CISO Academy — QA Automation to AppSec in 12 Months
A month-by-month training plan built around practice. Each topic produces a concrete artifact: a dissected CVE, a written exploit, a vulnerability found in a training application. Designed for QA Automation engineers with API testing experience transitioning to Application Security.
Phase 1: Foundation (Months 1–3)
Month 1: Network Literacy and Protocols
OSI model, TCP/IP, HTTP/1.1 & HTTP/2 at the byte level, TLS handshake and certificates, DNS attacks (rebinding, cache poisoning, exfiltration). Practice: Wireshark traffic analysis, curl, Burp Suite, MITM proxy in Python.
Month 2: Operating Systems and Linux Internals
Processes, UID/GID, SUID/SGID, file system internals, bash, systemd, iptables/nftables, tcpdump. Windows basics: AD, NTLM, Kerberos. Practice: privilege escalation via SUID on a vulnerable VM.
Month 3: Cryptography Without the Math
AES, RSA, ECC, hash functions, HMAC, key derivation (PBKDF2, Argon2, bcrypt), JWT deep dive. Common mistakes: ECB mode, nonce reuse, hardcoded secrets. Practice: cryptopals.com first set.
Phase 2: Web Vulnerabilities as Craft (Months 4–7)
Month 4: OWASP Top 10
SQL/NoSQL/command injection, XSS (reflected, stored, DOM-based), CSRF, SSRF, XXE, IDOR, insecure deserialization. Practice: PortSwigger Web Security Academy labs.
Month 5: Advanced Web Exploitation
Race conditions, HTTP request smuggling (CL.TE, TE.CL), prototype pollution, web cache poisoning, OAuth 2.0/OIDC attacks. Practice: PortSwigger Practitioner level.
Month 6: API Security
OWASP API Security Top 10, BOLA/IDOR, GraphQL security, gRPC, rate limiting. Practice: OWASP crAPI and VAmPI exploitation.
Month 7: Authentication & Authorization
SAML, OAuth, OIDC attacks, session management, MFA bypasses, WebAuthn, RBAC vs ABAC vs ReBAC. Practice: Keycloak local setup and exploitation.
Phase 3: Defensive AppSec (Months 8–11)
Month 8: Secure SDLC & Threat Modeling
STRIDE, PASTA, data flow diagrams, integrating security into development. Practice: full threat model for a SaaS architecture.
Month 9: SAST, DAST, SCA Toolkit
Semgrep, CodeQL, Snyk, Trivy, OWASP ZAP, gitleaks, trufflehog. Practice: full security pipeline in GitHub Actions.
Month 10: Secure Code Review
Reading code in Python, JS/TS, Go, Java for vulnerabilities. Studying real CVE fixes. Practice: dissect 10 public CVEs to the changed line.
Month 11: Cloud Security
AWS/GCP/Azure IAM, VPC, secrets management, Kubernetes security, CloudTrail, GuardDuty. Practice: flaws.cloud and flaws2.cloud CTFs.
Phase 4: Professional Development (Month 12+)
Month 12: Portfolio & Positioning
GitHub portfolio, PortSwigger Practitioner certification, HackerOne/Bugcrowd profile, LinkedIn repositioning. Target: 3+ CVE analyses, 1 security tool, 1+ bug bounty report.
Month 13: Certifications
BSCP ($90), TCM PNPT, OffSec OSCP. Target positions: Security Automation Engineer, AppSec Engineer, DevSecOps.
Essential Reading
- PortSwigger Daily Swig — daily security news
- tl;dr sec (Clint Gibler) — best weekly AppSec newsletter
- Project Zero blog — deep technical analyses from Google
- Orange Tsai — world-class web security research
- James Kettle — HTTP request smuggling research