The senior's road: the capstone, roles and a one-year plan
Lesson 5 of 5
5The senior's road: the capstone, roles and a one-year plan
The big pictureYou have reached the end of the path. In the first stage you learned how attackers think and how to protect your account. In the second you became an analyst investigating alerts. In the third you wrote detection rules and tested with permission. Now you design and lead. A senior is not the person who knows every tool, but the one asked "what do we do?" who gives a clear answer with reasons and numbers. This lesson turns what you learned into a visible project, and a plan for your next year.
What the picture shows: The capstone walks the whole loop once on a small imagined company, and each phase produces a file for your repo.
Map of this part
The concepts in order, click any one to jump to it:
Two ways into the same idea
Think of a medical student in their internship year: they learn less that is new than they pull everything together on real patients under supervision. The capstone is your internship: one company with its problems, and you design its protection, detect the attack on it, test it, then present what you did as a doctor presents a case.
The project: an imagined company, "Nakhla Store" (150 staff, a cloud shop, Kubernetes and Active Directory). The phases: a threat model and a Zero Trust plan, then hardening the cloud and containers with CSPM and Pod Security, then a detection lab with a SIEM and Sigma rules, then a purple day with Atomic Red Team, then a risk register in money and a board presentation. Certificates: OSCP+ (OffSec: a 24-hour practical exam; since November 2024 OSCP+ expires after 3 years while OSCP stays for life), GIAC (such as GCIH for incident handling and GCFA for forensics, renewed every 4 years), CISSP (ISC2: five years' experience in at least two of eight domains, or four with a degree or an accepted credential; without it you become an Associate of ISC2), CCSP for cloud security, and CISM for programme management. Check each certificate's official page before starting, as rules and prices change.
Before You Start
🗺️The junior roadmap
You know Security+ and the first tracks.
🧑✈️Leading a security programme
The previous lesson.
The Core Idea
1The capstone: Nakhla Store
This project takes about three months at 8 hours a week, all in your own lab or a trial cloud account you own. Press each phase to see its goal, what you do and its done-when condition. Every phase ends with a file published in your repo, with no secrets and no real data.
The capstone: a security programme for Nakhla Store
An imagined online shop with 150 staff, a cloud shop on Kubernetes, and Active Directory for the office.
1 · Design
- Goal
- Understanding the system and its threats before any tool.
- What you do
- Draw the data flow diagram with trust boundaries, apply STRIDE to every arrow crossing a boundary, and write a one-year Zero Trust plan using the CISA pillars.
- Done when
- You have a diagram, at least 15 threats each with a cure and priority, and a one-page plan.
2 · Harden the cloud
- Goal
- Safe settings and identities you can prove.
- What you do
- Build the shop with Terraform in a trial account, run an open-source CSPM scan (such as Prowler), fix the findings, and apply Restricted to the namespaces.
- Done when
- A before-and-after report with zero critical findings, no policy with
*, and every pod passing Restricted.
3 · Detection lab
- Goal
- Seeing the attack when it happens.
- What you do
- Collect cloud, Kubernetes and Windows logs in a free SIEM (such as Wazuh or Elastic), and write 10 Sigma rules for your chosen adversary's top techniques.
- Done when
- Every rule has a test proving it alerts, a dashboard shows the alerts, and a list of missing log sources.
4 · The purple day
- Goal
- Proving detection works against an emulated attack.
- What you do
- Run 10 techniques from an emulation plan with Atomic Red Team in your lab, record each outcome, fix the gaps, and rerun.
- Done when
- A coverage map in ATT&CK Navigator, and at least 7 of 10 techniques "alerted" or "blocked".
5 · Lead and present
- Goal
- Turning technical work into a management decision.
- What you do
- Write a risk register of the top five risks in money (ALE and a range), a ransomware response plan with roles, and a 10-slide deck for an imagined board.
- Done when
- You gave the talk in 15 minutes to a non-technical person who understood the top three risks and what you are asking of them.
2Where does a senior stand?
After the mid-level the roles branch out. Each has a different day and a fitting certificate. Pick what suits you: do you like building, hunting, attacking or leading?
| Role | The day | Key skill | Fitting certificate |
|---|---|---|---|
| Security architect | Designs protection and reviews teams' designs | Threat modelling and Zero Trust | CISSP, CCSP for cloud |
| Cloud security engineer | Secures accounts, containers and the pipeline | IAM, Kubernetes, infrastructure as code | CCSP, AWS or Azure security certificates |
| Detection engineering lead | Builds detection and measures its coverage | Sigma, ATT&CK and data | GIAC such as GCIA or GCDA |
| Senior incident responder | Leads investigations and major incidents | Forensics and calm under pressure | GCIH then GCFA |
| Senior pen tester / red team | Plans exercises and emulates adversaries | AD, web, stealth and reports | OSCP+ then OSEP or CRTO |
| Security programme lead | Runs risk, budget and the team | Risk in money and communication | CISM or CISSP |
3A one-year plan
This plan is for someone who finished the mid-level stage and works or trains, at about 8 to 10 hours a week. Do not move on before a phase's "done when" holds.
A 12-month plan to senior level
Regular weekly hours beat long scattered days. Half the time is hands-on.
1 · The stage 3 lessons
- Goal
- Understanding design, cloud, purple and leadership.
- What you do
- Walk this stage's lessons in order, run every example, and write a one-page summary of each.
- Done when
- You explain PE vs PEP to a colleague and compute ALE and ROSI without notes.
2 · The capstone
- Goal
- Published proof that you design, detect and lead.
- What you do
- Carry out the five Nakhla Store phases and publish each in your repo.
- Done when
- The repo is complete, and you presented to one technical and one non-technical person.
3 · The advanced certificate
- Goal
- A certificate proving depth in your role.
- What you do
- Pick by role: OSCP+ for testing, GCIH for response, CCSP for cloud, or start CISSP if your experience is complete. Daily lab work and practice tests.
- Done when
- You passed, or for practical exams: you solved 30 training machines without write-ups before booking.
4 · Give back
- Goal
- Being known for your work outside your company.
- What you do
- Contribute two Sigma rules or an Atomic test to an open repo, and give a talk at a local meetup or university.
- Done when
- An accepted contribution to an open repo, and a published or recorded talk.
5 · Teach and pick the next step
- Goal
- Locking in understanding by teaching, and deciding year two.
- What you do
- Coach a beginner through stage one of this path, then write your decision: go deeper in the same role, or move into leadership.
- Done when
- Someone else finished stage one with your help, and you have a written decision on the next step.
Change the start date and weekly hours to see your own plan.
from datetime import date, timedelta
start = date(2027, 1, 3) # change to your own start (a Sunday)
phases = [("Stage 3 lessons", 9), ("Capstone", 13), ("Advanced certificate", 17),
("Give back", 9), ("Teach and decide", 4)]
hours_per_week = 9
day, total = start, 0
for name, weeks in phases:
end = day + timedelta(weeks=weeks) - timedelta(days=1)
total += weeks * hours_per_week
print(f"{name:<21} {day:%d %b %Y} -> {end:%d %b %Y} (~{weeks * hours_per_week} h)")
day = end + timedelta(days=1)
print("total study:", total, "hours over", sum(w for _, w in phases), "weeks")Worked example
The task: a SOC analyst with two years' work has finished the mid-level stage, likes investigating more than attacking, and wants to be a senior incident responder within a year. What do you advise?
The answer: her role is incident response. The fitting certificate is GCIH first, then GCFA later. Her plan: two months on the stage 3 lessons focused on major incident leadership and the cloud (since most modern incidents touch it), then the capstone with a wider detection phase and an added ransomware tabletop, then GCIH. Alongside: she volunteers to be the scribe and then the technical lead in her team's real incidents, and writes a blameless review of each. After a year: a certificate, a project, and real written leadership experience. That is a strong promotion file.
Myth vs Reality
| Myth | Reality |
|---|---|
| A senior knows every tool. | A senior knows the principles deeply, picks the right tool and explains why. Tools change every two years. |
| CISSP is the first advanced certificate I should take. | CISSP needs five years' experience and suits design and leadership. For technical roles start with a hands-on certificate in your role. |
| After the last lesson, learning is over. | Security changes every month. A senior keeps reading reports, experimenting and teaching, and teaching is the strongest test of your understanding. |
Where you meet it at work
📈Promotion
A capstone, a certificate and written experience convince any panel.
🧑🏫Leading the team
A senior coaches juniors and reviews their work.
🌍Working anywhere
OSCP, GIAC and CISSP are known in every market.
Test your understanding
Which certificate fits an incident responder wanting technical depth?
GCIH from GIAC is for incident handling, and GCFA after it for forensics.
What changed with OSCP in November 2024?
A pass gives the lifelong OSCP plus OSCP+, which renews every 3 years.
How many years' experience does CISSP usually require?
Or four with a degree or accepted credential; without it you become an Associate of ISC2.
What is the done-when for the "purple day" phase of the capstone?
The condition is a measured result, not effort spent.
Which role suits someone who likes translating risk for management and running budgets?
The programme lead works in risk-in-money and communication; CISM or CISSP fit.
Quick review cards
Check Your Understanding
Why pick the role before the certificate?
Because the role decides which certificate helps you, and a certificate with no role stays a piece of paper.
What makes the capstone convincing to an employer?
That it is published and measured: each phase has a done-when and a visible result, from the threat model to the presentation.
How do you prove your understanding at the end of the plan?
By teaching someone else until they finish stage one; teaching is the strongest test of understanding.
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
Done with this lesson?
Sign in to save your progress.