The security architect and leader

Zero Trust architecture and threat modelling, cloud, container and supply chain security, purple teaming and adversary emulation, leading a security programme with risk in money and major incidents, then the capstone and a one-year plan.

OverviewZero Trust architecture and threat modelling, cloud, container and supply chain security, purple teaming and adversary emulation, leading a security programme with risk in money and major incidents, then the capstone and a one-year plan.
Zero Trust architecture and threat modellingIn the junior stage you met the idea of "never trust, always verify". Here you design it: the parts of NIST SP 800-207 (the policy engine and the enforcement point), the pillars of the CISA maturity model, how an access decision is built from identity, device and context signals, then threat modelling with STRIDE to find the flaw in the design before a line of code is written.
Securing the cloud, containers and the supply chainMost cloud breaches are not flaws in the cloud itself but wrong settings: a broad permission, a container running as root, or a booby-trapped package that arrived with an update. Here you learn shared responsibility in depth, least-privilege IAM, posture monitoring (CSPM), Kubernetes container security standards, and securing the supply chain with SBOMs, SLSA and signing, with the story of XZ Utils.
Purple teaming and adversary emulationA penetration test asks "are there flaws?". A senior asks a harder question: "if a specific group attacked us with its known methods, would we see it and stop it?". Here you learn the difference between a red team and a pen test, adversary emulation from real reports, purple team exercises where attacker and defender work in one room, and measuring coverage with MITRE ATT&CK.
Leading a security programme: risk in numbers and major incidentsA senior is asked in the boardroom: how much does this risk cost us? Is it worth the spend? Who decides when the big attack hits? Here you learn to turn risk into money (ALE and FAIR), compute the return on security spending, the programme metrics that actually matter, leading a major incident with clear roles, and the legal reporting duties.
The senior's road: the capstone, roles and a one-year planThe last lesson of the path pulls everything together: a capstone where you build a small security programme for an imagined company from design to detection to an exercise, then the senior roles and which certificates prove each (OSCP+, GIAC, CISSP, CCSP and others), and a one-year plan in phases, each with a "done when" condition.
Wrap-up and resourcesThe takeaways and glossary of this track.