Overview
Your complete guide to The security architect and leader
Zero Trust architecture and threat modelling, cloud, container and supply chain security, purple teaming and adversary emulation, leading a security programme with risk in money and major incidents, then the capstone and a one-year plan.
Non-technical and technical learners alike. Every part opens two ways in: a plain path built on an analogy for someone starting from zero, and a detailed path for someone who knows the basics and wants depth.
An animation, then what you need before you start, then the idea with code you run, then a worked example, then review cards and "test your understanding" questions.
Do not leave a part before you can answer its questions without guessing. Reading alone proves nothing.
Pick a topic
A look at The security architect and leader
You move from operating security to designing and leading it: design the architecture, secure the cloud, prove detection works, turn it all into management decisions, and pull it together in a capstone.
| Part | Topic | You learn |
|---|---|---|
| 1 | Zero Trust architecture and threat modelling | The parts of NIST SP 800-207 (PE, PA and PEP), the five CISA pillars and four maturity stages, access decisions from signals, continuous evaluation, threat modelling and its four questions, STRIDE, the order of rollout |
| 2 | Securing the cloud, containers and the supply chain | Shared responsibility by service type, IAM, least privilege and temporary roles, CSPM and CNAPP, the three Pod Security levels, RBAC and NetworkPolicy, SBOMs, SLSA and Sigstore, the XZ Utils lesson |
| 3 | Purple teaming and adversary emulation | Pen testing vs red teaming vs purple teaming, adversary emulation from threat intelligence, the emulation plan, Atomic Red Team, Caldera and the CTID library, the purple loop, measuring coverage, TIBER-EU and regulated exercises |
| 4 | Leading a security programme: risk in numbers and major incidents | Risk in money: SLE, ARO and ALE, the FAIR model, return on security investment (ROSI), programme metrics (MTTD, MTTR, patch coverage), major incident command roles, NIST SP 800-61r3 and CSF 2.0, legal reporting within 72 hours |
| 5 | The senior's road: the capstone, roles and a one-year plan | The capstone with its phases and done-when conditions, senior roles (architect, detection lead, senior tester, programme lead), advanced certificates and their requirements, visible expertise, a 12-month plan |
Done with this lesson?
Sign in to save your progress.