Model a system as an attack-path graph, find the chokepoints, and reason
about blast radius the way an attacker (and a good defender) does.
Audit a cloud account's IAM for privilege-escalation paths, design
multi-account guardrails, and attack-then-close a metadata-to-role-to-data
chain.
Attack a Kubernetes cluster (RBAC escalation, token theft, container escape)
and then harden it with Pod Security Admission, admission policy, network
policy, and runtime detection.
Design distributed authorization for a microservice system: workload
identity (SPIFFE/SPIRE), token exchange, and a relationship-based policy
engine (Zanzibar-style), with proven multi-tenant isolation.
Exploit and remediate the advanced web classes the first guide skipped:
request smuggling, XXE, SSRF chains, prototype pollution, deserialization,
web race conditions, SSTI-to-RCE, and SAML/OIDC attacks.
Build a data-protection layer: envelope encryption with a key hierarchy,
per-tenant keys, tokenization for PCI scope reduction, crypto-shredding for
erasure, and de-identification for analytics.
Run the detection-engineering lifecycle: telemetry architecture,
detection-as-code, ATT&CK coverage, threat hunting, and cloud/container
incident response.
Stand up the program scaffolding: SSDLC gates, vulnerability management at
scale (EPSS/KEV/reachability), an offensive program, and compliance without
theater.
Communicate risk quantitatively to engineers and to leadership.
