Security principles
Importance: Essential (5 of 5)
Applies threat, risk, least-privilege, and defense-in-depth models.
← All career guides9 of 9 skills67 of 67 courses
Security
Security Engineer
Designs and implements controls that reduce risk across infrastructure, applications, identities, and cloud environments.
Skill coverage
100%
Course coverage
100%
Skill coverage shows how much of the role's capability map already has a published course. Course coverage shows how much of the mapped course pipeline for this role has shipped.
- Role skills
- 9
- Published coverage
- 9
- Relevant courses
- 67
Capability map
Skills
Importance describes how central each capability is to the role. Course coverage shows where you can build the skill in the current OpenSkills catalog.
Security principles: 2 more courses
Security architecture: 2 more courses
Identity and access: 10 more courses
Security governance: 2 more courses
Network security: 5 more courses
Application security: 11 more courses
Cloud security: 2 more courses
Security Engineer capability map
- Security Engineer
- Security foundations
- Engineering domains
01
Security foundations
5 capabilities
Threat modeling
Importance: Essential (5 of 5)
Identifies trust boundaries, abuse cases, and proportionate mitigations.
Course coverage
Security architecture
Importance: Essential (5 of 5)
Designs controls as coherent parts of system architecture.
Identity and access
Importance: Essential (5 of 5)
Engineers authentication, authorization, secrets, and privileged access.
Course coverage
Security governance
Importance: Important (3 of 5)
Sets policy, standards, and program direction, and measures whether controls hold in practice.
02
Engineering domains
4 capabilities
Network security
Importance: Very important (4 of 5)
Protects network boundaries, flows, and services.
Application security
Importance: Essential (5 of 5)
Integrates secure design, coding, testing, and dependency controls.
Course coverage
- Application Security FundamentalsFree
- AI Red Teaming
- API Security
- Artifact Signing
- Attack Surface Management
- Authentication and Authorization
- Build Pipeline Security
- Container Image Security
- Dependency Security
- DevSecOps Fundamentals
- NGINX Security Hardening
- Runtime Application Security
- Secure Coding
- Secure Software Development Lifecycle
Cloud security
Importance: Very important (4 of 5)
Applies cloud identity, workload, data, and configuration controls.
Security operations
Importance: Very important (4 of 5)
Uses detection and incident response to contain active threats.
Course coverage
- Endpoint Detection and Response
- Intrusion Detection and Prevention
- Malware Analysis Fundamentals
- Network Detection and Response
- Open Source Security
- Ransomware Defense
- Security Information and Event Management
- Security Operations Fundamentals
- Security Orchestration, Automation, and Response
- Social Engineering Defense
- Threat Hunting
- Security Metrics
Learning path
Relevant courses
Core foundations
The concepts this role is built on.
Supporting knowledge
Adjacent knowledge that improves day-to-day judgment.
- Active Directory Security
- AI Red Teaming
- API Security
- Artifact Signing
- Attack Surface Management
- Authentication and Authorization
- Build Pipeline Security
- Certificate ManagementFree
- CIS Controls
- Cloud Native Security
- Cloud Penetration Testing
- Cloud SecurityFree
- Container Image Security
- Cryptographic Key Management
- Cryptography Fundamentals
- Data Loss Prevention
- Dependency Security
- DevSecOps Fundamentals
- Email Security
- Embedded Secure Boot and Chain of Trust
- Endpoint Detection and Response
- Federated Identity
- Firewalls
- HashiCorp Vault
- Identity Governance and Administration
- Intrusion Detection and Prevention
- Keycloak Fundamentals
- LDAP
- Malware Analysis Fundamentals
- Multi-Factor Authentication
- Network Detection and Response
- Open Source Security
- Privacy Engineering
- Privileged Access Management
- Public Key InfrastructureFree
- Ransomware Defense
- SAML
- Security Information and Event Management
- Security Operations Fundamentals
- Security Orchestration, Automation, and Response
- Single Sign-On
- SOC 2 Compliance
- Social Engineering Defense
- Threat Hunting
- TLS FundamentalsFree
- Virtual Private Networks
- Wallet and Key Custody
Specializations
Deeper paths for particular environments or directions.
- AWS Identity and Access Management
- Infrastructure Security Hardening
- Kubernetes Security
- NGINX Security Hardening
- Post-Quantum Cryptography
- Runtime Application Security
- Secure Coding
- Secure Software Development Lifecycle
- Security Governance
- Security Metrics
- Security Policies and Standards
- Security Program Management
- Zero Trust ArchitectureFree
HOWTOs
Concrete operational procedures from the courses on this page.
- How to contain a leaked cloud access key or compromised cloud identity
not executable: Needs a live cloud account (AWS, Microsoft Entra, or Google Cloud) where the leaked key or compromised identity still exists, with pre-incident audit logs and a break-glass responder principal that can disable credentials and revoke sessions. No runner in the fleet holds a tenant under an active credential incident, and a local emulator cannot prove real disable, session revoke, or persistence cleanup against a provider control plane, so nothing here is executed.
Disabling the credential, revoking the temporary sessions it already started, and scoping the principals, identity providers, and resources an attacker may have created for persistence, across AWS, Microsoft Entra, and Google Cloud.
Cloud Security
- How to scope and contain a compromised cloud compute instance
not executable: Needs a live cloud account with a running compute instance under investigation (EC2, Azure VM, or Compute Engine), same-region forensics capacity for memory and disk capture, and authority to isolate the instance and revoke its cloud credentials without destroying evidence. No runner in the fleet hosts that incident context, and a local VM cannot prove provider network isolation or instance-role session revoke, so nothing here is executed.
Isolating one compromised virtual machine without destroying evidence: the order of memory capture, disk snapshots, network isolation, and revoking the instance's own cloud credentials, then rebuilding from a known-good image rather than cleaning in place.
Cloud Security
Put the map to work
Find Security Engineer roles.
Search multiple job sources at once with queries tailored to this career, then use the skill map above to evaluate what each role actually asks for.