Bootcamp

# Security bootcamp - 10 working days (defender path)

> Authorised work only. Build hands-on skill in lab environments before
> production work.

Day 1 - Foundations: CIA triad, threat modelling, authorised vs unauthorised testing.
Day 2 - Identity + access: MFA, RBAC, conditional access, OAuth/OIDC, IAM least privilege.
Day 3 - Network + endpoint: VLANs, firewalls, EDR, Sysmon + tuning.
Day 4 - Cloud security: SCPs, IAM, GuardDuty, secure baselines, Wiz/Lacework type tooling.
Day 5 - AppSec: OWASP Top 10 defences, secure SDLC, SAST + DAST + SCA.

Weekend project: threat-model a small app + write 3 Sigma rules.

Day 6 - Detection engineering: Sigma, KQL, Splunk searches, MITRE ATT&CK coverage matrix.
Day 7 - DFIR fundamentals: KAPE, Velociraptor, memory acquisition, timeline analysis.
Day 8 - Cryptography in practice: TLS, JWT pitfalls, signing, KMS, key rotation.
Day 9 - Compliance + governance: ISO 27001, SOC 2, PCI scope decisions.
Day 10 - Purple team + tabletop: run Atomic Red Team in a lab; close the loop.

Capstone: build a small DetectionLab + ship 5 tuned detections + a runbook each.

## Tools to install (lab)

- DetectionLab + Splunk free or Elastic
- Sysmon + SwiftOnSecurity config
- Sigma + sigmac
- Atomic Red Team + Caldera
- Velociraptor
- Cloud sandbox accounts (AWS Free Tier, Azure Free, GCP Free)

## Career note

- Bootcamps build a base; real growth is the first 1-2 years of triage + IR work
- Document everything; your past write-ups are your portfolio
- Get a mentor in a senior defender role

# 30-day ethical-hacking bootcamp in the lesson body.