Description

A focused course, tailored for you

Application Security for Platform Engineering Teams

Build the threat model, secure the API surface, and make AppSec stick in a fast-moving platform org.

Platform engineering teams ship fast. AppSec reviews are slow. The result is a widening gap where security sign-off becomes a bottleneck developers route around, and vulnerabilities accumulate in the parts of the codebase nobody has time to revisit.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Application Security professionals inside platform-scale organisations face a structural tension: the toolchain moves at sprint cadence, but the security review process was designed for waterfall release gates. SAST findings pile up without triage priority. Threat models exist as documents rather than living artefacts. API surfaces grow across microservices without a consistent security baseline. Secrets rotation is manual and deferred. The security champion programme exists on paper but has no adoption mechanism. None of these are failures of intent. They are failures of process design. This course rebuilds the process from the inside.

What you walk away with

Run a threat modelling session in under 90 minutes that a developer squad can repeat without a security engineer in the room.
Define an API security baseline that applies consistently across service-mesh and REST endpoints without creating a separate review queue.
Implement secrets management in CI/CD pipelines using patterns that are adopted rather than bypassed.
Design a security-champion programme with clear scope, a monthly cadence, and measurable adoption metrics.
Triage SAST and DAST findings by risk and business context so that high-severity issues get fixed before the next release.
Produce a per-sprint security checklist that lives inside the team's existing tooling rather than a separate process.

The 12 modules

Module 1. The AppSec Operating Model for Platform Organisations

Contrasts the traditional AppSec gate model with the embedded-security model that fits platform engineering. Covers the three process failures that produce the review-avoidance pattern (slow queues, unclear ownership, no developer feedback loop) and defines the operating principles this course builds toward. Introduces the Security-by-Default maturity ladder used to position the team at the start of the course.

Module 2. Threat Modelling at Sprint Cadence

Walks through STRIDE and PASTA in their abbreviated, sprint-compatible forms. Shows how to scope a threat model to a single user story or API endpoint rather than an entire system. Covers the 90-minute threat modelling facilitation format, the artefacts produced (data flow diagram, threat register, mitigations backlog), and how to hand off findings as actionable tickets rather than a separate document.

Module 3. API Security Baseline for Microservices and Service Mesh

Defines the minimum security baseline for REST and gRPC APIs in a service-mesh environment: authentication (mTLS, JWT, API key lifecycle), authorisation (RBAC vs ABAC at the API layer), input validation, rate limiting, and error response hygiene. Covers how to encode the baseline as a linting ruleset that runs in CI rather than a review checklist a human must apply.

Module 4. SAST and DAST: Triage Without the Backlog Spiral

Addresses the most common SAST failure mode: a finding queue that grows faster than it is resolved because all findings are treated as equal priority. Covers severity classification by exploitability and business impact, the false-positive triage protocol, how to set suppression rules with accountability (who suppressed, why, reviewed by whom), and how to report SAST health to engineering leadership without turning it into a compliance theatre exercise.

Module 5. Secrets Management in CI/CD Pipelines

Covers the four most common secrets-leakage patterns in platform environments (hardcoded in source, committed in config, exposed in logs, copied into CI environment variables) and the vault-integration patterns that eliminate each one. Includes a migration runbook for rotating secrets already in the wild, a pre-commit hook configuration for secrets detection, and a developer-facing guide that explains the why as well as the how.

Module 6. Dependency Risk: SCA at Scale

Software Composition Analysis for large polyglot repositories. Covers how to configure SCA tooling (Dependabot, Snyk, OWASP Dependency-Check) for meaningful signal rather than noise, how to define a patching SLA by severity and exploitability, how to handle transitive dependencies in monorepos, and how to operationalise SBOM generation for the components that matter to downstream customers or regulators.

Module 7. Container and Infrastructure-as-Code Security

Covers image hardening (base image selection, non-root user, read-only filesystem, capability dropping), container registry scanning integrated into the build pipeline, Dockerfile and Helm chart linting with security rules, Terraform and Kubernetes manifest scanning using tools like Checkov and Trivy. Defines the policy-as-code pattern that enforces these controls without a human reviewer approving every change.

Module 8. Authentication and Authorisation Patterns for Internal Services

Addresses the internal-trust failure: services inside a platform perimeter that authenticate to each other with shared secrets or no authentication at all. Covers zero-trust service-to-service auth using mTLS and workload identity (SPIFFE/SPIRE), OAuth 2.0 and OIDC token validation patterns, the difference between authentication and authorisation at the API gateway versus at the service itself, and how to roll this out incrementally without breaking existing integrations.

Module 9. Security Champions: Programme Design That Gets Adopted

Analyses why most security-champion programmes fail (no clear scope, no time allocation, no feedback loop back to the security team) and defines the programme design that produces sustained adoption. Covers champion selection criteria, the monthly champion meeting format, the champion runbook template, how to handle champions who leave the team, and how to measure programme health with metrics that matter to engineering leadership rather than security.

Module 10. Security in the Developer Experience: IDE, PR, and Pipeline Gates

Covers the three integration points where security feedback reaches developers at the lowest context-switching cost: IDE plugins (linting, secrets detection), pull-request checks (SAST summary, dependency diff, IaC scan result), and pipeline gates (pass/fail criteria by severity, mandatory review triggers). Defines the configuration that makes these gates useful rather than friction, including how to handle the first-run false-positive spike when a new gate is enabled.

Module 11. Incident Response Handoff: From AppSec to SecOps

Covers the interface between application security and the security operations function when a vulnerability is exploited or a build artefact is compromised. Defines the runbook format that lets SecOps triage an application-layer incident without needing an AppSec engineer on the bridge, the logging and observability requirements that make application-layer forensics possible, and the post-incident review process that feeds findings back into the threat model.

Module 12. Measuring and Communicating AppSec Programme Health

Defines the metrics that accurately reflect AppSec maturity (mean time to remediate by severity, SAST coverage percentage, champion programme adoption rate, secrets-leak incidents per quarter) and the reporting format that communicates progress to engineering leadership without being dismissed as a compliance dashboard. Includes a quarterly AppSec health review template and a board-level risk summary format for organisations with regulatory reporting requirements.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Sprint ships before the security review slot opens: Modules 1, 2, and 10 rebuild the review process so it runs inside the sprint, not after it.

SAST backlog is growing faster than the team can triage it: Module 4 defines the triage protocol and suppression rules that bring the queue under control.

Secrets have leaked into source or CI environment variables: Module 5 provides the migration runbook and the CI/CD integration pattern that prevents recurrence.

Security champion programme exists on paper but has no traction: Module 9 redesigns the programme with clear scope, a monthly cadence, and measurable adoption metrics.

What you get with this course

12 written modules covering threat modelling, API security, SAST/DAST triage, secrets management, container security, IaC scanning, security champions, and AppSec metrics.
Per-sprint security checklist formatted for integration into Jira or Linear.
90-minute threat modelling facilitation template with STRIDE worksheet.
API security baseline linting ruleset (configurable for REST and gRPC).
Secrets management migration runbook and pre-commit hook configuration.
Security-champion programme runbook template.
Quarterly AppSec health review template.
Hand-built implementation playbook delivered alongside course access.

What you will have in hand by Day 1, Week 1, Month 1

Course access and the hand-built implementation playbook are provisioned within 24 hours of purchase.

Before and after

Before

Security reviews are a queue that developers route around. SAST findings accumulate without triage priority. Secrets rotation is deferred. The security champion programme has no adoption. AppSec metrics report findings volume rather than programme health.

After

Threat modelling runs inside sprint planning. The SAST queue is under control with clear triage criteria. Secrets are managed in vault integrations that developers use because they are easier than the alternative. The security champion programme has a monthly cadence and measurable adoption. AppSec health is reported in terms that resonate with engineering leadership.

What happens if you do not address this

Every sprint that ships without a working security review process widens the attack surface faster than it can be assessed. Vulnerabilities that would have been caught in a functioning threat model become incidents, and incidents inside a platform organisation affect every service that runs on it.

Who it is for

Application security engineers and AppSec leads working inside platform engineering, SRE, or product-security organisations who are accountable for securing a large, fast-moving codebase and need practical methods that fit how developers actually work.

Who this is NOT for. Penetration testers focused on external red-team engagements. GRC professionals whose work is primarily policy and audit documentation. Security operations analysts focused on incident response rather than secure development.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Each module is designed to be read in 20-30 minutes. The full course runs approximately six hours. The templates and runbooks are ready to use immediately; full implementation of all 12 modules across a platform team typically takes one quarter.

Why $199 is the right number

Internal security training programmes cover policy and compliance, not the operational process of embedding AppSec into a platform engineering workflow. Commercial SAST and DAST tooling addresses detection, not the triage and prioritisation problem. Conference talks and open-source guides cover individual techniques, not the operating model that makes those techniques stick at scale. This course builds the operating model.

FAQ

Is this relevant to teams that are already using SAST and DAST tooling?

Yes. The course is not about tool selection. It is about the process that makes the tools produce useful signal rather than noise. Most teams that struggle with SAST backlogs are not using the wrong tool; they are using the right tool without the triage and suppression workflow that keeps the queue manageable.

Does this cover cloud-native and Kubernetes environments specifically?

Modules 7 and 8 are written specifically for container and service-mesh environments. The API security baseline in Module 3 covers both REST and gRPC patterns. The secrets management module covers vault integrations for cloud-native CI/CD pipelines.

How is the implementation playbook tailored?

The hand-built implementation playbook is produced for your specific context after purchase. It takes the course frameworks and adapts them to your platform's scale, team structure, and existing toolchain, based on the onboarding information you provide.

Is this suited to a single AppSec engineer or a team?

Both. A single AppSec engineer can work through the course and use the templates to build the operating model from scratch. A team can distribute modules across members, with each person owning the implementation artefacts for their area.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.