Cybersecurity for Software Engineers

article المحتوى

Master practical cybersecurity and learn how to design systems that are resilient to attacks. This course helps developers take their careers to the next level by understanding security not as an option, but as an essential part of modern architecture.

Why Should Developers Dive Deep into Cybersecurity?
A Skill That Cannot Be Automated
AI is already capable of generating code, automating routine tasks, and accelerating development. But companies aren’t ready to entrust artificial intelligence with protecting systems that handle real data. That is precisely why engineers with security expertise are becoming key specialists.

In this course, you’ll learn to think like an attacker, identify vulnerabilities in architecture and code, and design systems with “security by default”—through hands-on practice, real-world case studies, and lab exercises.

What You’ll Gain

An understanding of attackers’ logic and the ability to identify vulnerabilities as early as the code review stage.
Hands-on experience exploiting and mitigating real-world attacks:
JWT Confusion, SQL Injection, XSS, CSRF, CORS errors, and others.
The ability to design secure authentication, session management, encryption, and API protection without simply copying “off-the-shelf solutions” from the internet.
A vocabulary of key security terms and the confidence to communicate with architects, auditors, and CISOs.
A systematic understanding of modern cybersecurity that remains relevant even as new attack vectors emerge.
What You’ll Learn
How to analyze and prevent real-world attacks
You won’t just memorize the OWASP list—you’ll recreate and fix key vulnerabilities yourself:

SQL Injection
XSS
CSRF
SSRF
JWT attacks
CORS configuration errors
Access control issues
Step-by-step labs will help you see the system through an attacker’s eyes and understand what the risk looks like “in real life.”

Designing Secure-by-Default Systems
You will learn about topics critical to secure architecture:

authentication and authorization;
OAuth 2.0, OIDC, and SAML;
MFA and passkeys;
secure secret storage;
encryption;
API security;
CI/CD security and DevSecOps approaches.
Think like an attacker and a defender at the same time
You’ll learn to identify security issues in architecture and pull requests before they make it to production.

What’s Included in the Program
7 modules · 26+ lessons · 11 labs

Module 1. Foundations
The Modern Web Under Attack: Architectures, Common Points of Failure, and Analysis of HTTP/HTTPS Traffic from an Attacker’s Perspective.

Module 2. Identity & Access Management
Password hashing, sessions and tokens, MFA, JWT, OAuth 2.0, OIDC, SAML, RBAC/ABAC, SSO, and key enterprise IAM practices.

Module 3. OWASP Top 10
Real-world exploitation of vulnerabilities from the OWASP Top 10 in labs and analysis of practical examples.

Module 4. Common Attack Patterns
CSRF, phishing, social engineering, session attacks, and building compromise chains for production systems.

Module 5. API & Cross-Origin Security
API protection, rate limiting, preventing abuse attacks, configuring CORS, and analyzing common configuration errors.

Module 6. Defensive Security & Infrastructure
Security headers, CSP, HSTS, WAF, DDoS protection, and hardening production services.

Module 7. Secure Development Lifecycle
DevSecOps, shift-left practices, automation of security testing, secret hunting, and management of vulnerable dependencies.

Table of Contents
1 Web & Network Basics
2 Modern Web Architecture
3 Auth 1 Hashing, Salt and Pepper
4 Auth 2 Sessions, Tokens and Cookies
5 MFA
6 Passwordless and Passkeys
7 JWT
8 OpenID Connect (OIDC)
9 Enterprise IAM (SSO, SCIM)
10 OWASP Top 10 Part 1
11 OWASP Top 10 Part 2
12 Session & Request Attacks
13 Social Engineering & Phishing Awareness
14 API Security Essentials
15 CORS & Cross-Origin Security
16 WAFs & DDoS Protection
17 Shift-Left Security & DevSecOps
18 Automated Security Testing