Security engineer
Learn to find, fix and prevent security flaws in software, using AI tools every week and learning to secure AI features too, in 24 weeks.
Coming soon · planned, not written yet
Cyber Security, DevSecOps and AI Red Teaming each have a role roadmaproadmap.sh
- 24
- weeks planned
- ~30 h
- a week
- 6
- milestone projects
- 1
- project, grown every week
These are planned figures. The weeks are written after we check the tools against current job postings and official documentation, so the final route may differ.
Built for the AI era
How AI fits this roadmap
Developers now use AI coding assistants, and an assistant can write insecure code that looks fine. That makes careful review, threat modelling and testing more important, so this roadmap has you use an AI assistant every week and check its output with scanners, tests and your own reading. You also learn the risks specific to AI features, such as prompt injection, and you test an AI-backed app in a lab.
The main project
HardenIt
A small web app with an AI chat feature that you threat-model, attack in your own lab, fix, scan automatically and write up the way a security team would.
What you will be able to do
- 01
Write a threat model for a web app with a data flow diagram and a list of threats ranked by risk, including threats to its AI feature.
- 02
Find and fix common web flaws such as injection, broken access control and cross-site scripting in your own lab app, and show each fix with a test.
- 03
Review code by hand and with a static scanner, and judge which findings, including AI-written code, are real and which are noise.
- 04
Add automated security checks to a CI pipeline for code, dependencies and container images, and block a build on a serious finding.
- 05
Respond to a simulated incident from detection to a written review, and test an AI feature for prompt injection in a lab you own.
01The route
Six months, one month at a time.
Each month ends in a milestone project, so you always have something to show for the work.
Month 1 · Weeks 1–4
Foundations and AI-assisted work
Linux, networking, HTTP, Git and the core security ideas. You set up an AI coding assistant, prompt it, and check what it writes with tests.
MilestoneThe HardenIt app running in your lab, with a log of AI suggestions you accepted and rejected
Month 2 · Weeks 5–8
Web application security
The OWASP Top 10 flaws, attacked and fixed in your own lab with Burp Suite Community Edition. You ask an AI to explain each flaw, then prove the explanation yourself.
MilestoneA report of flaws found in HardenIt, each with a fix and a test
Month 3 · Weeks 9–12
Threat modelling and secure code review
STRIDE threat models drawn in OWASP Threat Dragon, checks against OWASP ASVS, and code review by hand and with Semgrep. You review AI-written code for security flaws.
MilestoneA threat model and a code review report for HardenIt
Month 4 · Weeks 13–16
Security in the pipeline
Automated checks in CI for code, dependencies, secrets and container images with Trivy, plus a ZAP scan of the running app. You use AI to draft pipeline config, then check it.
MilestoneA pipeline that scans every change and fails the build on serious findings
Month 5 · Weeks 17–20
Securing AI features
Risks from the OWASP Top 10 for LLM Applications (2025 edition), such as prompt injection and leaking data, and the MITRE ATLAS knowledge base of attacks on AI systems. You test and harden the chat feature in HardenIt.
MilestoneAn AI feature tested in your lab, with attacks recorded and defences added
Month 6 · Weeks 21–24
Incident response, capstone and job search
Incident handling using NIST SP 800-61 Rev. 3 as the guide, a simulated incident with an AI-assisted timeline you verify, a portfolio write-up, interview preparation and applications.
MilestoneA portfolio, one incident review and a working job-search pipeline
03What is inside
Everything a week comes with.
Every week is built the same way, so once you have done one you know how all of them work.
- 01
One project, HardenIt
You grow one app with an AI feature, so every skill is tried on something real.
- 02
A day-by-day plan
Each week has a Learn part and a Do part, with a checklist so you know when you are done. Most weeks include a task to do with an AI assistant and a step to check its work.
- 03
A project in every milestone
Six milestones, each ending in something you can show and link to.
- 04
Reference topics
Short topic pages with check questions you can come back to.
- 05
A job track
Interview practice, portfolio and resume help, and an application plan.
- 06
Progress in your Study plan
Add weeks to your Study plan, give them dates, and finished days are counted for you.
04Is it for you
Who this is, and is not, for.
Better to know before you start than six weeks in.
It is for you if
- You can write small programs in some language and want to move into security.
- You are a developer, tester or system administrator who wants to be strong at secure code and at using AI tools safely.
- You can give about 30 hours a week for six months, part-time alongside other work.
It is not for you if
- You have never written code or used a terminal. Do a beginner course first.
- You want a job guarantee. Nobody can promise that, and this roadmap does not.
- You want to attack systems you do not own. Every exercise here is lab-only, legal and on targets you are authorised to test.
- You want to paste AI output into production without reading it. This roadmap trains you to check it.
?Questions
Before you start
- Is this roadmap ready?
- Not yet. This is the plan. The weeks are being written and checked against current job postings and official documentation. Leave your email and we will write to you when it opens.
- What will it cost?
- The price is not set. Roadmaps are bought once, with no subscription. We will announce it when this one opens.
- Will the plan change?
- It may. Before the weeks are written we check the tools against current job postings, so the lengths and months here are planned, not final.
- Is it legal to practise attacks?
- Only on systems you own or have written permission to test. Every exercise runs in a lab on your own machine or on free training sites made for the purpose, and the roadmap will say so in each week.
- Will it get me a job?
- It will give you skills and proof of work. It cannot promise a job on a fixed date, because hiring depends on the market, your location and your past work.
Not open yet
Leave your email and we will write once, when it opens.