Who it is for
- Companies that want specific developers to review code for security before it merges.
- Security teams growing a developer or junior engineer into an application security role.
- Teams that want developer security training paced to each person and built around their own languages and frameworks.
What you will be able to do
- Engineers who can trace untrusted input through a codebase like yours and spot authentication, authorization and data-flow flaws.
- Findings written the way developers accept them: location, root cause, evidence and fix.
- A habit of reviewing security-relevant and AI-generated changes before merge.
- Training paced to each engineer, so a senior and a junior developer each get what they need.
Before you start
- Each engineer meets the prerequisites of the chosen course; the initial assessment confirms it.
- A contact at your company for scope and scheduling.
- Time set aside for sessions and for the exercises between them.
How it works
Four steps. Each engineer follows their own plan.
ScopingAgree who is trained, in which course and towards what goal.
- Which engineers, and which course: secure code review or web and API penetration testing
- The languages and frameworks your team uses
- Goals for each engineer
- Language and scheduling
Initial assessmentFind each engineer’s starting point.
- A short practical assessment
- A plan for each engineer: order, depth and pace
- Agreed before training starts
One-to-one sessionsEach engineer works with me individually.
- Live online sessions following the course syllabus
- Labs and exercises between sessions, set for their level
- Examples in your team’s languages where possible
- Progress reviewed in every session
Final assessmentEach engineer shows what they can do on their own.
- An independent review of an application built for the course
- A findings report we go through together
- A certificate of completion on passing
Practical work
Labs prepared for the course
Applications and exercises I prepared, with documented flaws, running on each engineer’s machine.
Your team’s languages
Where the course allows, examples and exercises use the languages and frameworks your engineers work with.
Personal review
I review each engineer’s exercises and final report and go through them in our sessions.
Final assessment
Final assessment for each engineer
Each engineer reviews an application built for the course on their own and writes a findings report, which I go through with them.
How it is assessed
- Confirmed findings with evidence
- Correct root cause
- Sound severity reasoning
- Fixes that close the cause
How this course is different
One engineer, one instructor
Each engineer works with me individually, on their own schedule.
Paced per person
A senior engineer and a new hire follow different plans built from the same syllabus.
English, or Arabic
Each engineer is taught in English, or in Arabic if they are an Arabic speaker, which suits mixed teams in the Gulf and the wider region.
Tools you will use
Standards and references
- OWASP Code Review Guide
- OWASP Application Security Verification Standard (ASVS)
- NIST SP 800-218, Secure Software Development Framework
- OWASP Cheat Sheet Series
Case studies you can read now
- Security code review or penetration testing: what should you buy?
- Axios npm compromise: how the trust chain broke
- fast-jwt algorithm confusion: fixed on the third try
Questions about this course
Does this help with NCA requirements in Saudi Arabia?
The National Cybersecurity Authority’s secure coding standard template includes secure coding training for software developers. Individual training of your developers supports that practice. It is not an audit or a certification, and your compliance team decides how to record it.
Can several engineers be trained?
Yes. Each engineer is trained individually, on their own plan and schedule. Several engineers can be covered by one agreement with your company.
Can the exercises use our own code?
Training uses labs I prepare for the course. If you would like examples from your own code, tell me; anything like that is discussed and agreed in writing first.
Is any of it in person?
No. All training is online.
How is it priced?
$1,890 per engineer for one course. Several engineers can be covered by one agreement, set out in a written proposal before training starts.
Next
Engineers who finish one course can continue with the other.