← All 186 courses
SEC-202 Security

AWS Security Engineering

Secure AWS estates at professional depth: IAM policy craft including permission boundaries, org-wide guardrails with SCPs, GuardDuty detection with hands-on finding response, network protections, KMS key policy, and centralized logging — closing with response to seeded findings under time pressure.

B4Professional
6modules
42skill atoms
2role journeys
Curriculum

What this course covers.

6 modules, 42 named skill atoms. Expand any module to see them.

1IAM Mastery7 skill atoms
policy evaluation logicboundariesaccess analyzeridentity vs resource policy interactionexplicit deny precedencecondition keys such as aws:PrincipalOrgIDPassRole & confused-deputy risk
2Org Guardrails7 skill atoms
SCPscontrol tower conceptsaccount strategyOU design for blast radiusdeny-list vs allow-list SCP stylesregion & service restriction guardrailsroot account lockdown
3Detection Stack7 skill atoms
GuardDutySecurity Hubfinding triage labfinding severity normalizationEventBridge routing to responsesuppression rules & alert noiseInspector/Macie coverage gaps
4Network & Data Protection7 skill atoms
SG disciplineWAFKMS key policiessecurity group vs NACL semanticsVPC endpoint policiesWAF managed rules & false positivesS3 block-public-access enforcement
5Logging Architecture7 skill atoms
CloudTrail/Config centralizationintegrityorganization trail designlog file validationS3 object lock retentionConfig rules & conformance packscross-account log delivery
6Finding Response Drill7 skill atoms
seeded findingsinvestigateremediatereportCloudTrail timeline reconstructionexposed key containment & rotationrunbook writeup under time pressure
Where it fits

SEC-202 in the role journeys.

This course appears in 2 of our 45 role journeys. Here is what a learner takes immediately before and after it in each.

Cloud Security Engineer

Practitioner stage
CL-101SEC-202SEC-203

IAM Engineer

Professional stage
SEC-207SEC-202SEC-209

Roles this course serves

The capability ladder

This course is authored to band B4.

Every course we run is written to one rung of the CASI ladder, so a plan can be assembled to take a team from where they are to where they need to be.

What do B1–B6 mean?The CASI Capability Ladder — click to expand

Every course targets a band on the CASI Capability Ladder — our six-band proficiency scale, anchored to open standards (O*NET, ESCO, NICE, NIST AI RMF, Bloom's). A band tells you how deep a course goes, and what evidence proves it.

What the learner can doTypical evidence
B1
AwareUnderstands concepts and vocabulary; uses tools with guidance
Knowledge checks
B2
FoundationPerforms standard tasks correctly in familiar contexts
Guided labs, autograded exercises
B3
PractitionerDelivers complete pieces of work independently
Scenario labs, proctored hands-on exams
B4
ProfessionalHandles production-grade complexity, trade-offs and failure modes
Break-fix drills, design defenses
B5
AdvancedEngineers systems end-to-end under constraints; leads others
Rubric-scored capstones, vivas
B6
ExpertSets direction; recognised authority across teams
Portfolio + panel evaluation

A note on B6. Courses in this catalog target B1–B5. B6 is not taught — it is recognised, through a portfolio and a panel, once someone is setting direction for others. Every journey here is built to land a learner at B5.

Next step

Run SEC-202 for your team.

This course runs at several lengths depending on how deep you need to go and how much of it your people already have. Tell us who is being trained and we will scope it.

Add it to a training plan Talk to our team Check your team’s level free