Mir Ali Shahidi | Senior Information Security & Network Specialist

Career Architecture

Cybersecurity Career Tracks

Four complementary tracks define the professional capability model. Each track combines practical skills, operational knowledge, governance awareness, measurable security outcomes, and standards-based engineering.

Operational Track

SOC Operations & DFIR

Focuses on security monitoring, alert investigation, incident response, forensic analysis, threat hunting, and operational escalation.

Development Checklist

IT and networking foundationsBuild the operating-system and network knowledge required to interpret security telemetry.
CCNA and enterprise networkingUnderstand switching, routing, segmentation, ACLs, and network troubleshooting.
Linux and Windows administrationOperate and investigate the platforms that generate most enterprise security evidence.
SOC Tier 1 operationsPerform alert validation, event classification, ticket handling, and initial escalation.
SIEM operationsSearch, correlate, normalize, and investigate centralized security telemetry.
SOC Tier 2 investigationCorrelate multiple evidence sources and reconstruct suspicious activity.
Incident responseCoordinate detection, containment, eradication, recovery, and post-incident activities.
DFIRPreserve evidence and reconstruct host, network, identity, and timeline activity.
Threat huntingUse hypotheses, behavioral patterns, and threat intelligence to discover hidden activity.
Detection engineeringConvert investigative knowledge into durable SIEM and EDR detections.
Purple team validationMeasure whether defensive controls detect relevant adversary behaviors.

Expected Capability

Operate across SOC Tier 1 to Tier 3 responsibilities, conduct structured investigations, support DFIR, develop detections, and improve operational security maturity.

Governance Track

Management & GRC

Connects technical security operations with governance, risk, compliance, audit, policy, and executive decision support.

Development Checklist

Security governanceDefine accountability, security objectives, policies, and decision-making structures.
Risk managementIdentify assets, threats, vulnerabilities, impacts, likelihood, and treatment options.
ISO 27001 ISMSUnderstand scope, risk treatment, Statement of Applicability, controls, and continual improvement.
Security policiesTranslate organizational requirements into measurable and auditable security rules.
Audit and evidenceCollect objective evidence and document findings, nonconformities, and corrective actions.
CISM governanceDevelop governance, risk, program, and incident-management leadership capabilities.
CISA assuranceApply structured approaches to control assessment, audit evidence, and assurance.
CRISC risk perspectiveConnect information risk with business objectives and control decisions.
Executive reportingPresent security exposure, control effectiveness, incidents, and remediation priorities clearly.

Expected Capability

Translate technical security realities into governance, risk, audit, compliance, and executive-level security decisions.

Defensive Track

Defensive Security & Blue Team

Focuses on reducing attack surface, strengthening preventive and detective controls, improving visibility, and turning threat intelligence and incident lessons into measurable defensive improvements.

Development Checklist

Defense-in-depth architectureLayer identity, endpoint, network, application, data, and cloud controls to reduce single points of failure.
Security hardeningEstablish secure baselines for Windows, Linux, network devices, firewalls, and cloud workloads.
Identity securityApply MFA, least privilege, PAM, privileged-session controls, and lifecycle governance.
Endpoint protectionDeploy and tune EDR/XDR, host firewalls, application controls, and endpoint security policies.
Centralized loggingCollect, synchronize, normalize, protect, and retain security telemetry for investigation.
Network defenseUse segmentation, NAC, IDS/IPS, DNS security, secure remote access, and firewall governance.
Vulnerability managementPrioritize vulnerabilities using asset criticality, CVE/CVSS/CWE context, and remediation SLAs.
Detection engineeringCreate, test, tune, document, and measure SIEM and EDR detection logic.
Threat intelligenceEnrich defensive decisions with IOC, TTP, STIX/TAXII, and ATT&CK context.
Threat huntingInvestigate hypotheses and behavioral signals that may bypass automated detections.
Incident containmentMaintain practical playbooks for isolation, credential response, evidence preservation, and recovery.
Control validationUse authorized purple-team testing to measure control effectiveness and detection coverage.
Security metricsTrack MTTD, MTTR, false-positive rate, detection coverage, patch compliance, and control health.
Continuous improvementFeed lessons from incidents, audits, vulnerabilities, and testing back into the security program.

Expected Capability

Design and operate a layered defensive program capable of maintaining visibility, preventing common attack paths, detecting suspicious behavior, supporting containment, and demonstrating control effectiveness.

Offensive Track

Offensive Security & Red Team

Develops authorized security-testing capabilities for discovering weaknesses and validating defensive controls within explicitly permitted environments.

Development Checklist

ReconnaissanceUnderstand authorized asset discovery and attack-surface mapping at a conceptual level.
Scanning and enumerationIdentify exposed services and security-relevant configuration weaknesses in approved environments.
Vulnerability assessmentEvaluate weaknesses using severity, exploitability, exposure, and business context.
Web securityStudy common application security weaknesses and structured testing methodologies.
Wireless securityAssess wireless configuration, authentication, encryption, and segmentation controls.
Social engineering awarenessUnderstand human-risk testing within documented authorization and safety boundaries.
Linux and Windows security testingUnderstand common privilege, configuration, identity, and service weaknesses.
Active Directory assessmentAnalyze identity relationships, privilege paths, delegation, and security configuration.
Advanced assessment conceptsStudy privilege escalation, segmentation testing, pivoting concepts, and post-compromise risk.
Reporting and remediationConvert findings into reproducible evidence, risk statements, and actionable remediation guidance.

Expected Capability

Perform structured, authorized security assessments and communicate findings in a way that enables defensive remediation and control improvement.

ISOC Architecture

ISOC Cybersecurity Roadmap

A comprehensive 18-phase knowledge and expertise architecture progressing from computing and networking foundations through SOC operations, SIEM, DFIR, threat hunting, detection engineering, purple teaming, and security governance.

This roadmap is a capability framework rather than a claim that every listed technology or certification has been formally completed. The protocol and standards lists describe technical coverage areas relevant to the corresponding security discipline.

PHASE 00

IT & Computer Fundamentals

Hardware, operating systems, system architecture, virtualization, and cloud foundations.

Phase Description

Establish the computing foundation required to understand how enterprise systems operate, communicate, store information, execute processes, and expose security telemetry.

Hardware & Operating Systems

Hardware fundamentalsUnderstand major computer components and their security-relevant roles.
CPU, RAM and storageUnderstand processing, memory behavior, storage architecture, and evidence locations.
Windows and LinuxBuild working knowledge of the two dominant enterprise endpoint families.
Files and filesystemsUnderstand paths, permissions, metadata, journaling, and storage organization.
Processes and servicesRecognize process execution, service dependencies, and persistence concepts.

System Architecture & Cloud

Users and groupsUnderstand identity objects, permissions, ownership, and access control.
Command-line interfacesUse CLI concepts for administration, automation, and investigation.
VirtualizationUnderstand hypervisors, virtual machines, snapshots, and isolation boundaries.
Client and server architectureUnderstand service dependencies and common enterprise communication models.
Cloud conceptsUnderstand IaaS, PaaS, SaaS, shared responsibility, and cloud security foundations.

Protocols & Standards Coverage

System interfacesCLI, APIs, service interfaces, filesystem permissions.
VirtualizationHypervisors, VM networking, snapshots, isolation concepts.
Cloud securityShared responsibility and identity-centric access models.
Security foundationsCIA, least privilege, defense in depth.

Expected Capability

Explain core computing behavior and use operating-system fundamentals as a reliable base for networking, security monitoring, and DFIR.

PHASE 01

CompTIA Network+

Network fundamentals, protocols, switching, routing, addressing, and troubleshooting.

Phase Description

Develop a protocol-level understanding of enterprise networks and the troubleshooting skills required to interpret traffic and connectivity events.

Network Fundamentals

OSI and TCP/IP modelsMap network functions to layers for structured troubleshooting and analysis.
Ethernet and encapsulationUnderstand frames, headers, payloads, and transmission behavior.
MAC and IP addressingUnderstand hardware addressing and IPv4/IPv6 network identities.
Subnetting and CIDRCalculate network boundaries and understand address allocation.
NAT and address scopeDistinguish private, public, translated, and routable addressing.
Traffic typesUnderstand unicast, multicast, and broadcast communication.

Protocols, Switching & Routing

TCP, UDP and ICMPUnderstand transport behavior and diagnostic traffic.
DNS and DHCPUnderstand name resolution and dynamic address configuration.
HTTP and HTTPSUnderstand web communication and encrypted transport.
SSH, FTP and SFTPUnderstand remote administration and file-transfer protocols.
SMTP, IMAP and POP3Understand common email transport and retrieval flows.
SNMP and NTPUnderstand network management and time synchronization.
VLANs and trunksUnderstand logical segmentation and tagged Ethernet traffic.
Routing tablesUnderstand route selection, gateways, and packet forwarding.

Protocols & Standards Coverage

EthernetIEEE 802.3 fundamentals and frame behavior.
VLANIEEE 802.1Q tagging and logical segmentation.
STPLoop prevention and Layer 2 topology concepts.
IPv4 and IPv6Addressing, routing, and network-layer communication.
TCP and UDPReliable and connectionless transport models.
DNS and DHCPName resolution and address configuration services.

Expected Capability

Read network diagrams, explain common protocols, troubleshoot connectivity, and interpret network telemetry during security investigations.

PHASE 02

Cisco CCNA

Enterprise switching, routing, VLANs, ACLs, wireless, security, and network automation.

Phase Description

Build practical enterprise networking capability with emphasis on switching, routing, segmentation, access control, troubleshooting, and security-aware network design.

Switching & Routing

Ethernet switchingUnderstand MAC learning, forwarding, and Layer 2 troubleshooting.
VLAN and trunkingDesign logical segmentation and tagged inter-switch connectivity.
STP and inter-VLAN routingPrevent loops and provide controlled communication between segments.
IPv4 and IPv6Configure and troubleshoot modern network addressing.
OSPFUnderstand dynamic routing and route convergence concepts.

Security & Practical Labs

ACLsControl traffic using source, destination, protocol, and service criteria.
WLAN securityUnderstand wireless authentication, segmentation, and secure configuration.
Network automationUnderstand APIs, structured data, and automation concepts.
Packet Tracer labsBuild controlled topologies to practice switching and routing behavior.
Troubleshooting labsDiagnose addressing, VLAN, routing, ACL, and connectivity faults.

Protocols & Standards Coverage

802.1QVLAN tagging and trunking.
802.1D and 802.1wSTP and RSTP loop-prevention concepts.
OSPFInterior gateway routing protocol fundamentals.
NAT and DHCPAddress translation and automated configuration.
ACLsTraffic filtering and access-control concepts.

Expected Capability

Design and troubleshoot small-to-enterprise network topologies while understanding how network controls support security monitoring and segmentation.

PHASE 03

Linux + Windows Server / Active Directory

Enterprise operating systems, identity, administration, services, logging, and hardening.

Phase Description

Develop platform-level expertise for administration, hardening, authentication analysis, logging, and forensic investigation across Linux and Windows enterprise environments.

Linux Security & Administration

Linux architecture and CLIUnderstand kernel, userspace, processes, and command-line administration.
Files and permissionsAnalyze ownership, modes, ACLs, and sensitive filesystem locations.
Processes and systemdUnderstand service execution, startup behavior, and process relationships.
Packages and updatesMaintain software inventories and security patch levels.
Bash and SSHUse secure remote administration and repeatable command-line workflows.
Logs and auditUse system logs, audit frameworks, and monitoring data for investigations.

Windows & Active Directory

Domains and domain controllersUnderstand centralized identity and directory architecture.
OUs and GPOsManage organizational structure and centralized security configuration.
DNS and DHCPUnderstand critical Windows infrastructure dependencies.
PowerShell and Event LogsUse administrative and investigative telemetry efficiently.
Kerberos and NTLMUnderstand enterprise authentication protocols and their security implications.
Identity authorizationAnalyze groups, privileges, delegation, and access control.

Protocols & Standards Coverage

LDAP/LDAPSDirectory access and secure directory communication.
KerberosEnterprise ticket-based authentication.
NTLMLegacy Windows authentication concepts.
SSHSecure Linux administration.
Syslog and Windows EventingCentralized and host-based security telemetry concepts.

Expected Capability

Administer and investigate enterprise Linux and Windows systems while understanding identity, service, logging, and configuration security.

PHASE 04

CompTIA Security+

Security principles, controls, identity, cryptography, network protection, and incident response.

Phase Description

Build broad security knowledge covering confidentiality, integrity, availability, identity, cryptography, security controls, architecture, and operational response.

Security Architecture

CIA and AAAApply confidentiality, integrity, availability, authentication, and authorization concepts.
Security controlsDistinguish preventive, detective, corrective, deterrent, and compensating controls.
Defense in depthLayer independent controls to reduce security failure impact.
Zero TrustEvaluate access continuously instead of assuming network trust.
Network securityUnderstand firewalls, IDS/IPS, VPNs, segmentation, and secure protocols.

IAM, Crypto & Operations

MFA and SSOUnderstand stronger authentication and federated access patterns.
RBAC and PAMLimit privileges and control sensitive administrative access.
CryptographyUnderstand encryption, hashing, signatures, keys, and trust models.
PKI and certificatesUnderstand certificate issuance, validation, trust chains, and revocation.
Vulnerability managementIdentify, prioritize, remediate, and verify security weaknesses.
Incident responseUnderstand the operational lifecycle of security incidents.

Protocols & Standards Coverage

PKI and X.509Certificate-based trust and identity.
TLSEncrypted application-layer transport.
IPsec and VPNProtected network communication concepts.
RADIUS and TACACS+Centralized network authentication and authorization.
Zero TrustNIST SP 800-207 architecture principles.

Expected Capability

Assess common security risks, select appropriate controls, understand identity and cryptography, and communicate security fundamentals across technical and governance teams.

PHASE 05

Network Security & Enterprise Firewalls

Segmentation, firewall architecture, IDS/IPS, VPN, application control, and secure network design.

Phase Description

Develop enterprise network defense capabilities using layered controls, policy governance, segmentation, traffic inspection, secure remote access, and high-availability security platforms.

Network Defense

Network segmentationSeparate systems according to trust, function, sensitivity, and risk.
ACL and policy designControl traffic using explicit least-privilege rules.
IDS and IPSDetect and prevent suspicious network activity.
WAF and DDoS controlsProtect web services and availability against application and volumetric threats.
VPN and remote accessSecure remote connectivity using strong identity and encryption.
High availabilityMaintain resilient security enforcement during infrastructure failures.

FortiGate & Palo Alto

FortiGate administrationUnderstand routing, NAT, policy, IPS, web filtering, and application control.
Palo Alto administrationUnderstand security policies, zones, routing, and identity-aware controls.
User-ID conceptsConnect network activity with authenticated identities.
Threat preventionUse layered inspection to identify malicious or policy-violating traffic.
URL filteringControl web access based on categorized security and organizational policy.

Protocols & Standards Coverage

IPsec/IKESecure tunnel establishment and protected network traffic.
WireGuardModern VPN architecture and encrypted tunneling concepts.
802.1QVLAN segmentation and trunking.
TLS inspectionControlled encrypted-traffic inspection with appropriate trust architecture.
NATAddress translation and policy enforcement.

Expected Capability

Design, operate, troubleshoot, and assess enterprise firewall and network-defense architectures with clear policy governance.

PHASE 06

Wireshark & Packet Analysis

PCAP analysis, protocol interpretation, traffic investigation, and anomaly identification.

Phase Description

Develop packet-level investigation skills for validating alerts, reconstructing communication, identifying anomalies, and supporting incident response.

Protocol Analysis

Ethernet and ARPUnderstand Layer 2 communication and address resolution.
IPv4 and IPv6Interpret network-layer addressing and routing information.
TCP and UDPAnalyze transport behavior, sessions, retransmissions, and anomalies.
ICMPInterpret diagnostics and network reachability behavior.
DNS and DHCPInvestigate name-resolution and address-assignment activity.
HTTP and TLSUnderstand application communication and encrypted-session metadata.

Investigation Workflow

PCAP acquisitionPreserve and scope packet captures as investigative evidence.
Display filtersReduce large captures to relevant protocol and host activity.
Conversations and endpointsIdentify communicating hosts and traffic relationships.
Stream reconstructionReview sessions to understand application-level communication.
TCP anomaliesRecognize resets, retransmissions, unusual handshakes, and timing patterns.
Malicious traffic analysisCorrelate network indicators with known threat behavior.

Protocols & Standards Coverage

Ethernet/802.3Frame-level analysis.
ARPAddress-resolution behavior.
IPv4/IPv6Network-layer traffic analysis.
TCP/UDP/ICMPTransport and diagnostic protocols.
DNS/DHCP/HTTP/TLSCommon enterprise application traffic.

Expected Capability

Use packet captures to validate alerts, reconstruct communication, identify anomalies, and provide network evidence for SOC and DFIR investigations.

PHASE 07

SOC Analyst Tier 1

Monitoring, alert triage, classification, ticketing, IOC analysis, and escalation.

Phase Description

Establish disciplined SOC operations by turning raw alerts into structured cases with consistent severity, evidence, documentation, and escalation decisions.

SOC Operations

SOC architectureUnderstand people, process, technology, and escalation relationships.
MonitoringReview endpoint, network, identity, cloud, and application telemetry.
Alert ingestionUnderstand how security products generate and forward events.
Ticketing and SLADocument investigations consistently and meet response objectives.
Severity and priorityClassify cases according to technical and business impact.

Triage

False-positive analysisDetermine whether an alert represents expected or suspicious activity.
IOC evaluationAssess IPs, domains, hashes, URLs, and related indicators.
Phishing analysisReview email headers, sender context, links, and attachment indicators.
Identity eventsInvestigate authentication, privilege, and account anomalies.
ATT&CK mappingConnect suspicious behaviors to documented adversary techniques.

Protocols & Standards Coverage

MITRE ATT&CKTechnique-based investigation and categorization.
SyslogCommon centralized event transport.
Windows Event LogsHost and identity security telemetry.
DNS/HTTP/TLSHigh-value network investigation sources.

Expected Capability

Perform repeatable alert triage, distinguish benign from suspicious activity, document evidence, and escalate incidents with sufficient context.

PHASE 08

SIEM Systems: Splunk / ELK

Log ingestion, normalization, search, correlation, dashboards, and detection workflows.

Phase Description

Develop SIEM engineering and analyst capabilities across Splunk and Elastic architectures, from ingestion and normalization to detection, visualization, and investigation.

Splunk

Data ingestionUnderstand collection, forwarding, parsing, and indexing workflows.
Indexes and data modelsOrganize security telemetry for efficient investigation.
SPLSearch and correlate security events using structured queries.
Correlation searchesCombine event conditions to identify suspicious behavior.
Dashboards and alertsVisualize operational metrics and automate detection workflows.

Elastic

ElasticsearchUnderstand indexed security-event storage and search.
LogstashProcess and transform telemetry before indexing.
KibanaInvestigate data and create operational visualizations.
Beats and Elastic AgentCollect endpoint and infrastructure telemetry.
KQLSearch security data efficiently using Elastic query language.
Detection rulesConvert behavioral requirements into repeatable detections.

Protocols & Standards Coverage

SyslogNetwork and infrastructure log transport.
JSON/CEF/LEEFCommon structured security-event formats.
NIST SP 800-92Computer security log-management guidance.
SigmaPortable detection-rule concepts.
MITRE ATT&CKBehavioral detection mapping.

Expected Capability

Operate SIEM search and investigation workflows, develop correlation logic, build dashboards, and create maintainable security detections.

PHASE 09

SOC Analyst Tier 2

Advanced investigation, threat intelligence, attack reconstruction, and detection-gap analysis.

Phase Description

Move beyond initial triage into multi-source investigations that reconstruct activity, identify root causes, and improve security detections.

Advanced Investigation

Alert escalationValidate complex incidents and determine appropriate response priority.
Threat intelligence integrationEnrich investigations with indicators, context, and adversary behavior.
Attack lifecycle analysisReconstruct activity across multiple stages of an intrusion.
MITRE ATT&CK TTPsMap observed behaviors to adversary techniques and tactics.
Endpoint and network pivotsMove between evidence sources to build a consistent investigative timeline.

Root Cause & Detection

Root-cause analysisIdentify contributing conditions instead of treating only the visible alert.
Detection gap analysisIdentify attacker behaviors that current controls fail to detect.
Rule engineeringTranslate investigation findings into improved detection logic.
False-positive reductionImprove signal quality without unnecessarily reducing detection coverage.
Case documentationCreate evidence-based investigation records for repeatability and review.

Protocols & Standards Coverage

MITRE ATT&CKTactic and technique-based investigation.
STIXStructured threat-intelligence representation.
SIEM query languagesSPL, KQL, and related search concepts.
EDR telemetryEndpoint process, network, identity, and file activity.

Expected Capability

Lead complex SOC investigations, correlate heterogeneous evidence, identify root causes, and improve detection quality based on investigative findings.

PHASE 10

Incident Response

Preparation, detection, analysis, containment, eradication, recovery, and lessons learned.

Phase Description

Build a structured incident-response capability that preserves evidence, limits impact, coordinates stakeholders, and converts incidents into security improvements.

IR Lifecycle

PreparationMaintain roles, playbooks, tooling, contacts, and response readiness.
Detection and analysisValidate incidents and determine scope, impact, and affected assets.
ContainmentLimit attacker access and reduce operational impact using controlled actions.
EradicationRemove confirmed malicious conditions and address root causes.
RecoveryRestore systems safely and verify security before normal operation.

Evidence & Communication

Evidence collectionCollect relevant artifacts while preserving integrity and context.
IOC trackingMaintain indicators and relationships throughout the investigation.
Incident reportingDocument timeline, evidence, impact, actions, and recommendations.
Stakeholder communicationProvide accurate technical and executive updates appropriate to the audience.
Lessons learnedConvert incident findings into concrete control and process improvements.

Protocols & Standards Coverage

NIST SP 800-61Computer security incident handling guidance.
SANS IR lifecycleOperational incident-response methodology.
STIX/TAXIIStructured indicator exchange and intelligence sharing.
Chain of custodyEvidence handling and integrity documentation.

Expected Capability

Coordinate and document security incidents from preparation through recovery while preserving evidence and improving future resilience.

PHASE 11

Digital Forensics & Incident Response

Disk, memory, host, browser, network, timeline, and forensic evidence analysis.

Phase Description

Develop evidence-centered forensic capabilities for reconstructing activity across endpoints, storage, memory, browsers, operating systems, and network sources.

Evidence & Host Forensics

Evidence preservationProtect evidence integrity and document acquisition context.
Chain of custodyMaintain traceable evidence handling and transfer records.
NTFS and EXT4Understand filesystem artifacts and metadata relevant to investigations.
Windows artifactsAnalyze event logs, registry, execution, persistence, and user activity artifacts.
Linux artifactsReview logs, shell history, services, configuration, and user activity.

Memory, Timeline & Correlation

Memory forensicsUse memory analysis concepts to examine volatile system state.
VolatilityUnderstand structured memory-analysis workflows.
Browser artifactsReview browser history, downloads, sessions, and related evidence.
Timeline reconstructionCorrelate timestamps from multiple artifacts into a coherent sequence.
Network correlationConnect host evidence with network and identity telemetry.
Malware triageApply high-level static and dynamic analysis concepts for defensive investigation.

Protocols & Standards Coverage

Forensic acquisitionEvidence preservation and integrity principles.
NTFS/EXT4Filesystem artifact analysis.
Windows EventingHost and identity evidence.
PCAPNetwork evidence correlation.
Forensic reportingEvidence-based and reproducible documentation.

Expected Capability

Preserve and analyze digital evidence, reconstruct timelines, correlate host and network activity, and produce defensible forensic reports.

PHASE 12

Threat Hunting & Intelligence

Hypothesis-driven hunting, behavioral analysis, EDR, STIX/TAXII, and ATT&CK.

Phase Description

Develop proactive capabilities for discovering suspicious behavior that may not trigger existing automated detections.

Threat Hunting

Hunting hypothesesDefine testable security questions based on threats and telemetry.
IOC versus TTP analysisBalance fragile indicators with durable behavioral patterns.
Endpoint huntingSearch process, file, identity, and network telemetry for suspicious patterns.
Network huntingInvestigate DNS, HTTP, TLS, flow, and connection behavior.
Authentication huntingIdentify unusual login, privilege, geographic, and access patterns.

Threat Intelligence

MITRE ATT&CKUse adversary tactics and techniques to structure intelligence and hunts.
TaHiTI conceptsApply structured threat-hunting methodology.
EDR queriesUse endpoint telemetry to test hunting hypotheses.
STIX 2.1Represent threat intelligence using structured objects and relationships.
TAXII 2.1Understand automated exchange of structured threat intelligence.
Detection gapsTurn hunting results into new detection requirements.

Protocols & Standards Coverage

STIX 2.1Structured threat-intelligence representation.
TAXII 2.1Threat-intelligence exchange.
MITRE ATT&CKAdversary behavior taxonomy.
EDR/XDREndpoint and cross-domain telemetry.
YARAPattern-based file and malware identification concepts.

Expected Capability

Conduct repeatable threat hunts, enrich investigations with structured intelligence, identify detection gaps, and improve defensive visibility.

PHASE 13

Detection Engineering

SIEM and EDR detections, Sigma, behavioral analytics, testing, tuning, and coverage measurement.

Phase Description

Transform threat intelligence, incident findings, and hunting hypotheses into reliable, testable, maintainable security detections.

Detection Development

Detection requirementsDefine the behavior, telemetry, scope, and expected response for each detection.
SIEM logicImplement correlation logic using available security telemetry.
EDR detectionsUse endpoint behavior and process relationships to identify suspicious activity.
Sigma rulesCreate portable detection logic for compatible security platforms.
IOC and TTP detectionsCombine indicator and behavior-based approaches.

Quality & Validation

Detection testingValidate that expected telemetry triggers the intended analytic.
False-positive tuningReduce noise while preserving meaningful security coverage.
Coverage analysisMeasure which ATT&CK behaviors are visible and actionable.
Rule documentationRecord purpose, data sources, logic, limitations, and response guidance.
Lifecycle managementReview and retire detections as environments and threats change.

Protocols & Standards Coverage

SigmaPortable detection-rule format.
YARAPattern-based identification and malware analysis support.
MITRE ATT&CKDetection coverage mapping.
NIST CSFDetection and response capability alignment.
EDR/XDRBehavioral endpoint and cross-domain detection.

Expected Capability

Design measurable detections, validate their behavior, reduce unnecessary noise, and maintain a documented detection lifecycle.

PHASE 14

Purple Team

Authorized adversary emulation, control validation, detection testing, and continuous improvement.

Phase Description

Connect offensive security testing with defensive engineering by validating whether expected adversary behaviors are prevented, detected, investigated, and contained.

Validation

Adversary emulationModel documented adversary behaviors within explicitly authorized environments.
Atomic Red Team conceptsUse controlled behavior simulations to test defensive visibility.
TTP validationCheck whether telemetry and detections cover relevant behaviors.
Control validationMeasure preventive and detective control effectiveness.
Detection engineering feedbackConvert testing results into new or improved analytics.

Metrics & Improvement

Detection coverageMeasure observed security behaviors against expected coverage.
Response validationAssess whether alerts lead to appropriate investigation and containment.
False-positive measurementTrack the operational cost of noisy detection logic.
Control gapsDocument missing preventive, detective, or response capabilities.
Continuous improvementRepeat testing after remediation to verify improvement.

Protocols & Standards Coverage

MITRE ATT&CKBehavioral adversary framework.
MITRE D3FENDDefensive countermeasure knowledge base.
Atomic Red TeamControlled security validation concepts.
PTESPenetration-testing methodology concepts.
NIST CSFSecurity capability and improvement alignment.

Expected Capability

Coordinate authorized security validation with defensive teams and convert test results into measurable detection and control improvements.

PHASE 15

ISO 27001 ISMS / GRC

Information security management, risk, controls, Statement of Applicability, and audit.

Phase Description

Develop governance capabilities for establishing, operating, auditing, and continually improving an information security management system.

ISMS & Risk

ISMS scopeDefine organizational, technological, and process boundaries for security governance.
Asset managementIdentify information assets, owners, dependencies, and business value.
Risk assessmentEvaluate threats, vulnerabilities, impacts, likelihood, and risk treatment.
Risk treatmentSelect controls and document treatment decisions.
Statement of ApplicabilityDocument control applicability and organizational justification.
Security policiesTranslate governance requirements into documented organizational controls.

Audit & Improvement

Audit planningDefine audit objectives, criteria, evidence, and sampling approaches.
Evidence collectionGather objective evidence demonstrating control operation.
FindingsDocument observations, nonconformities, and risk implications.
Corrective actionsTrack root causes, remediation ownership, deadlines, and verification.
Continual improvementUse audit, incident, risk, and performance data to improve the ISMS.

Protocols & Standards Coverage

ISO/IEC 27001Information security management system requirements.
ISO/IEC 27002Information security control guidance.
NIST CSFCybersecurity risk-management framework concepts.
CIS ControlsPrioritized defensive control practices.
Risk managementAsset, threat, vulnerability, impact, and treatment concepts.

Expected Capability

Build and assess governance structures, risk processes, security controls, audit evidence, and continual-improvement activities within an ISMS.

PHASE 16

CISM Management

Security governance, risk management, security programs, and incident leadership.

Phase Description

Connect security leadership with business objectives through governance, risk decisions, program management, and incident-management oversight.

CISM Domains

Information security governanceAlign security strategy, accountability, and business requirements.
Information security risk managementTranslate security uncertainty into structured business risk decisions.
Information security programPlan, implement, monitor, and improve security initiatives.
Incident managementEstablish leadership, preparation, response, and recovery governance.

Leadership & Measurement

Security strategyDefine priorities based on organizational risk and objectives.
Resource managementAlign people, technology, budget, and expertise with security priorities.
MetricsMeasure security performance using meaningful operational and risk indicators.
Executive communicationExplain security conditions and decisions in business-relevant language.

Protocols & Standards Coverage

CISMGovernance, risk, program, and incident-management domains.
ISO/IEC 27001ISMS governance and continual improvement.
NIST CSFCybersecurity risk and capability framework.
CIS ControlsOperational control prioritization.

Expected Capability

Lead information security programs using governance, risk, performance measurement, and incident-management principles.

PHASE 17

CISSP Management & Architecture

Security and risk, assets, architecture, IAM, assessment, operations, and software security.

Phase Description

Integrate broad security leadership and architecture knowledge across the major domains of enterprise information security.

Core Domains

Security and Risk ManagementGovern security principles, risk, compliance, policy, and professional ethics.
Asset SecurityProtect information throughout its lifecycle and classification levels.
Security ArchitectureDesign resilient security architecture and engineering principles.
Network SecurityProtect communications through segmentation, secure protocols, and architecture.
Identity and Access ManagementControl identities, authentication, authorization, and access lifecycle.

Assessment & Operations

Security Assessment and TestingValidate security controls through structured testing and evidence.
Security OperationsManage monitoring, incident response, recovery, and operational resilience.
Software SecurityIntegrate security into software development and application lifecycle processes.
Architecture governanceAlign technical security architecture with enterprise requirements and risk.

Protocols & Standards Coverage

CISSP Eight DomainsBroad enterprise security knowledge architecture.
ISO/IEC 27001Security governance and management systems.
NIST CSFRisk-based cybersecurity capability structure.
OWASPApplication security and secure development concepts.
CIS ControlsPrioritized security control practices.

Expected Capability

Integrate security architecture, governance, risk, identity, assessment, operations, and software-security principles into enterprise-level security decisions.

Specialized Security Testing

Authorized Offensive Security Track

A specialized capability layer covering CEH-oriented concepts, penetration testing, and OSCP-level methodology while keeping testing strictly within explicitly authorized environments.

Offensive Security

CEH, Penetration Testing & OSCP-Level Concepts

The objective is to understand how authorized security assessments discover weaknesses and how those findings can be translated into stronger defensive controls.

Assessment Checklist

ReconnaissanceMap approved assets, services, technologies, and externally visible attack surfaces.
ScanningIdentify reachable services and security-relevant configuration information.
EnumerationCollect authorized service and identity information for assessment.
Vulnerability assessmentPrioritize weaknesses according to technical and business risk.
Web application testingAssess common application-security weaknesses using structured methodologies.
Wireless assessmentEvaluate authentication, encryption, configuration, and segmentation.
Security awareness testingEvaluate human-layer controls only with explicit authorization and defined safeguards.

Advanced Methodology

Linux privilege conceptsUnderstand common permission and configuration weaknesses at a conceptual level.
Windows privilege conceptsUnderstand identity, service, configuration, and permission weaknesses.
Active Directory assessmentEvaluate identity relationships and privilege paths in approved environments.
Segmentation testingDetermine whether network boundaries enforce intended trust relationships.
Pivoting conceptsUnderstand how segmented environments are evaluated without providing operational abuse instructions.
Post-assessment analysisDocument impact, affected assets, evidence, and defensive recommendations.
Professional reportingDeliver clear findings with severity, evidence, business impact, and remediation guidance.

Protocols & Standards Coverage

CEHBroad ethical hacking and security-assessment knowledge domains.
OSCP-level methodologyPractical assessment discipline and structured reporting concepts.
PTESPenetration-testing execution standard concepts.
NIST SP 800-115Technical guide for information-security testing and assessment.
OWASP WSTGWeb security testing methodology.
MITRE ATT&CKAdversary behavior and technique mapping.

Authorization requirement: All offensive-security activities represented by this track are intended for systems, networks, applications, identities, and environments where explicit authorization has been granted.

Expected Capability

Understand and conduct structured authorized security assessments while producing evidence-based remediation guidance that strengthens defensive architecture.

Protocols & Standards

Technical Standards Coverage

A consolidated reference of networking, identity, cryptography, threat intelligence, detection, governance, and security-assessment standards represented throughout the roadmap.

Networking & Transport

Core communication protocols used for enterprise networking and security analysis.

Identity & Cryptography

Standards and protocols supporting trust, authentication, authorization, and secure communication.

Threat Intelligence & Detection

Frameworks and formats used to describe, exchange, detect, and analyze adversary behavior.

Security Risk & Governance

Frameworks for governance, controls, risk management, auditing, and security maturity.

Vulnerability & Software Security

Common standards for describing vulnerabilities, severity, weaknesses, and application-security testing.

Security Operations

Operational technologies and practices supporting monitoring, response, investigation, and resilience.

Technical Research

One-Year Technical Review of Pig Butchering Scam Infrastructure

An extensive technical research project led by Mir Ali Shahidi analyzing the operational, financial, and network infrastructure of organized crypto-based "Pig Butchering" (Sha Zhu Pan) syndicates over a 12-month period.

Research Scope & Key Metrics

This independent technical investigation focuses on OSINT, forensic domain telemetry, hosting infrastructure clustering, and automated threat-intelligence export for defensive mitigation.

2,000+

Scam Domains Analyzed

12 Months

Continuous Infrastructure Monitoring

STIX 2.1

Threat Intelligence Feed Output

Core Technical Highlights

Domain Infrastructure Clustering: Tracking ASNs, registrar patterns, DNS configurations, and SSL/TLS certificate reuse across scam networks.
OSINT & Digital Forensics: Reconstructing threat actor infrastructure, deployment templates, and web application components.
STIX 2.1 Intelligence Integration: Formatting indicators, infrastructure objects, and relationship graphs for SOC/SIEM ingestion.
Multilingual Report Distribution: Published technical documentation across 7 languages to support global threat intelligence sharing.