Security Engineer Roadmap

The path from "I know the OWASP Top 10 exists" to "I got the job" - and you practice each step by fixing a real vulnerable system in a live cloud workspace. Every skill links to a live ticket you fix.

Your progress0 of 12 skills

Injection & Input

SQL injection

Close a SQLi in a search endpoint with parameterized queries.

Practice live: Close a SQL Injection in a Search Endpoint → Cross-site scripting

Neutralize a stored XSS in user comments.

Practice live: Neutralize a Stored XSS in Comments →

Authentication & Passwords

Password storage

Replace plaintext passwords with bcrypt hashing.

Practice live: Hash Passwords Instead of Storing Plaintext → JWT flaws

Patch a JWT 'none' algorithm bypass.

Practice live: Patch the JWT None-Algorithm Bypass →

Secrets Management

Secrets in source

Pull hardcoded credentials out of the source tree.

Practice live: Remove Hardcoded Credentials From Source Code → Secrets in git history

Scrub a leaked secret out of git history.

Practice live: Scrub a Secret From Git History →

Access & Transport

Path traversal

Block path traversal in a file-serving route.

Practice live: Block a Path Traversal Vulnerability → Force HTTPS

Terminate and force HTTPS at the nginx edge.

Practice live: Force HTTPS Redirects at the Nginx Edge →

Sessions & Abuse

Session hardening

Harden session cookies against theft.

Practice live: Harden Session Cookie Security Flags → Brute force

Shut down login brute-force with rate limiting.

Practice live: Stop Login Brute-Force With Rate Limiting →

Supply Chain & Pipeline

Vulnerable dependencies

Patch known-vulnerable npm dependencies.

Practice live: Patch Vulnerable npm Dependencies → Security scanning

Build and run a SAST/SCA/SBOM scan pipeline.

Practice live: Build a Security Scan Pipeline (SAST + SCA) →

Stop reading roadmaps. Start doing them.

Every skill above is a real broken system in a live workspace. Fix it, and it lands on your portfolio.

Start free →