proofstone / become / cybersecurity / defensive security
Defensive security
Keeping them out, and finding out when they got in: hardening, monitoring, response. Pick a profession: each one is a map you walk node by node, and every card says, up front, what you need before you start.
5 professions · 5 planned
Security engineer
plannedThe infrastructure defended: hardening, the network, identity, the SIEM.
stack: Linux · networking · IAM · SIEM
before you start: you already run services in production
Cloud security engineer
plannedThe same defence for the cloud: identity, policies, configuration, posture.
stack: AWS / GCP / Azure · IAM · policy as code
before you start: you already run workloads in the cloud
SOC analyst
plannedWatching and responding: logs, alerts, the first investigation.
stack: SIEM · EDR · logs
before you start: nothing — start from zero
DFIR investigator
plannedAfter the incident: disks, memory, the chain of evidence, the root cause.
stack: Autopsy · Volatility · OS internals
before you start: you already know how an operating system works inside
Malware analyst
plannedTaking malware apart: how it works, how to detect it.
stack: Ghidra · IDA · x86 · C
before you start: you already write C and read assembly