepts
- asset discovery
- shadow IT
- external attack surface
- EASM tools
- continuous monitoring
- asset inventory
- exposure management
- digital footprint
3 · Identity & Access5 topics
Authentication Protocols (OAuth2/OIDC/SAML)
OAuth 2.0 flows, OpenID Connect, SAML, MFA, and federated identity patterns
Objectives
- Select appropriate OAuth 2.0 flow for different application types
- Implement secure multi-factor authentication
Key concepts
- OAuth 2.0 flows
- OIDC
- SAML
- MFA
- JWT
- token validation
- federated identity
- SSO
Access Control Models (RBAC/ABAC)
Role-based, attribute-based, and policy-based access control design and implementation
Objectives
- Design RBAC models that avoid role explosion
- Compare RBAC and ABAC for complex authorization scenarios
Key concepts
- RBAC
- ABAC
- policy-based access
- least privilege
- role explosion
- permission boundaries
- access reviews
- entitlement management
Privileged Access Management
Privileged account security, just-in-time access, session recording, credential vaulting, and break-glass procedures
Objectives
- Design a PAM program that minimizes standing privileges
- Implement just-in-time access with audit trails
Key concepts
- privileged accounts
- just-in-time access
- session recording
- credential vaulting
- break-glass procedures
- PAM tools
- service account governance
- standing privileges
Zero Trust Architecture
Zero trust principles, micro-segmentation, identity-centric security, continuous verification, and NIST SP 800-207
Objectives
- Design a zero trust architecture for a hybrid cloud environment
- Apply NIST SP 800-207 principles to network and application access
Key concepts
- verify explicitly
- least privilege access
- assume breach
- micro-segmentation
- identity-centric
- continuous verification
- BeyondCorp
- NIST SP 800-207
Identity Governance
Identity lifecycle management, access certifications, segregation of duties, and orphaned account detection
Objectives
- Design an identity governance program with automated lifecycle management
- Implement access certification campaigns and SoD controls
Key concepts
- identity lifecycle
- access certifications
- segregation of duties
- orphaned accounts
- joiner-mover-leaver
- recertification campaigns
- IGA platforms
- birthright access
4 · Threat Detection & Response5 topics
SIEM Operations (Splunk/Sentinel)
SIEM deployment, log ingestion, correlation rules, dashboards, and alert tuning
Objectives
- Configure SIEM log sources and correlation rules
- Tune alerts to reduce false positives while maintaining detection coverage
Key concepts
- Splunk
- Microsoft Sentinel
- log ingestion
- correlation rules
- detection engineering
- alert tuning
- dashboards
- data normalization
Log Analysis & Correlation
Log parsing, pattern recognition, timeline analysis, cross-source correlation, and anomaly detection
Objectives
- Correlate events across multiple log sources to detect attacks
- Write effective queries to identify suspicious patterns
Key concepts
- log parsing
- pattern recognition
- timeline analysis
- cross-source correlation
- anomaly detection
- baseline behavior
- IOC matching
- KQL/SPL queries
MITRE ATT&CK Framework
Tactics, techniques, and procedures mapping, detection coverage analysis, and threat-informed defense
Objectives
- Map detection rules to MITRE ATT&CK techniques
- Identify gaps in detection coverage using the ATT&CK matrix
Key concepts
- tactics
- techniques
- procedures
- ATT&CK Navigator
- detection coverage
- threat-informed defense
- adversary emulation
- sub-techniques
Incident Response Procedures
IR lifecycle, containment strategies, eradication, recovery, communication protocols, and post-incident review
Objectives
- Lead an incident response following NIST SP 800-61 guidelines
- Create effective IR playbooks for common attack scenarios
Key concepts
- preparation
- identification
- containment
- eradication
- recovery
- lessons learned
- IR playbooks
- communication protocols
Digital Forensics Basics
Evidence collection, chain of custody, disk imaging, memory forensics, and forensic report writing
Objectives
- Collect and preserve digital evidence following chain of custody procedures
- Perform basic memory and disk forensics for incident investigation
Key concepts
- evidence collection
- chain of custody
- disk imaging
- memory forensics
- forensic tools
- write blockers
- forensic report writing
- legal admissibility
5 · Application & Cloud Security5 topics
Secure SDLC Integration
Security gates in CI/CD, SAST/DAST/SCA tools, security champions, and shifting security left
Objectives
- Integrate security testing tools into CI/CD pipelines
- Design a security champions program for development teams
Key concepts
- shift left
- SAST
- DAST
- SCA
- security gates
- security champions
- threat modeling in SDLC
- security user stories
Container Security
Image scanning, runtime security, Kubernetes security policies, secrets management, and container hardening
Objectives
- Secure a Kubernetes cluster using defense-in-depth controls
- Implement container image scanning in the build pipeline
Key concepts
- image scanning
- runtime security
- Kubernetes RBAC
- network policies
- pod security standards
- secrets management
- admission controllers
- container hardening
Cloud Security Posture (CSPM)
Cloud misconfiguration detection, compliance monitoring, CSPM tools, and multi-cloud security governance
Objectives
- Implement CSPM for continuous cloud compliance monitoring
- Design auto-remediation workflows for common misconfigurations
Key concepts
- CSPM tools
- cloud misconfigurations
- compliance monitoring
- cloud security benchmarks
- multi-cloud governance
- infrastructure scanning
- drift detection
- auto-remediation
Supply Chain Security
Software supply chain attacks, SBOM, dependency management, code signing, and provenance verification
Objectives
- Implement SBOM generation and vulnerability tracking for dependencies
- Design controls to prevent supply chain attacks in CI/CD pipelines
Key concepts
- SBOM
- dependency confusion
- typosquatting
- code signing
- provenance
- SLSA framework
- artifact verification
- build reproducibility
API Security
API authentication, rate limiting, input validation, API gateway security, and OWASP API Security Top 10
Objectives
- Identify and mitigate OWASP API Security Top 10 vulnerabilities
- Design secure API architectures with defense-in-depth controls
Key concepts
- API authentication
- rate limiting
- input validation
- API gateway security
- OWASP API Top 10
- BOLA
- broken function level auth
- mass assignment
6 · Security Strategy5 topics
Risk Assessment & Management
Qualitative and quantitative risk assessment, risk registers, risk treatment strategies, and risk appetite
Objectives
- Conduct a risk assessment using both qualitative and quantitative methods
- Develop risk treatment plans aligned with organizational risk appetite
Key concepts
- risk assessment
- qualitative analysis
- quantitative analysis
- risk register
- risk treatment
- risk appetite
- risk matrix
- annual loss expectancy
Security Architecture Design
Security reference architectures, defense in depth, security zones, and secure design patterns
Objectives
- Design a security architecture for a multi-tier application
- Apply defense-in-depth principles across network, application, and data layers
Key concepts
- reference architectures
- security zones
- defense in depth
- secure design patterns
- SABSA
- security capabilities
- trust boundaries
- data flow security
Compliance & Audit Readiness
SOC 2, PCI DSS, GDPR, HIPAA compliance, audit preparation, evidence collection, and continuous compliance
Objectives
- Prepare an organization for SOC 2 Type II audit
- Map security controls across multiple compliance frameworks
Key concepts
- SOC 2
- PCI DSS
- GDPR
- HIPAA
- audit preparation
- evidence collection
- continuous compliance
- control mapping
Threat Modeling (STRIDE/PASTA)
STRIDE, PASTA, and attack tree methodologies, data flow diagrams, threat enumeration, and mitigation prioritization
Objectives
- Conduct a STRIDE-based threat model for a web application
- Prioritize threats and mitigations using risk-based ranking
Key concepts
- STRIDE
- PASTA
- attack trees
- data flow diagrams
- trust boundaries
- threat enumeration
- mitigation prioritization
- threat libraries
Red Team / Purple Team Operations
Adversary simulation, red team planning, purple team collaboration, and measuring detection and response effectiveness
Objectives
- Plan and execute a red team engagement with clear objectives
- Design purple team exercises that improve detection and response capabilities
Key concepts
- adversary simulation
- red team operations
- purple team exercises
- detection validation
- C2 frameworks
- evasion techniques
- blue team collaboration
- attack narratives
7 · Expert Security5 topics
Zero Trust Architecture Design
Designing enterprise Zero Trust architectures: identity perimeter, micro-segmentation, continuous verification, and SASE
Objectives
- Design an enterprise Zero Trust architecture across identity, device, network, and application layers
- Evaluate SASE and ZTNA solutions for replacing VPN-based perimeter security
Key concepts
- identity perimeter
- micro-segmentation
- continuous verification
- SASE
- ZTNA
- least-privilege access
- BeyondCorp model
Advanced Threat Modeling
Applying advanced threat modeling methodologies (STRIDE, PASTA, LINDDUN) to complex distributed systems
Objectives
- Apply STRIDE, PASTA, or LINDDUN to model threats for complex distributed systems
- Build attack trees and prioritize threats using MITRE ATT&CK for realistic adversary simulation
Key concepts
- STRIDE
- PASTA
- LINDDUN
- attack trees
- threat actors
- data flow diagrams
- risk prioritization
- MITRE ATT&CK
Red Team Operations & Adversary Simulation
Planning and executing red team operations to simulate advanced persistent threats and validate security controls
Objectives
- Plan and execute red team operations simulating APT kill chains from initial access to impact
- Design purple team exercises that validate detection coverage against ATT&CK techniques
Key concepts
- kill chain
- APT simulation
- TTPs
- lateral movement
- C2 frameworks
- purple teaming
- ATT&CK framework
Security Architecture Review Process
Conducting systematic security architecture reviews: threat model reviews, design reviews, and security requirements analysis
Objectives
- Lead security architecture reviews using structured review checklists and trust boundary analysis
- Define security gates and requirements for engineering design review processes
Key concepts
- architecture review board
- security gates
- security requirements
- design review checklist
- trust boundaries
- security controls mapping
Compliance Automation & DevSecOps
Automating compliance checks in CI/CD pipelines: SAST, DAST, SCA, and policy-as-code for continuous compliance
Objectives
- Design a DevSecOps pipeline with SAST, DAST, and SCA integrated as security gates
- Implement compliance-as-code with automated evidence collection for audit readiness
Key concepts
- SAST/DAST
- SCA
- policy-as-code
- compliance-as-code
- SBOM
- security gates in CI/CD
- audit artifacts
Levels: Junior, Mid, Senior, and Expert
Explain it in your own words
Graded by AI · no account · 1 questionNo options to guess from: you write, the AI grades against the topic's rubric and tells you what level your answer reads at.
Already studying Cybersecurity Engineer?
The assessment measures topic by topic, and your plan skips what you already know.
Open to read. An account is only needed to be measured.
Frequently asked questions
Where should I start studying Cybersecurity Engineer?
Start with Security Fundamentals: CIA Triad & Security Principles, Network Security Basics, and Operating System Security. The map orders topics by what they depend on, so each one prepares the next.
How long does a full Cybersecurity Engineer assessment take?
A full assessment of this path takes about 55 minutes. Study time depends on where you start; a diagnostic shows which topics you can skip.
Do I need an account to use this page?
No. The map, objectives and key concepts are open. You only need an account to be measured, get your gap by topic and receive a plan.