Skip to main content

Security Engineer Journey

You own scanning, triage, and remediation. This is the documentation path in the order you'll need it — each stage says what you should be able to do before moving on.

Typical role: Security Manager — Stages 1 and 5 involve connecting accounts and configuring schedules, which need management access; a Security Analyst can follow Stages 2–4 (see Roles, Teams & API Keys).

Stage 1 — Connect everything you defend​

  1. Connecting Cloud Accounts — AWS, GCP, and Azure with read-only access and copy-paste Terraform.
  2. Required Permissions — the exact per-provider permission sets, and how granting at the org level covers future accounts.
  3. Container Security — connect ECR, Artifact Registry/GCR, ACR, or Docker Hub.
  4. Kubernetes Security — clusters auto-discovered from cloud accounts, or onboarded via read-only kubeconfig.

You can now: see your estate in Asset Inventory.

Stage 2 — Understand how scanning works​

  1. App & Infrastructure Scanning overview — every scan type and the open-source engines behind it.
  2. How Cloud Scans Run — per-provider partitioning, statuses, and the daily/weekly scheduled-scan options.
  3. Native Scans — web (ZAP, Nuclei), network (Nmap), TLS, API scanning, and authenticated scanning.
  4. Compliance & Benchmark Checks — CIS benchmarks and framework mappings for cloud posture.

You can now: run any scan type on demand and explain what a Partial status means.

Stage 3 — Work findings like a queue​

  1. Vulnerability & Risk overview — the detection-to-remediation lifecycle.
  2. Vulnerability Management — deduplication, occurrences, lifecycle statuses, and the prioritization signals: CVSS severity, EPSS, CISA KEV, and P0–P4 priority rank.
  3. Risk Register — promote what matters into governed risks with owners and treatment plans.

You can now: answer "what are our ten most important findings, and why those?"

Stage 4 — Make remediation accountable​

  1. SLA Management — policies by severity and environment, breach dashboard, escalation. Use Create Default Policies to start.
  2. Jira — tickets from findings with two-way status sync; the Integration Catalog for what every other tool does once connected.
  3. Notifications — Slack/Teams/email routing rules so critical findings interrupt someone.
  4. Verify fixes with scans, not tickets: a finding only reaches Verified when a follow-up scan no longer detects it — and a finding that comes back is automatically Reopened. This behavior is documented in Vulnerability Management.

You can now: see every finding currently past its SLA on the Breach Dashboard, and prove closures with scan evidence.

Stage 5 — Automate yourself out of the loop​

  1. Scan Management & Scheduling — the Unified Scheduler: cron/interval schedules, failure notifications, and history.
  2. CLI & CI/CD — gate builds via the GitHub Action or plain REST; SARIF export for other tools.
  3. API & Automation and Automation Use Cases — API keys, release gates, findings export, webhook receivers.
  4. API Reference — the full endpoint catalog when you outgrow the recipes.

You can now: go on holiday. Scans run on schedule, failures notify the channel, criticals become tickets, and builds gate themselves.

Going deeper​

Last updated on