Description

A focused course, tailored for you

The Merchant-Side Cyber Analyst Investigation Playbook

A written investigation playbook for the analyst who has to clear a merchant-impacting alert before the next CAB without losing the audit trail.

The alert is in your queue. The CAB is in fifty-seven minutes. The merchant TAM is already typing a Slack question. You need a write-up that answers four different readers without rewriting it four times.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Cyber security analysts working inside a high-scale commerce platform sit at the junction between merchant-impacting alerts and the rest of the business. The detection is rarely the bottleneck. The bottleneck is the write-up. The merchant TAM wants a plain-language explanation of whether the buyer-facing surface was exposed. The on-call eng manager wants a yes or no on the change window. The GRC partner wants the evidence wrapped so the SOC 2 control owner can drop it straight into the audit folder. The privacy team wants to know whether the data the attacker could have read crosses any PII boundary that triggers notification. Most analyst playbooks stop at the IOC. The work after the IOC, the work that decides whether the merchant stays calm and the deploy ships on time, is the work nobody trained you for. That is the work this course covers.

What you walk away with

Triage a merchant-impacting alert against a written checklist that names every downstream reader and the artefact each one needs.
Produce a CAB-ready one-pager from an open investigation in under thirty minutes, with the deploy-decision question answered explicitly.
Build the merchant blast-radius worksheet that the TAM can read directly to the affected account without translation.
Wrap the investigation evidence the way the SOC 2 control owner and the PCI assessor will accept without follow-up questions.
Run the post-incident control regression that prevents the same alert pattern from recurring, and log the regression where the auditor will find it.

The 12 modules

Module 1. The merchant-impacting alert taxonomy

A working taxonomy of the alerts that touch a merchant surface, separated from the alerts that do not. Covers admin-portal session anomalies, API token replay, buyer-data access patterns, payment-flow tampering signals, and the supply-chain integrity alerts that ride on third-party app installs. Each alert type gets a default downstream-reader map so you know who needs to hear what before you start typing.

Module 2. Token replay and session-graph analytics

How to query session graphs to confirm or deny a replay claim quickly. Covers building the token-to-IP-to-ASN-to-device-fingerprint join in your SIEM, the distinction between legitimate session sharing inside a merchant team and adversarial replay, and the five questions to answer before you escalate. Includes the worked example of the two-ASN ninety-second case and the analyst notebook structure that survives an audit review.

Module 3. Merchant blast-radius worksheet

A written worksheet that captures, for a given alert, exactly which merchant accounts and which buyer-facing surfaces were in scope. Covers account boundaries, app-installation scope, embedded checkout surfaces, and the data classifications inside each. The worksheet is the artefact the merchant TAM reads aloud on the call, so it is built to be read aloud rather than skimmed.

Module 4. The CAB-ready one-pager

Templates for the one-pager the change advisory board needs from you when your alert is the reason a deploy might pause. Covers the deploy-decision question stated explicitly at the top, the evidence summary, the residual-risk paragraph, and the rollback trigger. Includes three worked examples at three different severities and the language pattern that lets a non-security CAB member decide without asking you to reread the whole thing.

Module 5. Evidence packaging for SOC 2 and PCI

How to wrap the investigation artefacts so the SOC 2 control owner and the PCI assessor accept the evidence without a follow-up request. Covers the file-naming convention that maps cleanly to control IDs, the chain-of-custody record an internal audit reviewer will inspect, the timestamp normalisation rule, and the redaction pattern that lets you share evidence externally without leaking buyer PII.

Module 6. The privacy-team handoff

The decision tree for whether an investigation triggers a privacy review and what the privacy team needs from you when it does. Covers buyer-PII boundary mapping, the data-classification cross-walk between your security taxonomy and the privacy taxonomy, the notification-trigger thresholds across the jurisdictions a global commerce platform actually serves, and the artefact format the privacy team uses to make their own decision.

Module 7. Working with the merchant TAM

How to brief the technical account manager who will speak to the affected merchant. Covers the plain-language translation of admin-portal alerts, the four questions the TAM will be asked by the merchant, the artefacts the TAM needs in advance so they are not reading the worksheet for the first time on the call, and the post-call sync that keeps the merchant record clean for future audits.

Module 8. Deploy-window decision support

How to give the on-call engineering manager a clear go or no-go signal during an active deploy window. Covers the deploy-decision question structure, the residual-risk language that lets the manager decide without security expertise, the partial-go pattern when only one service in the deploy is affected, and the post-deploy verification check that closes the loop.

Module 9. Supply-chain alert investigation

Specific patterns for investigating alerts that originate from a third-party app, a partner integration, or a build-pipeline anomaly. Covers the SBOM lookup workflow, the merchant-installation footprint query, the partner-notification decision tree, and the joint-investigation artefact the partner security team will accept. Includes the worked example of an installed-app token leakage and the merchant-side communication pattern.

Module 10. Documentation that survives the next quarter

How to write the investigation record so that the analyst who picks up a similar alert next quarter does not have to start from scratch. Covers the indexed runbook entry, the cross-reference to related alerts, the lesson-learned that becomes a detection rule, and the tagging convention that makes the record discoverable inside your case-management system.

Module 11. Post-incident control regression

How to run the regression check that confirms the control gap behind the original alert has been closed. Covers the regression query template, the cadence for re-running it, the place to log the regression result so the internal audit team finds it, and the language to use when the regression reveals the control gap is wider than the original alert suggested.

Module 12. The analyst portfolio artefact

A written summary of your investigation work that you can show internally for promotion, lateral movement, or external interviews. Covers the case-anonymisation pattern, the three-investigation portfolio structure, the metric set that quantifies your impact without leaking buyer data, and the narrative arc that turns a queue of tickets into a coherent body of work.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Module 1 helps when a new alert type lands in your queue and you are not yet sure who downstream needs to hear about it.

Modules 2 through 4 are the active-investigation kit for any alert that has a CAB or a merchant TAM consequence.

Modules 5 through 7 are for the handoffs that happen once the technical answer is known.

Modules 8 through 12 are the closing work, the documentation, the regression check, and the portfolio artefact that survives the next quarter.

What you get with this course

Written modules in the Art of Service learning environment, each anchored to a specific merchant-impacting alert pattern.
Downloadable templates for the merchant blast-radius worksheet, the CAB one-pager, the SOC 2 and PCI evidence wrapper, and the privacy-team handoff brief.
Worked examples drawn from admin-portal session replay, supply-chain app token leakage, and buyer-data access anomalies.
Hand-built implementation playbook delivered alongside course access, tailored to the analyst working inside a high-scale commerce platform.

What you will have in hand by Day 1, Week 1, Month 1

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.

Modules 1 through 4 are workable in the first week if you are running an active investigation.

Modules 5 through 8 fit the handoff cadence for the next two weeks of alerts.

Modules 9 through 12 are revisited at the next post-incident review and at the next internal audit cycle.

Before and after

Before

The alert lands. You spend forty minutes triaging, twenty minutes rewriting the same answer for the TAM, the eng manager, the GRC partner, and the privacy team, and another twenty trying to remember where you put the evidence files so the SOC 2 control owner can grab them.

After

The alert lands. You open the playbook, run the session-graph query, fill the blast-radius worksheet, hand the CAB one-pager to the eng manager, drop the evidence into the prewrapped folder structure, and close the ticket inside the SLA with every downstream reader served.

What happens if you do not address this

Without a written investigation playbook, every merchant-impacting alert is reinvented from memory. The slowest part is the write-up, not the triage. Over a quarter the cost is paid in missed deploy windows, merchant TAMs reading worksheets for the first time on a live call, audit follow-ups that the SOC 2 control owner has to chase, and investigations that do not survive the next quarter because the documentation pattern was different each time.

Who it is for

A cyber security analyst inside a commerce or fintech platform whose alerts have a merchant-facing blast radius. You triage admin-portal sessions, API token misuse, buyer-data access patterns, and the occasional supply-chain anomaly. You report into a SOC or security operations function, but your write-ups end up in the hands of merchant TAMs, engineering managers running deploy windows, GRC analysts assembling SOC 2 and PCI evidence, and the privacy team. You want the triage clock to feel less like a panic and more like a checklist you trust.

Who this is NOT for. Not for a network engineer who never touches application-layer alerts. Not for a CISO or director who does not personally close tickets. Not for a SOC analyst at a non-commerce platform where there is no merchant TAM relationship to manage. Not for a red-team operator or detection engineer whose output is rules and tooling rather than investigation write-ups.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. About four to six hours across all twelve modules for a first pass. Reusable as a reference whenever a merchant-impacting alert lands.

Why $199 is the right number

Generic incident-response training stops at the IOC and assumes the write-up is a documentation problem rather than a multi-reader artefact problem. SANS courses cover detection depth but not the merchant TAM handoff, the CAB one-pager, or the SOC 2 evidence wrapper. Internal runbooks tend to grow ticket by ticket and never reach the regression-check stage. This playbook is built specifically for the analyst whose alerts touch a merchant surface, where the investigation is only half the job.

FAQ

Does this teach detection engineering?

No. The course assumes detections already exist and the alert is in your queue. It covers what happens between the alert landing and the ticket closing.

Is the implementation playbook generic?

No. The implementation playbook is hand-built for the analyst working merchant-impacting alerts inside a high-scale commerce platform. It is written after purchase and delivered alongside course access.

How current are the SOC 2 and PCI evidence patterns?

The evidence-wrapping module covers the current Trust Services Criteria and the current PCI DSS version. The pattern is the same when the assessor changes; only the file-naming convention shifts.

Does it cover privacy notifications across jurisdictions?

Yes. Module 6 covers the notification-trigger thresholds for the jurisdictions a global commerce platform actually serves, with the decision tree the privacy team will accept.

Is there a discount for team purchases?

Reach out by reply to discuss team pricing. The default is per-seat at the listed price.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.