Cybersecurity Engineer

Start from zero: variables, control flow, functions, debugging, terminal habits, and the programming vocabulary used throughout the pathway.

Trace DNS, TCP, TLS, HTTP, processes, users, files, permissions, ports, and logs, then build a local security inspector.

Understand the complete web request lifecycle, trust boundaries, proxies, caching, APIs, and the architecture security controls must protect.

Model Sentinel Notes with assets, actors, data flows, trust boundaries, STRIDE threats, misuse cases, mitigations, and residual risk.

Implement Argon2id passwords, safe recovery, opaque sessions, rotation, revocation, resource authorization, OAuth with PKCE, MFA, and passkey-aware design.

Defend web and API boundaries against broken access control, injection, SSRF, XSS, CSRF, unsafe errors, and resource abuse using OWASP 2025 and ASVS 5.0.

Constrain validation, serialization, filesystem, process, and secret boundaries and choose maintained cryptographic recipes by required property.

Harden CI with least privilege, pinned actions, dependency and secret review, SAST, SBOMs, provenance, signatures, and fail-closed release gates.

Harden images and Kubernetes workloads with non-root execution, restricted security contexts, bounded identity, RBAC, NetworkPolicy, admission, and runtime evidence.

Design privacy-aware security events, behavior detections, triage evidence, containment, recovery, incident timelines, and post-incident improvements.

Protect LLM and agent systems from prompt injection, excessive agency, tool misuse, memory poisoning, unsafe output, and uninformed approvals.

Capstone: audit, reproduce bounded abuse cases, fix root causes, add regression and delivery gates, detect attempted abuse, and present the hardened Sentinel Notes system.