Target: Penetration Testing / VAPT / AppSec / Product Security / Security Engineer roles
Method: Learn → Understand → Practice → Lab → Project → Interview Questions → Explain
| Depth | Meaning |
|---|---|
| D5 | Specialist / research-level |
| D4 | Strong professional / deep interview level |
| D3 | Working professional / strong interview level |
| D2 | Fundamentals + common interview questions |
| D1 | Awareness |
| Subject | Target Depth | Importance |
|---|---|---|
| Computer Networks | D4 | 🔴🔴🔴🔴🔴 |
| Operating Systems | D4 | 🔴🔴🔴🔴🔴 |
| Web Technologies | D4–D5 | 🔴🔴🔴🔴🔴 |
| Web Application Security | D5 | 🔴🔴🔴🔴🔴 |
| API Security | D4–D5 | 🔴🔴🔴🔴🔴 |
| DBMS & SQL | D3–D4 | 🔴🔴🔴🔴🔴 |
| Data Structures & Algorithms | D3 | 🔴🔴🔴🔴🔴 |
| Linux | D4 | 🔴🔴🔴🔴🔴 |
| Windows Security | D3–D4 | 🔴🔴🔴🔴 |
| Active Directory | D4 | 🔴🔴🔴🔴🔴 |
| Python | D4 | 🔴🔴🔴🔴🔴 |
| JavaScript | D4 | 🔴🔴🔴🔴 |
| Bash / Shell Scripting | D3–D4 | 🔴🔴🔴🔴 |
| PowerShell | D3–D4 | 🔴🔴🔴🔴 |
| C & Memory | D3–D4 | 🔴🔴🔴 |
| OOP | D3 | 🔴🔴🔴🔴 |
| Software Engineering | D3 | 🔴🔴🔴 |
| System Design | D3 | 🔴🔴🔴🔴 |
| Distributed Systems | D2–D3 | 🟠🟠🟠 |
| Computer Architecture | D2–D3 | 🟠🟠🟠 |
| Cloud Computing & Security | D3–D4 | 🔴🔴🔴🔴 |
| Identity & Access Management | D3–D4 | 🔴🔴🔴🔴 |
| Secure Coding & Code Review | D3–D4 | 🔴🔴🔴🔴 |
| Threat Modeling | D3 | 🔴🔴🔴 |
| DevSecOps | D3 | 🔴🔴🔴 |
| Docker | D3 | 🟠🟠🟠 |
| Kubernetes | D2–D3 | 🟠🟠 |
| Cryptography | D3 | 🟠🟠🟠 |
| Penetration Testing / VAPT | D4 | 🔴🔴🔴🔴🔴 |
| Bug Bounty & Recon | D4 | 🔴🔴🔴🔴 |
| Security Tools | D3–D4 | 🔴🔴🔴🔴 |
| Vulnerability Management | D3 | 🔴🔴🔴 |
| Security Reporting | D4 | 🔴🔴🔴🔴 |
| Security Fundamentals | D4 | 🔴🔴🔴🔴🔴 |
| Malware Analysis | D2–D3 | 🟠🟠🟠 |
| Reverse Engineering | D2–D3 | 🟠🟠 |
| Assembly | D2–D3 | 🟠🟠 |
| Blue Team / Detection | D2–D3 | 🟠🟠 |
| SIEM / EDR / IDS / IPS | D2–D3 | 🟠🟠 |
| AI/ML Security | D2–D3 | 🟠🟠🟠 |
| Mobile App Development | D2–D3 | 🟠🟠 |
| Mobile Application Security | D3 | 🟠🟠🟠 |
| Security Architecture | D3–D4 | 🔴🔴🔴🔴 |
| MITRE ATT&CK | D3 | 🔴🔴🔴 |
| OWASP | D4 | 🔴🔴🔴🔴🔴 |
| Security Standards & Compliance | D2 | 🟡🟡 |
| Communication & Behavioral Interview | D4 | 🔴🔴🔴🔴🔴 |
| Java | D3 | 🟠🟠🟠 |
| PHP | D2–D3 | 🟡🟡 |
| Go | D2–D3 | 🟡🟡 |
| C++ / Rust / Kotlin | D1–D2 initially | 🟢 |
For every major subject:
Learn → Implement → Lab → Task → Mini Project → Attack/Test → Fix → Retest → Report → Explain
The goal is not simply to finish theory.
Understand → Build → Break → Fix → Defend
- Web Application Security
- API Security
- Computer Networks
- Operating Systems
- Linux
- Python
- Windows / Active Directory
- JavaScript
- DBMS / SQL
- Recon / Bug Bounty
- Burp Suite
- Security Fundamentals
- Security Reporting
- Cloud Security
- Secure Coding / Code Review
- PowerShell
- C / Memory
- Software Engineering
- Identity / IAM
- DevSecOps
- DSA
- OOP
- System Design
- Threat Modeling
- Docker
- Mobile Security
- Cryptography
- Vulnerability Management
- Distributed Systems
- Computer Architecture
- Kubernetes
- Malware Analysis
- Reverse Engineering
- Blue Team / Detection
- AI/ML Security
- Mobile Development
- Compliance / Standards
- Advanced cryptography
- Advanced malware research
- Advanced exploit development
- iOS development initially
Each major topic should eventually follow:
📁 Topic
├── 📖 Concepts
├── 🎯 Interview Questions
├── 🧪 Practicals
├── 🧩 Tasks
├── 🛠️ Tools
├── 🚀 Mini Project
├── 🏗️ Major Project
├── 📝 Notes
└── 🎤 Interview Explanation