Red teamer
Simulate real attacker paths across people, apps, identity, cloud, and infrastructure.
What it means
Red teaming is goal-driven adversary simulation. The work is less about one bug class and more about planning a realistic path, testing detection, and explaining business impact.
Good fit
Learners who want broad offensive depth across enterprise environments.
End state
You can plan scoped campaigns, chain findings responsibly, and communicate attack paths clearly.
Real-world domains
Web applications and APIs SaaS products, REST and GraphQL APIs, browser trust boundaries, sessions, tenants, and business logic. Enterprise identity SSO, MFA, directory services, Kerberos concepts, role design, service accounts, and ownership checks. Cloud compute and platform Cloud accounts, IAM, storage, metadata services, serverless, containers, Kubernetes, and workload boundaries. Detection and incident response Logs, packets, endpoint artifacts, cloud audit trails, triage, timelines, and control validation. Research, scoping, and reporting Authorized research workflow: scope, notes, repeatability, evidence, severity, remediation, and writeups. Milestone flow
- Scope objectives
Define goals, rules of engagement, evidence standards, and a repeatable workspace.
- Map web and API exposure
Find reachable products, trust boundaries, data flows, and likely bug classes.
- Chain identity and platform paths
Connect application access, enterprise identity, and cloud or workload privileges.
- Validate detection and impact
Explain what defenders should see, what controls failed, and how to reduce repeat risk.
Categories in this path
Penetration tester
Assess scoped systems, validate risks, and write reproducible findings.
What it means
Penetration testing is a scoped security assessment. The goal is to find and validate issues, avoid unnecessary risk, and produce useful remediation guidance.
Good fit
Learners aiming for consulting, internal assessments, or junior pentest roles.
End state
You can run a scoped review from setup to evidence, severity, and remediation.
Real-world domains
Web applications and APIs SaaS products, REST and GraphQL APIs, browser trust boundaries, sessions, tenants, and business logic. Cloud compute and platform Cloud accounts, IAM, storage, metadata services, serverless, containers, Kubernetes, and workload boundaries. Enterprise identity SSO, MFA, directory services, Kerberos concepts, role design, service accounts, and ownership checks. Research, scoping, and reporting Authorized research workflow: scope, notes, repeatability, evidence, severity, remediation, and writeups. Milestone flow
- Scope the assessment
Translate the statement of work into test boundaries, accounts, notes, and evidence rules.
- Assess apps and APIs
Test request flows, identity, object ownership, input handling, and business logic.
- Add host and cloud context
Understand where the system runs and which platform controls affect exploitability.
- Package findings
Write reproduction steps, severity, impact, remediation, and retest notes.
Categories in this path
Blue teamer
Defend systems by understanding signals, logs, controls, and attacker behavior.
What it means
Blue teaming is defensive security operations. It focuses on hardening, monitoring, triage, detection, and response using concrete evidence.
Good fit
Learners interested in SOC, detection, incident response, or defensive engineering.
End state
You can explain what happened, where evidence lives, and which controls reduce repeat risk.
Real-world domains
Detection and incident response Logs, packets, endpoint artifacts, cloud audit trails, triage, timelines, and control validation. Cloud compute and platform Cloud accounts, IAM, storage, metadata services, serverless, containers, Kubernetes, and workload boundaries. Enterprise identity SSO, MFA, directory services, Kerberos concepts, role design, service accounts, and ownership checks. Milestone flow
- Build a signal baseline
Know normal traffic, host behavior, log locations, and evidence quality.
- Protect identity
Review account lifecycles, privilege boundaries, delegation, and authentication controls.
- Monitor cloud and workloads
Connect platform logs, workload boundaries, image hygiene, and runtime behavior.
- Investigate and improve
Turn evidence into timelines, lessons learned, and hardening work.
Categories in this path
Defensive engineer
Design safer systems, reduce bug classes, and build controls into delivery.
What it means
Defensive security engineering turns security knowledge into designs, guardrails, reviews, tests, and defaults that prevent repeat classes of issues.
Good fit
Developers, platform engineers, and security engineers who want prevention-first skills.
End state
You can review designs, catch risky assumptions early, and recommend durable controls.
Real-world domains
Web applications and APIs SaaS products, REST and GraphQL APIs, browser trust boundaries, sessions, tenants, and business logic. Cloud compute and platform Cloud accounts, IAM, storage, metadata services, serverless, containers, Kubernetes, and workload boundaries. Enterprise identity SSO, MFA, directory services, Kerberos concepts, role design, service accounts, and ownership checks. Detection and incident response Logs, packets, endpoint artifacts, cloud audit trails, triage, timelines, and control validation. Milestone flow
- Threat model systems
Document assets, actors, trust boundaries, abuse cases, and review checkpoints.
- Secure app contracts
Design identity, authorization, schemas, sessions, and browser controls deliberately.
- Harden platform defaults
Reduce insecure defaults across workloads, build systems, secrets, and runtime permissions.
- Feed lessons into controls
Turn reviews and incidents into tests, guardrails, and engineering guidance.
Categories in this path
Bug bounty hunter
Find valid issues on authorized programs and communicate impact to triage.
What it means
Bug bounty hunting is authorized vulnerability research against program scopes. It rewards impact, clear evidence, and respectful testing habits.
Good fit
Learners who want public-program practice and portfolio-ready reports.
End state
You can choose scope, test safely, avoid duplicates, and write reports triage can act on.
Real-world domains
Web applications and APIs SaaS products, REST and GraphQL APIs, browser trust boundaries, sessions, tenants, and business logic. Research, scoping, and reporting Authorized research workflow: scope, notes, repeatability, evidence, severity, remediation, and writeups. Cloud compute and platform Cloud accounts, IAM, storage, metadata services, serverless, containers, Kubernetes, and workload boundaries. Milestone flow
- Pick programs and scope
Read policy, identify in-scope assets, set rate limits, and keep clean notes.
- Test app and API logic
Focus on account, tenant, workflow, and object ownership failures.
- Chase impact classes
Prioritize issues that show clear user, data, or platform impact.
- Submit clean reports
Make triage easy with exact steps, expected impact, screenshots, and remediation ideas.
Categories in this path
Application security specialist
Review application behavior, APIs, browser boundaries, auth, and authorization design.
What it means
Application security focuses on how software enforces trust. It blends code review, design review, dynamic testing, and developer guidance.
Good fit
Learners who want to specialize in product, web, and API security.
End state
You can map app trust boundaries, test them, and explain fixes to engineering teams.
Real-world domains
Web applications and APIs SaaS products, REST and GraphQL APIs, browser trust boundaries, sessions, tenants, and business logic. Enterprise identity SSO, MFA, directory services, Kerberos concepts, role design, service accounts, and ownership checks. Research, scoping, and reporting Authorized research workflow: scope, notes, repeatability, evidence, severity, remediation, and writeups. Milestone flow
- Map product surfaces
Identify users, objects, request flows, permissions, and data boundaries.
- Review code and data boundaries
Connect source, runtime behavior, browser trust, and interpreter boundaries.
- Partner on fixes
Translate findings into developer-friendly fixes, tests, and rollout guidance.
- Scale review patterns
Build checklists and research habits that make reviews repeatable.
Categories in this path
CTF player
Practice isolated challenge solving across web, pwn, crypto, reversing, forensics, and OSINT.
What it means
Capture the flag practice uses intentionally vulnerable puzzles to build pattern recognition and problem-solving without touching real systems.
Good fit
Learners who want hands-on reps and a safe place to build instincts.
End state
You can classify challenges, build solve notes, and move from hints to independent solving.
Real-world domains
Research, scoping, and reporting Authorized research workflow: scope, notes, repeatability, evidence, severity, remediation, and writeups. Web applications and APIs SaaS products, REST and GraphQL APIs, browser trust boundaries, sessions, tenants, and business logic. Low-level systems research Compiled programs, assembly, file formats, memory corruption, mitigations, reversing, and lab exploit notes. Detection and incident response Logs, packets, endpoint artifacts, cloud audit trails, triage, timelines, and control validation. Milestone flow
- Build a solve system
Set up notes, files, hints, tooling, and writeup templates before chasing flags.
- Practice web, crypto, and forensics
Learn challenge patterns for requests, encodings, files, packets, and evidence.
- Practice pwn and reversing
Work through binaries, memory layout, mitigations, crashes, and disassembly.
- Write up and transfer
Turn solves into durable notes and connect lab patterns back to real-world categories.
Categories in this path
Binary exploitation and reversing specialist
Understand binaries, memory corruption, mitigations, reverse engineering, and lab exploit notes.
What it means
Binary exploitation and reverse engineering focus on compiled programs: how they behave, how they fail, and how to explain those failures safely.
Good fit
Learners who want deep pwn, reversing, malware-analysis, or vulnerability-research foundations.
End state
You can analyze toy binaries, reason about mitigations, and document root cause and fix paths.
Real-world domains
Low-level systems research Compiled programs, assembly, file formats, memory corruption, mitigations, reversing, and lab exploit notes. Research, scoping, and reporting Authorized research workflow: scope, notes, repeatability, evidence, severity, remediation, and writeups. Milestone flow
- Read binaries
Use static and dynamic analysis to understand control flow, imports, strings, and formats.
- Reason about memory
Study stack frames, heap layout, crashes, input length, and corrupted state in labs.
- Study mitigations
Understand stack canaries, NX, ASLR, PIE, RELRO, heap checks, and return-to-libc concepts.
- Document lab findings
Write reproducible notes that explain root cause, constraints, mitigations, and fixes.
Categories in this path
Cloud and container security specialist
Review cloud identity, storage, build systems, containers, Kubernetes, and runtime boundaries.
What it means
Cloud and container security focuses on modern platform boundaries: identity, network exposure, workloads, images, secrets, and logs.
Good fit
Learners working near DevOps, platform engineering, or cloud security reviews.
End state
You can inventory cloud assets, reason about trust relationships, and identify platform control gaps.
Real-world domains
Cloud compute and platform Cloud accounts, IAM, storage, metadata services, serverless, containers, Kubernetes, and workload boundaries. Enterprise identity SSO, MFA, directory services, Kerberos concepts, role design, service accounts, and ownership checks. Web applications and APIs SaaS products, REST and GraphQL APIs, browser trust boundaries, sessions, tenants, and business logic. Detection and incident response Logs, packets, endpoint artifacts, cloud audit trails, triage, timelines, and control validation. Milestone flow
- Inventory the platform
Map accounts, projects, workloads, images, storage, secrets, and where code runs.
- Trace identity and APIs
Follow IAM, service accounts, role assumptions, API exposure, and permission boundaries.
- Review workload boundaries
Check network paths, metadata access, runtime permissions, image trust, and cluster posture.
- Log and remediate
Tie control gaps to logs, blast radius, remediation, and prevention work.
Categories in this path
Forensics and incident response analyst
Collect evidence, build timelines, analyze artifacts, and explain what changed.
What it means
Forensics and incident response reconstruct events from evidence. The work depends on careful handling, repeatable analysis, and clear timelines.
Good fit
Learners interested in investigations, SOC escalation, or incident response.
End state
You can preserve artifacts, build timelines, and communicate defensible findings.
Real-world domains
Detection and incident response Logs, packets, endpoint artifacts, cloud audit trails, triage, timelines, and control validation. Cloud compute and platform Cloud accounts, IAM, storage, metadata services, serverless, containers, Kubernetes, and workload boundaries. Enterprise identity SSO, MFA, directory services, Kerberos concepts, role design, service accounts, and ownership checks. Research, scoping, and reporting Authorized research workflow: scope, notes, repeatability, evidence, severity, remediation, and writeups. Milestone flow
- Preserve evidence
Collect artifacts, logs, images, hashes, and notes without damaging the investigation trail.
- Rebuild the timeline
Correlate packets, host artifacts, authentication events, and directory activity.
- Correlate cloud and workloads
Connect cloud audit logs, workload events, identities, and container activity.
- Explain impact and controls
Write defensible findings, likely impact, control gaps, and prioritized next actions.
Categories in this path