Cyber Security Course with Placement Support

Command-line fluency on the two operating systems you will attack and defend, plus enough Bash and Python to automate the boring parts.

• Linux file system, permissions and services
• Bash scripting for log parsing
• Windows internals, Active Directory basics
• PowerShell for administrators and attackers
• Python for security: sockets, requests, parsing
• Cron, systemd and persistence
• Users, groups, sudo and privilege
• Hardening checklists (CIS benchmarks)

Module outcome: You can harden a fresh Ubuntu and Windows Server build and script a log parser in Python.

The attacker's workflow from footprinting to enumeration, run against deliberately vulnerable machines on our lab network.

• Rules of engagement and legal boundaries
• OSINT: Shodan, Google dorks, Maltego
• Nmap scanning and service fingerprinting
• Enumeration of SMB, SNMP, FTP and web
• Vulnerability scanning with Nessus and OpenVAS
• Password attacks with Hydra and Hashcat
• Metasploit framework fundamentals
• Documenting findings as you go

Module outcome: You can take a target from an IP address to an initial foothold and document every step.

Where most real breaches happen. Every vulnerability is exploited by hand in Burp Suite and then fixed in code, because you will be asked to do both.

• Burp Suite proxy, repeater and intruder
• SQL injection, blind and time-based
• Cross-site scripting: reflected, stored, DOM
• Authentication and session flaws
• IDOR, access control and business logic bugs
• SSRF, XXE and file upload attacks
• API security and JWT weaknesses
• Secure coding remediation patterns

Module outcome: You can complete OWASP Juice Shop and write remediation guidance for each finding.

The engagement discipline we sell to clients: scoping, methodology, exploitation, privilege escalation and the report that gets remediation funded.

• VAPT methodology: PTES and OWASP testing guide
• Scoping documents and authorisation
• Network penetration testing walkthrough
• Linux and Windows privilege escalation
• Lateral movement and pivoting
• Post-exploitation and cleanup
• CVSS scoring and severity
• Writing an executive and technical report

Module outcome: You deliver a full VAPT report on a multi-host lab environment, graded by our audit team.

The defender's side: collecting logs, writing detections and working alerts the way an L1 and L2 analyst does on shift.

• SOC roles, tiers and shift workflow
• Log sources: syslog, Windows events, cloud
• Splunk search and dashboards
• Wazuh and ELK deployment
• Writing detection rules and Sigma
• Alert triage and false positive tuning
• Threat intelligence feeds and IOCs
• Ticketing and escalation practice

Module outcome: You triage a simulated shift of 50 alerts and correctly escalate the three real intrusions.

What happens after the alert: containment, evidence handling, memory and disk analysis, and the post-incident report.

• NIST incident response lifecycle
• Playbooks for phishing, ransomware, insider
• Evidence acquisition and chain of custody
• Disk forensics with Autopsy
• Memory analysis with Volatility
• Malware triage basics and sandboxing
• Business continuity and backups
• Post-incident review and lessons learned

Module outcome: You reconstruct a ransomware incident timeline from disk and memory images.

Most of our clients run on AWS, so you learn to audit and fix the misconfigurations behind real cloud breaches.

• Shared responsibility model
• IAM policies, roles and least privilege
• S3 exposure and encryption
• VPC, security groups and network ACLs
• CloudTrail, GuardDuty and Config
• Container and Kubernetes security basics
• Secrets management
• Cloud security posture assessment

Module outcome: You audit a deliberately misconfigured AWS account and remediate every critical finding.

The frameworks that decide budgets: ISO 27001, SOC 2, the DPDP Act and CERT-In directions, taught by the team that helps clients pass audits.

• Risk assessment and treatment
• ISO 27001 controls and audit process
• SOC 2 trust criteria
• DPDP Act 2023 obligations
• CERT-In 2022 directions and reporting
• PCI DSS essentials
• Security policies and awareness
• Vendor and third-party risk

Module outcome: You produce a gap assessment against ISO 27001 Annex A for a sample organisation.

A supervised end-to-end audit of a live application with a written report, presented to our security lead, followed by mock interviews and portfolio review.

• Capstone scoping and authorisation
• Full VAPT of a staging application
• SOC monitoring during the engagement
• Executive presentation of findings
• Certification prep: CEH, Security+, CySA+
• Resume, LinkedIn and GitHub review
• Mock technical and HR interviews
• Placement pipeline onboarding

Module outcome: You leave with a graded audit report, a portfolio and a rehearsed interview story.