SEC-508 Security

Post-Quantum Migration Programme

Lead an estate-wide cryptographic migration that spans years, vendors and regulators. Learners sequence work by data lifetime and exposure, interrogate supply chain roadmaps, negotiate protocol and interoperability constraints across organisational boundaries, and produce the evidence an auditor and a regulator will ask for. The capstone is a multi-year roadmap with explicit decision points, defended against peer challenge.

B5Advanced

6modules

42skill atoms

1role journey

Curriculum

What this course covers.

6 modules, 42 named skill atoms. Expand any module to see them.

1Programme Framing7 skill atoms

scope and boundary definitiontarget end state per cryptographic classfunding case in business termsgovernance and decision rightsrisk-accepted remainder stated up frontsuccess measures beyond percent completestakeholder map across engineering, legal and procurement

2Risk-Based Sequencing7 skill atoms

crown-jewel data with decade-long confidentiality needsexternally reachable services firstsigning chains with long verification horizonsend-of-life systems that will never migratedependency ordering across serviceswave plans with named owners and datescompensating controls where migration is impossible

3Supply Chain & Vendors7 skill atoms

interrogating vendor PQC roadmapscrypto-agility clauses in contractsSaaS and managed service constraintshardware refresh cycles as the true pacing itemopen-source library maturity assessmentescalation when a vendor slipsalternate control while waiting

4Protocol & Interop Constraints7 skill atoms

partner and B2B integration negotiationstandards and profiles still in fluxindustry mandates and sector profilesnegotiation failure across organisational boundarieslong-lived embedded fleetsstaged bilateral interoperability testingdeprecation clocks for classical-only endpoints

5Evidence & Assurance7 skill atoms

CBOM as a durable audit artefactcontrol mapping to NIST and national guidanceattestation per migrated serviceexception register with compensating controlsanswering internal audit and regulator questionsprogress reporting without vanity metricsindependent verification of claims

6Roadmap Under Uncertainty7 skill atoms

multi-year plan with explicit decision pointsre-planning triggers when standards movepreserving optionality and reversible choicesbudget phasing across financial yearsboard and regulator narrativecapability building and staffing plandefending the roadmap to a challenge panel

Where it fits

SEC-508 in a role journey.

This course appears in 1 of our 45 role journeys. Here is what a learner takes immediately before and after it in each.

Cryptography / PQC Engineer

Capstone stage

SEC-207→SEC-508→journey complete

Roles this course serves

Cryptography / PQC Engineer

The capability ladder

This course is authored to band B5.

Every course we run is written to one rung of the CASI ladder, so a plan can be assembled to take a team from where they are to where they need to be.

What do B1–B6 mean?The CASI Capability Ladder — click to expand

Every course targets a band on the CASI Capability Ladder — our six-band proficiency scale, anchored to open standards (O*NET, ESCO, NICE, NIST AI RMF, Bloom's). A band tells you how deep a course goes, and what evidence proves it.

What the learner can doTypical evidence

AwareUnderstands concepts and vocabulary; uses tools with guidance

Knowledge checks

FoundationPerforms standard tasks correctly in familiar contexts

Guided labs, autograded exercises

PractitionerDelivers complete pieces of work independently

Scenario labs, proctored hands-on exams

ProfessionalHandles production-grade complexity, trade-offs and failure modes

Break-fix drills, design defenses

AdvancedEngineers systems end-to-end under constraints; leads others

Rubric-scored capstones, vivas

ExpertSets direction; recognised authority across teams

Portfolio + panel evaluation

A note on B6. Courses in this catalog target B1–B5. B6 is not taught — it is recognised, through a portfolio and a panel, once someone is setting direction for others. Every journey here is built to land a learner at B5.

Other Security courses at this level.

SEC-205

Run SEC-508 for your team.

This course runs at several lengths depending on how deep you need to go and how much of it your people already have. Tell us who is being trained and we will scope it.

Add it to a training plan Talk to our team Check your team’s level free

Post-Quantum Migration Programme

What this course covers.

SEC-508 in a role journey.

Cryptography / PQC Engineer

Roles this course serves

This course is authored to band B5.

Other Security courses at this level.

Cloud IAM at Scale: Federation & Workload Identity

Incident Response & Recovery Engineering

Detection Engineering & Threat Hunting

Adversary Simulation & Purple Teaming

AI Security: Defending LLM Applications

Securing Agentic AI Systems

Run SEC-508 for your team.