BOARD 01W01-04
Infrastructure & telemetry
Stand up a hardened, loopback-only estate and the first telemetry pipeline.
- Linux hardening & isolation
- Loopback lab in CI
- Wazuh agents + log pipeline
The program
26 weeks. Six boards. Proven.
A self-directed range on real, loopback-only infrastructure. A ranger clears one board every four to five weeks, each a cryptographically signed release tag, and the final board holds a 95% bar enforced by the pipeline. No board is credited on a screenshot.
Boards6 signed releases
Graded days130
Final board bar95%
AI assistance0
program-measureded25519-signed
The six boards
One continuous operation, in six stages.
Each board is a four to five week block that ends in a signed release tag. A board turns green only when the program re-measures the evidence and signs it.
130
graded days
BOARD 02W05-08
SOC & detection engineering
Build detections that fire on fixtures and cut mean time to detect.
- SIEM design & ingestion
- Sigma rules + Suricata/Zeek
- Cases, triage & response
BOARD 03W09-12
Ethical hacking
Reproduce real attacks against your own estate and report like a pro.
- Recon & web exploitation
- Auth / access-control abuse
- Pen-test methodology & report
BOARD 04W13-16
Secure pipeline
Ship fixes through a gate that enforces supply-chain integrity.
- Secure SDLC & CI gate
- Detection-as-code
- Signing with Sigstore / cosign
BOARD 05W17-20
Security architecture
Design resilient systems and run the operation like a lead.
- Reference architecture
- IaC & resilience
- Security operations mgmt
BOARD 06W21-26
Capstone & qualification
Blind qualification simulations, final board, and the hiring narrative.
- Integrated capstone
- Blind qualification sims
- Final board + remediation
How a board is cleared
Day work, every day, until the board is signed.
- Each graded day is reproduced in the loopback lab with a negative control captured.
- Evidence lands under evidence/W##/D### and ships as one pull request against protected main.
- The CI gate runs the autograder; red blocks merge, so only working, recorded work advances.
- A board turns green only on its signed release tag, re-measured by the program.
board1 · infrastructuresigned
board2 · detectionsigned
board3 · ethical hackingin progress
board4 · secure pipelinelocked
final bar95% enforced
Mapped to the standards your auditors use
Every board traces to a framework.
The curriculum is not ad hoc. Each board maps to the control families and technique catalogs a hiring manager and an auditor already recognize.
NIST CSF 2.0
Govern to Recover
Identify, Protect, Detect, Respond and Recover across the full range.
MITRE ATT&CK
14 tactics, 60+ techniques
Every red action and its paired detection is mapped to a technique id.
OWASP Top 10 : 2025
Web & API
Including the OWASP API Top 10 for BOLA, SSRF and auth abuse.
NIST SP 800-53
Control implementation
AC, SI, CM and AU families exercised through real changes and gates.
NIST SP 800-115
Testing methodology
Technical security testing and assessment, applied to each engagement.
NIST SP 800-61
Incident handling
Detection, triage, containment and eradication, proven on evidence.
Ready to prove it?
Clone the range and submit your first signed day today, or bring Qwalora to your workforce as a measured, auditable cohort.