Career focus Preparation for certification and roles in EU/US companies

Format 1:1 mentorship + practice on real cases

Application Security / Web and API security

Become an Application Security Engineer for EU/US companies: preparation for work and certification

1:1 mentorship. Transition from QA/Dev to Security in the international market. Practice with real Application Security processes.

Get an Application Security growth plan on WhatsApp

Code security analysis (SAST / DAST / IAST)
We work through real defects, false positives, prioritization, and how to drive findings to fixes in code and CI.

Cloud security (Docker, AWS / Azure)
Images and container runtime, secrets, IAM, and common cloud misconfigurations — in the context of how the app runs in production.

OWASP Top 10, API Security and vulnerability management
From threat modeling and abuse cases to a bug-bounty mindset: how to find, document and fix risks without backlog chaos.

10+

years

50+

students

1:1

format

Seats left: 3/5

Book a technical intro call on WhatsApp

Flexible

1:1 or small group
Fits your schedule

Who it’s for

WHO IS THIS MENTORSHIP FOR?

For people in Europe and the US who want to grow in Application Security — tailored to your level and goals

QA engineers tired of routine

If you’re stuck in regression and want growth: we’ll add a security mindset, OWASP/API checks, and scenarios that are valued in the international market.

Developers transitioning to Security

Move into Application Security using what you already know: reading code, architecture, APIs. Learn to find and fix vulnerabilities like an engineer — not “by checklist”.

For those ready for intensive learning

This isn’t “easy money”. You’ll need discipline and a lot of practice: HTML/JavaScript fundamentals, networking/HTTP, and real AppSec tasks.

For relocation to EU / US

International market context: how AppSec is described in hiring, what to expect from security reviews, and how to present experience without marketing fluff.

Program

WHAT DO WE COVER?

A practical program tailored to your stack: from code and APIs to pipelines and cloud

Engineering fundamentals for Application Security

HTTP/TLS, sessions and authentication, logging and tracing, Linux and scripting, working with databases and APIs — plus HTML & JavaScript as a baseline to confidently analyze incidents, artifacts, and common OWASP/API scenarios.

HTTP and trust boundaries: request/response, cookies, redirects, common protocol- and server-logic issues. We cover HTML and JavaScript as a baseline — markup, DOM, and minimal JS used later in OWASP/API deep-dives.

Linux and Bash: CLI basics, scripting, and navigation in Linux systems.

Databases: SQL from a security perspective: injections, access control, typical data-layer issues, and how to catch them in review and tests.

API debugging: Postman/Insomnia, negative scenarios, reproducing race conditions and common authZ bugs.

Threats, trust model and crypto in applications

Threat modeling, trust boundaries, common crypto-usage mistakes, secrets and keys — in a practical form for services and APIs.

Threat modeling: abuse cases, risk prioritization, and turning findings into engineering tasks.

Cryptography: basics of encryption, hashing, and digital signatures.

Identity & sessions: OAuth/OIDC/JWT (where it breaks), refresh flows, typical session-management mistakes.

OWASP Top 10 in real code

How defects look in services: SQLi/XSS/CSRF/SSRF, common anti-patterns, and safer alternatives at the architecture level.

OWASP Top 10: core web application vulnerabilities.

Attacks: SQL Injection, XSS, CSRF, SSRF and other techniques.

Defense: mitigation techniques for common attacks.

API Security

Security of REST, GraphQL, and SOAP APIs. Authentication, authorization, and finding common API vulnerabilities.

REST API: RESTful API security and practical protection methods.

GraphQL: GraphQL security specifics and common risk patterns.

Authentication: JWT, OAuth, API keys and safe usage patterns.

DevSecOps, SAST/DAST/IAST and cloud for applications

Embedding checks into CI/CD, dependency policies, secret scanning, Docker containers, and common AWS/Azure controls around the service.

DevSecOps: Quality gates, exception policy, metrics, and collaboration with engineering/SRE.

SAST / DAST / IAST: How to choose, tune, and interpret results to reduce noise and speed up remediation.

Cloud & platform: Docker (images, privileges, secrets), IAM and network perimeter in AWS/Azure; typical misconfigurations impacting applications.

In sessions

HOW WE WORK IN SESSIONS

Repositories, CI, logs, and traffic — the same style as real product Application Security (process illustrations)

Linux terminal: safe practice commands — Terminal & Linux: commands, scripts, reproducibility, and artifacts for analysis

Code editor: scripts and automation review — Code & IDE: reading existing code, spotting anti-patterns and trust boundaries

Network diagram: nodes and connections — Networks & topology: how traffic moves and where trust models break

Web application security — Web/App security: sessions, trust boundaries, common defects and controls

HTTP requests and responses analysis — Requests & responses: traffic analysis, log correlation, evidence for tickets

Online lesson: mentor’s screen — Live review: mentor’s screen, Q&A, and review of your steps

Format

HOW DOES THE MENTORSHIP WORK?

Flexible format adapted to your goals

1:1 sessions

A personal approach focused on your goals. The track is adapted to your level and pace.

Practice on real cases

We analyze real incidents and typical Application Security scenarios — what happens in real products, not abstract training theory.

Support and mentoring

Support in messenger between sessions: Q&A, help with tasks, and career guidance.

Flexible schedule

We adapt to your work schedule. Sessions can be rescheduled, and the pace is tailored.

Instructor

WHO MENTORS YOU?

VITALI BRUNOVSKI

APPLICATION SECURITY & QUALITY AUTOMATION

Experience

10+ years in security and quality automation: from hands-on investigations to implementing processes around applications and APIs.

Approach

Focus on reproducibility: how to prove impact, reduce fix cost, and align with engineering using real artifacts.

Safety & ethics

We work within legal scenarios and company policies: no illegal demonstrations, focus on reducing risk for the product and users.

FAQ

Do I need programming skills?

Not strictly required — but helpful: the more confident you are with code logic and HTTP, the faster we go hands-on. If you’re new to programming, we can cover JavaScript fundamentals specifically for AppSec tasks and checks.

What do I need?

A computer/laptop with internet access. We’ll install the required tools together in the first session. Most tools are free or have free tiers.

How long does it take?

It depends on your goal (strengthen current role vs transition) and the format. For a deep track, a common baseline is ~6 months with regular sessions, but the plan is always adapted to your context.

Reviews