Description

This curriculum spans the design and operational governance of core security functions across threat intelligence, identity management, endpoint and network controls, cloud security, incident response, and secure development, reflecting the multi-quarter implementation cycles and cross-team coordination typical of enterprise security modernization programs.

Module 1: Threat Landscape Analysis and Intelligence Integration

Establishing criteria for ingesting external threat intelligence feeds based on relevance to industry-specific attack patterns and adversary TTPs.
Configuring internal SIEM systems to normalize and correlate IOCs from multiple threat feeds without introducing performance bottlenecks.
Deciding which intelligence-sharing communities (e.g., ISACs) to join based on data reciprocity, legal liability, and operational utility.
Implementing automated enrichment of security alerts using threat intelligence platforms (TIPs) while managing false-positive rates.
Developing rules for deprecating stale threat indicators to prevent alert fatigue and maintain detection efficacy.
Assigning ownership for threat actor profiling and campaign tracking across security operations and incident response teams.

Module 2: Identity and Access Management at Scale

Designing role-based access control (RBAC) hierarchies that balance least privilege with operational efficiency in multi-tenant environments.
Integrating legacy systems with modern identity providers using SAML or OIDC without compromising authentication audit trails.
Enforcing step-up authentication for privileged actions based on risk context, such as geolocation or device posture.
Implementing just-in-time (JIT) access for third-party vendors with time-bound approvals and session monitoring.
Managing privileged account lifecycle across hybrid environments, including cloud workloads and on-prem servers.
Responding to orphaned accounts after employee offboarding by establishing automated detection and remediation workflows.

Module 3: Endpoint Detection and Response (EDR) Deployment

Selecting EDR agents based on kernel-level visibility requirements and compatibility with existing endpoint protection suites.
Defining detection rules that minimize performance impact on user devices while maintaining behavioral monitoring coverage.
Configuring EDR console access with role-based permissions to prevent unauthorized tampering with detection logic.
Integrating EDR telemetry into central SIEM for cross-platform correlation without duplicating event streams.
Responding to EDR alerts with containment actions that avoid disrupting business-critical applications.
Conducting regular tuning of detection signatures to reduce false positives from legitimate administrative activity.

Module 4: Network Security Architecture and Segmentation

Designing micro-segmentation policies for data center workloads based on application dependency mapping and compliance boundaries.
Deploying inline inspection tools (e.g., next-gen firewalls) without introducing single points of failure in high-availability networks.
Implementing DNS-layer security controls to block command-and-control traffic while maintaining internal resolution integrity.
Managing firewall rule sprawl through periodic rulebase audits and automated deprecation of unused rules.
Enforcing encrypted traffic inspection policies that comply with privacy regulations and avoid decrypting sensitive HR or legal data.
Integrating network access control (NAC) systems with endpoint posture assessment to dynamically assign VLANs or access tiers.

Module 5: Cloud Security Posture Management (CSPM)

Mapping cloud resource configurations to compliance frameworks (e.g., CIS, NIST) using automated policy-as-code tools.
Responding to misconfigured S3 buckets or public database endpoints with automated remediation scripts and ownership alerts.
Integrating CSPM tools with CI/CD pipelines to enforce security guardrails before infrastructure provisioning.
Managing cross-account IAM roles in AWS or Azure to prevent privilege escalation through overly permissive trust policies.
Monitoring for shadow IT by detecting unauthorized cloud service signups using DNS and proxy logs.
Establishing ownership accountability for cloud resources by linking workloads to business units via tagging standards.

Module 6: Incident Response Orchestration and Playbook Design

Developing playbooks for ransomware incidents that specify escalation paths, communication protocols, and system isolation procedures.
Integrating SOAR platforms with ticketing systems to ensure incident actions are auditable and comply with regulatory timelines.
Defining thresholds for declaring incident severity levels based on data exfiltration volume, system criticality, and business impact.
Coordinating containment actions across geographically distributed teams while maintaining chain-of-custody for forensic evidence.
Conducting tabletop exercises that simulate supply chain compromises to validate detection and response workflows.
Managing disclosure decisions for incidents involving third-party vendors based on contractual SLAs and legal obligations.

Module 7: Security Governance and Risk Metrics

Calculating mean time to detect (MTTD) and mean time to respond (MTTR) using historical incident data to prioritize tooling investments.
Presenting cyber risk exposure to executive leadership using business-aligned KPIs rather than technical vulnerability counts.
Establishing thresholds for acceptable risk in legacy system remediation based on cost, downtime, and exploit likelihood.
Aligning security controls with regulatory requirements (e.g., GDPR, SOX) through control mapping and audit trail maintenance.
Managing third-party risk by requiring security questionnaires and continuous monitoring for critical vendors.
Conducting annual penetration tests with scoped objectives that reflect real-world attack scenarios and business priorities.

Module 8: Secure Development and DevSecOps Integration

Integrating SAST and DAST tools into CI/CD pipelines with fail-safe thresholds that prevent blocking legitimate code changes.
Managing false positives in code scanning by tuning rulesets for specific frameworks and application architectures.
Enforcing secure configuration of container images using image signing and vulnerability scanning in registries.
Defining ownership for remediating open-source library vulnerabilities based on development team responsibility and patch availability.
Implementing secrets detection in source code repositories with automated alerts and revocation workflows for exposed credentials.
Conducting threat modeling for new applications during design phase to identify security requirements before coding begins.